Use Java's Keytool to create a CSR and install your SSL/TLS certificate on your Tomcat (or other Java-based) server
The private key (www.hostname.com.key) is stored locally on the server and is employed for decryption. The public key, in the form of a WildCard SSL Certificate Signing Request (certrequest.csr.
Use these instructions to generate your certificate signing request (CSR) and install your SSL/TLS certificate on your Tomcat server using Java’s Keytool.
Restart Note: After you've installed your SSL/TLS certificate and configured the server to use it, you must restart the Tomcat service.
- To create your certificate signing request (CSR), see Tomcat Server: Create Your CSR with Java Keytool.
- To install your SSL certificate, see Tomcat Server: Install and Configure Your SSL/TLS Certificate.
To view these instructions in Spanish, see CSR para Tomcat and Tomcat Instalar Certificado SSL.
If you are looking for a simpler way to create CSRs, and install and manage your SSL/TLS certificates, we recommend using the DigiCert® Certificate Utility for Windows. You can use the DigiCert Utility to generate your CSR and prepare your SSL/TLS certificate file for installation on your Tomcat server. See Tomcat: Create CSR & Install SSL/TLS Certificate with the DigiCert Utility.
I. Tomcat Server: Create Your CSR with Java’s Keytool
Use the instructions in this section to create a new keystore (.jks) file and to generate your CSR.
Apache Logo
Recommended Method: Use the DigiCert Java Keytool CSR Wizard
Save yourself some time: Use the DigiCert Java Keytool CSR Wizard to generate a Keytool command to create your Tomcat keystore and CSR.
- Simply fill out the form, click Generate, and then paste your customized Java Keytool command into your terminal.
- The Java keytool utility creates both your private key and your certificate signing request, and saves them to two files: your_common_name.jks, and your_common_name.csr.
- You can then copy the contents of the CSR file and paste it into the CSR text box in our order form.
- Skip to Step 2, part 3: Save and Back-up Your Keystore File.
Do you prefer a more manual approach to generating your Tomcat keystore and CSR? Follow the instructions below.
Step 1: Use Keytool to Create a New Keystore
Important: We recommend you generate a new keystore following the process outlined in this section. Installing a new certificate to an old keystore often ends in installation errors or the SSL/TLS certificate not working properly. Before you begin this process, backup and remove any old keystores.
- Run Command
- Navigate to the directory where you plan to manage your keystore and SSL/TLS certificate.
- Enter the command below.In the command above, your_site_name should be the name of the domain you want to secure with this SSL/TLS certificate. When ordering a Wildcard certificate, do not include the asterisk (*) in the filename (e.g., your_site_name). The asterisk is not a valid keytool character.
- Create a Password
- When prompted, create a password for your Keystore.Note: You will specify this password in your Tomcat configuration file and then use it to generate your CSR and to import your certificate.
- Store this password somewhere safe, such as a trusted and secured password manager.
- Enter your SSL/TLS certificate information.Important: When prompted for the first and last name, DO NOT type your first and last name. Instead, type the Fully Qualified Domain Name (FQDN) for the site you are securing with this certificate (e.g., www.yourdomain.com, mail.yourdomain.com). Are you are ordering a Wildcard Certificate? Then your FQDN must begin with an asterisk (*). (e.g.,*.yourdomain.com).
- Enter your Organization information.
- When prompted to verify your information, type y or yes to confirm.
- When asked for a 'key password for <server>', press enter to use the password you just created for the keystore file.
- Your keystore file, your_site_name.jks, is now created and in your current working directory.
Step 2: Generate a Certificate Signing Request (CSR) from your New Keystore
- Run Command
- In Keytool, type the following command:In the command above, your_site_name should be the name of the keystore file you created in Step 1: Use Keytool to Create a New Keystore or when using the DigiCert Java Keytool CSR Wizard.
- When prompted, enter the password you created earlier (when you created your new keystore).
- In your current directory, csr.txt (e.g., your_site_domain.txt) now contains your CSR.
- Save and Back-up Your Keystore File
- Take note of the path to your keystore file (your_site_domain.jks) as your SSL/TLS certificate will be installed to it later.
- We recommend that you create a back-up copy of your Keystore file (your_site_domain.jks) before continuing. Having a back-up of the Keystore file can help resolve issues that may occur during certificate SSL/TLS installation.
- Order Your SSL/TLS Certificate
- Open the .csr file you created with a text editor.
- Copy the text, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it in to the DigiCert order form.
- Make sure that when you Select Server Software, you select Tomcat.
Tomcat SSL/TLS Certificates, Guides, & TutorialsBuy NowLearn More - Install CertificateAfter you’ve received your SSL/TLS certificate from DigiCert, you can install it on your Tomcat server.
The following instructions will guide you through the CSR generation process on Apache OpenSSL. To learn more about CSRs and the importance of your private key, reference our Overview of Certificate Signing Request article. If you already generated the CSR and received your trusted SSL certificate, reference our SSL Installation Instructions and disregard the steps below.
1. Log In
Log in to your server’s terminal via Secure Shell (SSH).
2. Run CSR Generation Command
Generate a private key and CSR by running the following command:Here is the plain text version to copy and paste into your terminal:
Note: Replace “server” with the domain name you intend to secure.
3. Enter your Information
Enter the following CSR details when prompted:
- Common Name: The FQDN (fully-qualified domain name) you want to secure with the certificate such as www.google.com, secure.website.org, *.domain.net, etc.
- Organization: The full legal name of your organization including the corporate identifier.
- Organization Unit (OU): Your department such as ‘Information Technology’ or ‘Website Security.’
- City or Locality: The locality or city where your organization is legally incorporated. Do not abbreviate.
- State or Province: The state or province where your organization is legally incorporated. Do not abbreviate.
- Country: The official two-letter country code (i.e. US, CH) where your organization is legally incorporated.
Note: You are not required to enter a password or passphrase. This optional field is for applying additional security to your key pair.
4. Copy the CSR text from the file
Locate and open the newly created CSR in a text editor such as Notepad and copy all the text including:
Note 1: Your CSR should be saved in the same user directory that you SSH into unless otherwise specified by you. Note 2: We recommend saving or backing up your newly generate “.key” file as this will be required later during the installation process.
5. Generate the order
Elliptic curve cryptography generate public key. Return to the Generation Form on our website and paste the entire CSR into the blank text box and continue with completing the generation process.
Upon generating your CSR, your order will enter the validation process with the issuing Certificate Authority (CA) and require the certificate requester to complete some form of validation depending on the certificate purchased. For information regarding the different levels of the validation process and how to satisfy the industry requirements, reference our validation articles.
After you complete the validation process and receive the trusted SSL Certificate from the issuing Certificate Authority (CA), proceed with the next step using our SSL Installation Instructions for Apache OpenSSL.