Installing an SSL Certificate

The following topic describes how to install an SSL certificate for jetty.

To install SSL certificate for jetty:

Create a keystore using keytool, supplied with the Sun JDK. When creating a certificate, you must specify keystorePassword and keyPassword.

> jdk/bin/keytool -genkey -alias my-cert -keyalg RSA
        -keystore .mykeystore

Create a Certificate Request "CSR", into the file cert.csr.

Copy Code

> jdk/bin/keytool -certreq -alias my-cert -file cert.csr
        -keystore .mykeystore

Send your CSR to a Certificate Authority such as Verisign or XRamp, and purchase a SSL certificate. The CA will return a cert.crt file to you. The following URL can be used for testing https://www.thawte.com/cgi/server/test.exe
Convert cert.crt from PEM to DER (cert.der). You can use openssl to convert it:

Copy Code

openssl x509 -in cert.crt -out cert.der –outform DER

Import the certificate into the keystore:

Copy Code

> jdk/bin/keytool -import -alias my-cert -file cert.der -keystore .mykeystore

Edit jetty.xml:

Copy Code

<Call name="addListener">
    <Arg>
      <New class="org.mortbay.http.SunJsseListener">
        <Set name="Port">8443</Set>
        <Set name="MinThreads">5</Set>
        <Set name="MaxThreads">100</Set>
        <Set name="MaxIdleTimeMs">30000</Set>
        <Set name="LowResourcePersistTimeMs">2000</Set>
        <Set name="Keystore"><SystemProperty name="jetty.home"
             default="."/>/.mykeystore</Set>
        <Set name="Password">keystorePassword</Set>
        <Set name="KeyPassword">keyPassword</Set>
      </New>
    </Arg>
  </Call>

Change the protocol and port for siteURL in trackstudio.properties.

Copy Code

# URL of your site. Host name and port should be correct.
# We use this address in e-mail notification messages.

trackstudio.siteURL https://localhost:8443/TrackStudio

Launch jetty.
Open https://localhost:8443/TrackStudio

To create a self-signed certificate:

Create a Certificate Authority by running:

Copy Code

perl ./CA.pl -newca

Copy Code

./CA -newca

Create a certificate request:

Copy Code

jdk/bin/keytool -certreq -alias my-cert -file cert.csr
        -keystore .mykeystore

Create a certificate:

Copy Code

openssl ca -config /usr/share/ssl/openssl.cnf
           -out cert.crt -infiles cert.csr

Verify the certificate:

Copy Code

openssl verify -CAfile ./demoCA/cacert.pem cert.crt

Convert the certificate from PEM to DER:

Copy Code

openssl x509 -in cert.crt -out cert.der -outform DER

Import cert.der into the keystore.

Notes

Please note that some functionality (Excel reports, Save target as... when file download, etc) will not work with a demo cert under MS Internet Explorer. Use a certificate from a Certificate Authority such as Verisign or XRamp to solve this issue.

Topic path: Installation Guide > UNIX Installation > Installing an SSL Certificate