1

I'm working in an environment with a working Microsoft Active Directory Certificate Services (MS ADCS) PKI. In that environment, I'm deploying this Java app which uses a java key store to manage the keys and certificates for its https server. The de facto tool for administration seems to be keytool.exe. The documentation for keytool can be found here.

A generally-recommended method of generating a key pair, creating a certificate request, and importing the the certificate is as something like this:

  1. Generate Key Pair keytool -genkey -keyalg RSA -keysize 2048 -alias securekey -keystore keystore

  2. Generate Certificate Request keytool -certreq -alias securekey -keystore keystore -file NewCertRequest.csr

  3. Import Root Certificate keytool -importcert -alias root -keystore keystore -file rootcert.csr

  4. Import Intermediate Certificate keytool -importcert -alias intermediateX -keystore keystore -file intcert.csr <= repeat this for each intermediate certificate, in order

  5. Import Newly-Signed Certificate keytool -importcert -alias securekey -keystore keystore -file NewlySignedCert.csr

keytool and Establishing a Certificate Chain

Step 3 establishes the trust anchor. keytool 'prints out' the certificate for your review and requires you to answer "yes" to explicitly trust that certificate.

Step 4 imports the intermediate certificates in the trust chain that link from the root to the newly signed certificate. When you import each successive subordinate intermediate certificate, keytool automatically trusts them (or at least it's supposed to). The way that keytool signals that it has a complete certificate path to a trust anchor (i.e. the root certificate from step 3) is subtle and weakly documented:

If the certificate is not found and -noprompt option is not specified, the information of the last certificate in the chain is printed out, and the user is prompted to verify it.

The unwritten corollary to this is as follows: "If keytool can verify a complete certificate path to a trust anchor, it will not print out any certificate."

You can confirm this by using, for example, the GeoTrust Global CA and Google Internet Authority G2 certificates for steps 3 and 4, respectively. (Find these certs behind the green lock when you go to https://www.google.com.) keytool will print out the root GeoTrust Global CA and ask you to explicitly trust it. After trusting GeoTrust Global CA keytool will import Google Internet Authority G2 without printing out any certificate thus indicating that keytool trusts Google Internet Authority G2.

keytool can't chain my Microsoft ADCS certs

When I attempt to build the trust chain using my MS ADCS certificates (a la the google chain described above) keytool fails to establish a chain of trust. I'm not sure what, exactly, the difference is, but the failure is betrayed when keytool prints out the certificate in step 4 indicating that it didn't establish the trust chain up to the already-trusted root certificate from step 3.

What to do?

Given that keytool doesn't seem to be able to chain MS ADCS certs, what should I do for applications in our environment that use the java key store for managing keys and certificates?

2
  • Have you considered using another certificate type? tomcat applications can accept other keystore types, not just JKS. PKCS12 might be better suited for your needs (just use .pfx file you might already have). If you do use tomcat, just define the KeystoreType in the server.xml file.
    – DavidGamba
    Jun 10, 2014 at 19:13
  • That's an interesting suggestion. I can't remember how far down that path I went. I'll check to see if the application has a way to specify KeystoreType. The app in question is the proprietary app for network server shutdown by APC.
    – alx9r
    Jun 10, 2014 at 22:03

3 Answers 3

1

Use KeyStore Explorer

After much trial-and-error I gave up on keytool for chaining MS ADCS certificates. The method that finally worked for me was to use Keystore Explorer to ingest a "bundle" of all the certificates chained together.

Prepare the Certificate 'Bundle'

There are other users of keytool that recommended importing certificate chains by creating a concatenation of base64-encoded X.509 certificates. I suspect this file format has a proper, official name, but I'm not sure what it is. Essentially, you end up with a text file that looks like this:

-----BEGIN CERTIFICATE-----
MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
...
5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEBDCCAuygAwIBAgIDAjppMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
...
yuGnBXj8ytqU0CwIPX4WecigUCAkVDNx
-----END CERTIFICATE-----
...

The bottom-most certificate in the file is the root certificate, above that is the first subordinate cert in the chain above that is the second all the way up to the newly-signed certificate for the device you're working on which is at the top.

All of this can be prepared by exporting certificates using Windows' built-in crypto shell extensions to export base64-encoded X.509 certificates and notepad to concatenate them.

Trying to Import the Bundle Using keytool fails

I tried importing the bundle using keytool like this:

keytool -importcert -alias securekey -keystore keystore -file bundle.cer

Based on the documentation keytool should be happy with this, but I get this error:

keytool error: java.lang.Exception: Incomplete certificate chain in reply

This is no surprise. After all, these are the same certificates with which keytool couldn't establish a trust chain when the certs were imported individually.

Import CA Reply into Keystore Using "KeyStore Explorer"

Open the keystore (i.e. the file called keystore in the question and this answer) with KeyStore Explorer. Right-click the key-pair and select Import CA Reply and point it to the bundle of base64-encoded X.509 certificates you prepared earlier.

In my case, at least, KeyStore Explorer succeed at importing the bundle of MS ADCS certificates where keytool failed. Once the bundle was imported, I could continue to administer the key store with keytool, and ultimately the app that depends on the key store for its https server is successfully using our MS ADCS certificates.

0

I encountered a similar issue (though I was using the VMware Linux version) and was able to use the following similar method of solving the issue: Required information: - Putty was used for SSH connection to the PCNS server - an FTP client for transferring the files back and forth - internal Microsoft ADCS - finally I was using APC PCNS 3.1 VMware

Useful URL: http://www2.schneider-electric.com/resources/sites/SCHNEIDER_ELECTRIC/content/live/FAQS/176000/FA176886/en_US/Replacing%20the%20SelfSigned%20Cert%20on%20PowerChute_Linux.pdf

• Modify file '/opt/APC/PowerChute/group1/pcnsconfig.ini' o In the section [NetworkManagementCard] add the line KeystorePassword = your_password

• command: service PowerChute stop

• command: opt/APC/PowerChute/jre1.7.0_45/bin/keytool -genkey -alias securekey -keyalg RSA -keystore /opt/APC/PowerChute/group1/keystore -keysize 2048

• command: opt/APC/PowerChute/jre1.7.0_45/bin/keytool -certreq -alias securekey -keystore /opt/APC/PowerChute/group1/keystore -file /opt/APC/PowerChute/group1/newpowerchute.csr

• Combine chain of certs (*.cer) into 1 bundled file (bundle.cer): web server (top), intermediate (middle), root (bottom)

• command: opt/APC/PowerChute/jre1.7.0_45/bin/keytool -import -trustcacerts -alias securekey -file /opt/APC/PowerChute/group1/bundle.cer -keystore /opt/APC/PowerChute/group1/keystore

• command: service PowerChute start

Regards,

Jamie

5
  • I think you omitted the step where you signed the newpowerchute.csr. How did you do achieve that here?
    – alx9r
    Aug 1, 2014 at 15:13
  • I'm also wondering how you confirmed that your final keytool -import command succeeded. Keytool -import likes to silently fail.
    – alx9r
    Aug 1, 2014 at 15:17
  • Once the 'newpowerchute.csr' file was created and I FTP'd it across to my Windows machine, I copied and pasted the file contents into my internal Microsoft AD CA web page using the default Web Server template. The CA auto accepted the request and I downloaded the Base 64 encoded certificate.
    – Jamie
    Aug 5, 2014 at 7:37
  • As for the final import using keytool. When the command was run it had verbose output and I saw that all the certificates in the chain were in there. You can also run the 'list' switch with keytool and see what certificates are in the keystore.
    – Jamie
    Aug 5, 2014 at 7:41
  • It is interesting that keytool succeeded importing the bundled certs where it failed in my case. Thanks for the details.
    – alx9r
    Aug 5, 2014 at 12:12
0

Note for PCNS Windows users:

Requirement: Install valid third-party certificate to PCNS web server (TCP:6547)

PKI scheme: Root CA -> Issuing CA -> Web server

Chapter "Appendix: Replacing the Default PowerChute SSL Certificate" from PCNS Security Handbook.pdf stands that we need to follow these steps:

  1. Configure password for Java keystore file "C:\Program Files\APC\PowerChute\group1\keystore" [GOOD]
  2. Delete existing keystore file "C:\Program Files\APC\PowerChute\group1\keystore" [STANGE/GOOD]
  3. Generate new RSA keys for keystore file "C:\Program Files\APC\PowerChute\group1\keystore" [GOOD]
  4. Generate new CSR for keystore file "C:\Program Files\APC\PowerChute\group1\keystore" [NOT PERFECT/GOOD]
  5. Sign CSR using self-signed CA using openssl [NOT PERFECT]
  6. Import Root CA to the keystore file "C:\Program Files\APC\PowerChute\group1\PowerShute-keystore" [STRANGE/LEADS TO ERRORS]
  7. Import certificate signed by Root CA to the keystore file "C:\Program Files\APC\PowerChute\group1\PowerShute-keystore" [STRANGE/LEADS TO ERRORS]

After following officially defined procedure I failed to install Enterprise CA signed certificate to the PCNS web server. I cannot even understand why should we need to use "PowerChute-keystore" file for certificate import process if we generate RSA keys inside "keystore" file

I created below procedure that works in my environment. All commands were executed from within PowerShell with elevated rights because keytool.exe requires admin privileges to delete entries from keystore file. I used external OpenJDK from Microsoft that was installed with JAVA_HOME environment variable. Example keystore password was set to changeme123, but better use another one. Enterprise CA was configured with auto-approve valid certificate requests. Certificate of Enterprise CA and Root CA added to trust stores on all domain clients using GPO

# Java keystore password
$jksPwd = 'changeme123'

# Current host DNS name (hostname)
$hostNameShort = $env:COMPUTERNAME.ToLower()

# Current host DNS name (FQDN)
$hostNameLong = $env:COMPUTERNAME.ToLower() + '.' + $env:USERDNSDOMAIN.ToLower()

# Current host IP address
$hostIp = (Get-NetIPAddress -AddressFamily IPV4 -InterfaceAlias 'Ethernet0').IPAddress

# Enterprise PKI template name (web server)
$pkiTpl = 'WebServer'

# Enterprise PKI server FQDN
$pkiHost = 'entpki.example.com'

# Enterprise PKI server subject
$pkiSubj = 'Example Issuing CA'

# Get to the PCNS group1 folder
Set-Location -Path 'C:\Program Files\APC\PowerChute\group1\'

# Migrate keystore from JKS to PKCS12 format (there was a warning to use newer format for keystore file which I choose to follow up)
& "${env:JAVA_HOME}bin\keytool.exe" -importkeystore -srckeystore keystore -destkeystore keystore -deststoretype pkcs12 -srcstorepass $jksPwd

# Delete current certificate with key (requires Admin privileges)
& "${env:JAVA_HOME}bin\keytool.exe" -delete -alias securekey -keystore keystore -storepass $jksPwd

# Generate new keys and CSR
& "${env:JAVA_HOME}bin\keytool.exe" -genkeypair -alias securekey -keyalg RSA -keysize 2048 -dname "CN=${hostNameShort}, OU=IT, O=Example, L=City, ST=State, C=CT" -ext "SAN=dns:${hostNameLong},dns:${hostNameShort},ip:${hostIp}" -validity 365 -keypass $jksPwd -keystore keystore -storepass $jksPwd
& "${env:JAVA_HOME}bin\keytool.exe" -certreq -alias securekey -file "$env:TEMP\${hostNameShort}.csr" -keystore keystore -dname "CN=${hostNameShort}, OU=IT, O=Example, L=City, ST=State, C=RU" -ext "SAN=dns:${hostNameLong},dns:${hostNameShort},ip:${hostIp}" -storepass $jksPwd

# Sign CSR and retrieve P7B
& "certreq.exe" -submit -f -q -attrib "CertificateTemplate:${pkiTpl}" -config "${pkiHost}\${pkiSubj}" "$env:TEMP\${hostNameShort}.csr" "$env:TEMP\${hostNameShort}.crt" "$env:TEMP\${hostNameShort}.p7b" "$env:TEMP\${hostNameShort}.rsp"

# Import P7B
& "${env:JAVA_HOME}bin\keytool.exe" -import -noprompt -trustcacerts -alias securekey -file "$env:TEMP\${hostNameShort}.p7b" -keystore keystore -storepass $jksPwd

The general issue with importing certificate bundle was linked to keystore.exe file itself. Seems that there is some kind of a bug that prevents importing valid certificate chain (CRT+CRT+CRT). According to keytool source code this utility supports importing P7B files also. Other tools, like KeyStore Explorer may allow to overcome this issue but they need to be installed/used on enterprise systems

UPDATE: Fixed SAN fields inside keystore and CSR

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.