I'm working in an environment with a working Microsoft Active Directory Certificate Services (MS ADCS) PKI. In that environment, I'm deploying this Java app which uses a java key store to manage the keys and certificates for its https server. The de facto tool for administration seems to be keytool.exe
. The documentation for keytool
can be found here.
A generally-recommended method of generating a key pair, creating a certificate request, and importing the the certificate is as something like this:
Generate Key Pair
keytool -genkey -keyalg RSA -keysize 2048 -alias securekey -keystore keystore
Generate Certificate Request
keytool -certreq -alias securekey -keystore keystore -file NewCertRequest.csr
Import Root Certificate
keytool -importcert -alias root -keystore keystore -file rootcert.csr
Import Intermediate Certificate
keytool -importcert -alias intermediateX -keystore keystore -file intcert.csr
<= repeat this for each intermediate certificate, in orderImport Newly-Signed Certificate
keytool -importcert -alias securekey -keystore keystore -file NewlySignedCert.csr
keytool and Establishing a Certificate Chain
Step 3 establishes the trust anchor. keytool
'prints out' the certificate for your review and requires you to answer "yes" to explicitly trust that certificate.
Step 4 imports the intermediate certificates in the trust chain that link from the root to the newly signed certificate. When you import each successive subordinate intermediate certificate, keytool
automatically trusts them (or at least it's supposed to). The way that keytool
signals that it has a complete certificate path to a trust anchor (i.e. the root certificate from step 3) is subtle and weakly documented:
If the certificate is not found and -noprompt option is not specified, the information of the last certificate in the chain is printed out, and the user is prompted to verify it.
The unwritten corollary to this is as follows: "If keytool can verify a complete certificate path to a trust anchor, it will not print out any certificate."
You can confirm this by using, for example, the GeoTrust Global CA
and Google Internet Authority G2
certificates for steps 3 and 4, respectively. (Find these certs behind the green lock when you go to https://www.google.com.) keytool
will print out the root GeoTrust Global CA
and ask you to explicitly trust it. After trusting GeoTrust Global CA
keytool
will import Google Internet Authority G2
without printing out any certificate thus indicating that keytool
trusts Google Internet Authority G2
.
keytool can't chain my Microsoft ADCS certs
When I attempt to build the trust chain using my MS ADCS certificates (a la the google chain described above) keytool
fails to establish a chain of trust. I'm not sure what, exactly, the difference is, but the failure is betrayed when keytool
prints out the certificate in step 4 indicating that it didn't establish the trust chain up to the already-trusted root certificate from step 3.
What to do?
Given that keytool
doesn't seem to be able to chain MS ADCS certs, what should I do for applications in our environment that use the java key store for managing keys and certificates?
JKS
.PKCS12
might be better suited for your needs (just use.pfx
file you might already have). If you do use tomcat, just define theKeystoreType
in theserver.xml
file.