How to convert Java Keytool certificates to a format OpenSSL can use to import into the OpenEdge Keystore. 
 

Java Keytool is used to create and maintain certificates for Java based applications.

Keytool can be used to create and sign certificates that are then stored in a password protected Java Key Store (.jks).

OpenEdge processes such as the database, appserver, and webspeed agents cannot use Java Key Stores as they are not Java processes. 

In order for OpenEdge to use the certificates contained in a Java Keystore, the certificates need to be exported from the Java Keystore in a format that OpenSSL can recognize before importing into the OpenEdge Keystore.

The following example details creating a self-signed certificate with Java's Keytool and then exporting the certificates so they can be imported in the OpenEdge Keystore using OpenSSL (sslc). It shows how to configure the default asbroker1 to use the certificates.

*** All password used in the below example are 'password' ***
 

1. Open PROENV and create a self signed certificate using Java KeyTool. This will create a testJKS.jks Java Keystore which will contains the key alias testAlias as well as a private key and self signed certificate:

       2. In order for non-Java OpenEdge components to use the certificates contained in testJKS.jks Java Keystore, the certificates need to be exported from the Java Keystore in PKCS#12 format before OpenSSL can import            them into the OpenEdge Keystore. The first step to this is to export the private key and self-signed certificate into a PKCS#12 file using Keytool:



       3. Next, export the self-signed certificate from the PKCS#12 file test.pk12 using OpenSSL. This will export the self-signed certificate to test.cer: 



       4. Next export the private key from the PKCS#12 file and convert it to a format that ‘pkiutil –import’ will accept. It’s important to use the original Java Keystore key alias name for the .pk1 file as this is what pkiutil will                  look for when searching for the alias to import into:



       5. There is a known issue detailed in article  pkiutil -import fails with The CA keys entry <Key Alias> does not contain a valid private-key.. If using OpenEdge version 11.6.0 or 11.6.1, perform the following                  step as detailed in the article. If using OpenEdge 11.6.2 or greater, skip this step and move onto step 6.
 
 

       6. Next, copy test.pem from %WRKDIR% to %DLC%/keys/requests and then import the self-signed certificate with pkiutil:  
 


       7. Use genpassword to create the encrypted password for the ubroker.properties KeyAliasPasswd entry:


       
       8. Modify ubroker.properties appserver asbroker1 for the KeyAlias, KeyAlaisPasswd, and sslEnable:



       9. Start adminserver and appserver and ensure it starts successfully with SSL configured: