Can ACE produce a self signed certificate?

Hi people,
I have used ace to create a csr and then send it to verisign and install the signed certificate on ACE so that it acts as ssl-proxy termination.
But now I want to know if it's possible for ACE to create a self signed certificate. (instead of sending it to verisign to sign it).
Can this be done?
thanks,
george

HI George,
As far as I know, there is no option to signed your certificates from ACE. You'll have to create keys and certificates on a separate device using openssl and then import them into the ACE module.
http://docwiki.cisco.com/wiki/SSL_Termination_on_the_Cisco_Application_Control_Engine_Without_an_Existing_Chained_Certificate_and_Key_in_Routed_Mode_Configuration_Example#Using_OpenSSL_to_Generate_a_Self_Signed_Certificate

Similar Messages

Can you use a self signed certificate on an external Edge Server interface?

Hi,
I have a small lab deployment for evaluation purposes. The Lync FE server works great for internal users. I have now added an Edge server. For the internal interface, I have a self signed certificate from our internal CA. (no problem there) For the external
interface, I have a self signed certificate from our own external CA. I have installed the cert on the client machine of the external user and installed it for trusted operation. I have used the RUCT and digicert tools to prove that the external self signed
cert is valid (root and intermediate have been checked for validity).
At first, when logging in from the Lync 2013 client on the external users machine, I would get an error from Lync about the cert being untrusted. I have now fixed that error by adding it as trusted. At this point, there are no errors or warnings in the Event
Viewer (in the application or system logs) However, I receive the following error from the Lync client, "Were having trouble connecting to the server... blah, blah".
Here is my question. Does the Microsoft Lync 2013 client and/or the "testconnectivity.microsoft.com" tool specifically prevent or forbid the use of self signed certificates on the external interface of an Edge server? They seem too.
I can tell if the certificate is my problem or something else. Any ideas on how to trouble shoot this?
Thx

Drago,
Thanks for all your help. I got it working.
My problem with the Lync client error, "Were having trouble connecting to the server... blah, blah", was NOT a certificate error. It was a problem with my Lync Server Topology. (My sip default domain needed to match my user login domain.)
Let me update everyone about self-signed certificates:
YES, you can self-sign a certificate on your external edge server. It is a pain, but possible.
I have a self signed certificate from our own external CA. I have installed the cert on the client machine of the external user for trusted operation. I have used the RUCT and digicert tools to prove that the external self signed cert is valid (root and
intermediate have been checked for validity).
Here are my notes:
Create/enable your own external Certificate Authority (CA) running on a server with internet access.
On the Lync Edge Server, run the "Lync Server 2013 - Development Wizard".
Click "Install or Update Lync Server System". (Lync will automatically determine its deployment state)
You should have already completed: Step1 and Step 2.
Run or Run Again "Step 3: Request, Install or Assign Certificates".
Install the "Edge internal" certificate.
Click "Request" button to run the "Certificate Request" wizard.
You use can "Send the request immediately to an online certificate authority" option to connect to your internal CA, and create the certificate.
Once the certificate has been created, use "Import Certificate" to import it.
Once imported, on the Edge Server, go to: (Control Panel -> Administrative Tools -> Internet Information Services (ISS) Manager -> Server Certificates -> Complete Certificate Request...
In the Lync deployment wizard - Certificate Wizard, "Assign the newly imported "edge internal" certificate.
Install the "Edge External" certificate (public Internet).
Click the "Request" button to run the "Certificate Request" wizard.
Press "next"
Select "Prepare the request now, but send it later (offline certificate request).
Supply the "Certificate Request File" name and location. (You will need the file later. It should have the file extension ".req").
Click next on the "Specify Alternate Certificate Template". (which means you are using the default options)
Give it a Friendly Name. Bit Length = 2048. I selected "Mark the certificate's private key as exportable" option.
Fill in the organization info.
Fill in the Geographical Information.
The wizard should automatically fill-in the "Subject name:" and "subject alternative name:' fields.
Select your "Configured SIP domains"
"Configure Additional Subject Alternative Names" if you want. Otherwise, next.
Verify the "certificate Request Summary". Click next.
Run the wizard script to "Complete". The wizard will create a file containing the certificate request with the file extension ".req". (Let's assume the file name is "myCert.req")
Move your myCert.req file to your external CA. Have your CA issue the cert (based on myCert.req) and export the new cert to a file. I save it as a P7B certificate. (Let's call it "ExternalCert.p7b")
In the Lync Deployment wizard - Certificate Wizard, click on "Import Certificate" for ExternalCert.p7b.
Once imported, on the Edge Server, go to: (Control Panel -> Administrative Tools -> Internet Information Services (ISS) Manager -> Server Certificates -> Complete Certificate Request... (assign it a friendly name. Let's say "EXTERNAL-EDGE")
For the "External Edge certificate (public Internet), click "Assign".
The "Certificate Assignment" wizard will run.
Click next.
From the list, select your cert "EXTERNAL-EDGE".
Finish the wizard to "complete".
You are finished on the server.
Move the "ExternalCert.p7b" file to the machine running the lync client. Install the cert via the "Certificate Import Wizard".
When installing it to a particular Certificate Store, select the "Place all certificates in the following store" option.
Browse
Select "Trusted Root Certification Authorities"
Finish the wizard.

How can I replace the self-signed certificate on a SL150?

Hi,
I would prefer to have our internal CA sign the SSL-certificate for our SL150.
Is this possible? Where can I find the configuration to generate a request and upload the certificate?
Thanks,
/M

http://h10032.www1.hp.com/ctg/Manual/c01918142.pdf
Videos from the HP Media Service Library
http://h20574.www2.hp.com/default.htm?lang=en&cc=US&hpappid=psml
It's probably easier to order a new board as it's separate from the main mother board.

Possible to select self-signed certificate for client validation when connecting to VPN with EAP-TLS

In windows 8.2, I have a VPN connection configured with PPTP as the outer protocol and EAP : "Smart card or other certificate ..." as the inner protocol. Under properties, in the "When connecting" section I've selected "Use a certificate
on this computer" and un-checked "Use simple certificate selection".
My preference would be to use separate self-signed certificates for all clients rather than having a common root certificate that signed all of the individual client certificates. I've tried creating the self-signed certificate both with and without the
client authentication EKU specified, and I've added the certificate to the trusted root certificate authority store on the client. But when I attempt to connect to the VPN I can not get the self signed certificate to appear on the "Choose a certificate"
drop down.
Are self signed certificates supported for this use in EAP-TLS? If it makes a difference, I'm working with makecert (not working with a certificate server).
TIA,
-Rick

Hi Rick,
Thank you for your patience.
According to your description, would you please let me know what command you were using to make a self-signed certificate by tool makecert? I would like to try to reproduce this issue. Also based on my experience, please let me
know if the certificate has private key associated and be present in the local machine store. Hence, please move the certificate from the trusted root certificate authority store to personal store.
Best regards,
Steven Song
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

SSL (Self Signed Certificate) in Business Connector

After going through hundreds of messages, I am still not clear about the steps involved in including SSL certificate with HTTP protocol.
1. Instead of subscribing to Trusted Certificate Authority, can we ceate a Self Signed Certificate? If yes, how?
2. Can anyone please explain the steps involved in including SSL certificate (configuring/importing the certificate)? We are successfully calling HTTP and sending the XML document to a HTTPS URL with authorized user name and password. I need to include SSL certificate to complete the requirement. I have looked at all the PDF documents that are available with BC installation and looked at many forums and still haven't found the answers.
Thanks in advance.

Hi Ramesh.
When untrusted root certificates may be acceptable
Some CAs may be trusted, but in only a very limited way. For example, a company with employees in diverse
locations can make internal documents available to all its employees by setting up a Web site on an intranet that
is only accessible from inside the corporate LAN (i.e. people on the Internet cannot see it). If there are
documents on this site that should have limited access within the company (such as strategic plans or personnel
documents), then these can be protected with SSL.
Since both the servers as well as the browsers are on corporate-controlled equipment, it is well within the
companyu2019s interests to act as its own CA. This means that the company can generate its own root certificate
with which it can sign as many SSL certificates as required for the servers deployed in its intranet. Once this is
done, this certificate should be installed into the certificate stores of all the browsers used in the company. Since
the computers these browsers run on are controlled by the company, this is easy to do: the corporate IT
department can have a policy that the companyu2019s root certificate is installed in the browseru2019s certificate store
whenever a new computer is set up. This prevents security warnings from being displayed whenever an
employee accesses an SSL-secured site on the company intranet.
The advantage to the company is that it can deploy secured sites anywhere on its intranet without purchasing
certificates from an external CA. Note that if the company also runs an e-commerce site, then it should purchase
its SSL certificate from a trusted CA and not use an internal one for sites accessible to the public, who will not
have the certificate installed by the corporate IT department, and thus would receive a security warning.
In such an environment, an unscrupulous employee (most likely a member of the IT team) who has access to
the private key could launch very successful MITM attacks against employees who visit SSL-protected ecommerce
and e-banking sites at work. This will be discussed later in this document. However, the company
can easily protect itself by warning employees not to visit such sites on company time or equipment, since they
are not u201Cbusiness related activities.u201D
Please see this doc related to trusted and untrusted certificate.
http://www.sericontech.com/Downloads/Untrusted_Root_Certificates_Considered_Harmful.pdf

REMOVE A SELF SIGNED CERTIFICATE

Hi All,
We have just finished testing a new configuration on an ASA 5510 for Any Connect. During testing we used a self signed certificate but now want to install a full certificate from a CA. The question is what is the best way to remove the old self generated certificate so we don't get any conflicts when installing the new certificate?
We are looking at Go Daddy for the SSL cert, anyone have any other recommendations ?
Thanks,

The certificate (or more accurate: the trustpoint) is assigned to the interface. If you configure a new trustpoint for your new certificate and assign that trustpoint to your outside interface, then nothing will conflict. If you want you can still use your self-signed certificate for the inside interface. But of course you can also delete it.
There are so many CAs that you can choose from. Some customers of me use Entrust, others Thawte. I got mine from StartSSL. It's your choice. It's more about cost and reputation.

Two way ssl with self signed certificate?

How can I use a self signed certificate with two-way SSL with weblogic 7sp4?
Specfically, I don't want to use any CA authority.
Is it possible to simply have the clients certificate in the servers truststore or not?
I pull out the certificate via
javax.servlet.request.X509Certificate
but when I use a self signed certificate it's never there.
If I instead use a certificate that was created with CertGen it works. But CertGen uses the GenCertCA to create the certificate chain.

How can I use a self signed certificate with two-way SSL with weblogic 7sp4?
Specfically, I don't want to use any CA authority.
Is it possible to simply have the clients certificate in the servers truststore or not?
I pull out the certificate via
javax.servlet.request.X509Certificate
but when I use a self signed certificate it's never there.
If I instead use a certificate that was created with CertGen it works. But CertGen uses the GenCertCA to create the certificate chain.

How pass client credentials to ws client and accept self signed certificate

How do you connect to a web service over ssl and accept self-signed certificates. I generated the client using JAX-WS but i ran into two problems. First of all, how do you pass the client credentials? And second, how can you accept a self-signed certificate?

Thanks for your comments Jason.
I'm not quite sure why the certificate has client auth. It does seem to be a misconfiguration, but I do see both 7.3.1 & 7.3.2 on the cert. That seems like a possible fix, but in a backwards way. I can get those certificates reissued, but I'm confused
as to why config manager itself is not installing per the site settings.
My default install is via a vbs script you wrote (1.6.5). The other methods I've tried in this particular instance are by browsing to the server and running ccmsetup.exe from explorer out of my sms_<site> directory, and by using command line
specifying the /mp:mp.mysite.com
I looked for command line switches to use, but there's no /NoUsePKI switch or /UseSelfSigned...
any suggestions for a better installation method?

HT5012 How can you add a self signed CA Certificate to iOS 8?

How Can I add a self signed CA Certificate to an iPad with iOS 8.1?

I don’t think that I can help you but I am very interested in your question. Perhaps you have seen information about a related problem…
https://discussions.apple.com/thread/6590335
One way to install the self-signed CA certificate is to export it to a .CER file, email it to the iOS 8 device, open the attachment and process it. My guess is that the certificate will be installed (check the resulting profile) but due to an iOS 8 bug it will be ineffective.
Or, you could send a signed email from the email account for the CA. Open the email on the iOS 8 device and process it.
I assume your goal is for certificates issued by the CA to be automatically trusted on the iOS 8 device. Good luck with that.
The method I used was to send a .CER file. The CA certificate showed up as a profile. However, I do not get automatic trusting of certificates issued by the CA.

In Firefox 4.0 with a Server with a self signed certificate using IPv6 I can not add a "Security Exception" for this certificate.

In Firefox 4.0 I have a server ... it contains a self signed certificate. Using IPv6 I can not add a "Security Exception" for this certificate.
1. I log onto the server (using IPv6). I get the "Untrusted connection page" saying "This connection is Untrusted"
2. I click on "Add Exception.." under the "I understand the Risks" section.
3. The "Add Security Exception" dialog comes up. soon after the dialog comes up I get an additional "Alert" dialog saying
An exception occured during connection to xxxxxxxxx.
Peer's certificate issuer has been marked as not trusted by the User.
(Error code sec_error_untrusted_issuer).
Please note that this works in Firefox 3.6.16 (in IPv4 and IPv6). It also works in Firefox 4.0 in IPv4 only IPv6 has an issue. What's wrong?

Exactly the same problem, except I'm using FF v6 for Windows, not FF v4 as for the lead post. This is for a self-cert which IS trusted, although the error message says it isn't.

Can we connect Outlook with Exchange 2013 with the default Self-signed certificate?

Hi,
the question is very simple, but after several days searching in this forums and in the web I have not been able to find a definitive answer YES or NOT. I know that Self-signed certificates are not for a production enviroment and only for labs and we must
purchase a third party certificate or get one from a internal CA.
Anyone can answer this question with no doubt?
Thanks in advance!
jspt

Hi Abhi,
I wrote this question because in a recent migration to 2013 from 2007 we've found with this problem: you can view it in the post http://social.technet.microsoft.com/Forums/exchange/en-US/1ddd1e81-1061-4461-95dd-13de653ef8fe/outlook-cant-connect-with-exchange-2013-after-migration-from-exchange-2007?forum=exchangesvrdeploy.
Also I have installed a new exchange 2013 in a lab enviroment and I also have unabled to connect from a Outlook 2013. The problem is the same Outlook is unable to detect the exchange server. Many people in this forums told me that have to be a certificate
problem and for that I posted this question. Honestly, I don't know how to do for Outlook can be connect with Exchange 2013. I don't know what I'm doing wrong.
Anyway thanks for your answer.
jspt

How can I delete the MSE self-signed certificate?

We are running v7.3.101.0 of the MSE and need to delete the self-signed certificate. I know the self-signed certificate is a feature of the MSE and comes pre-installed. Is it a requirement or can we delete it without causing any issues? If we can delete it, how? Your assistance is greatly appreciated.

Hello muchaim,
After reviewing your post, it sounds like you want to delete the recent call list. I would recommend that you read this article, it may be able to help the issue.
FaceTime for Mac (Yosemite): Make and receive FaceTime calls
FaceTime keeps a list of the most recent calls you made, received, or declined, with the most recent call at the top. To return a call, click the Video button or the Audio button . To remove a call, select it and press Delete.
Thanks for using Apple Support Communities.
Have a nice day,
Mario

How to replace an expiring self-signed certificate?

Well, I've successfully (I THINK) replaced two of the three certificates that are expiring.
First off - 90% of what's in the Security manual concerning certificates is useless to this issue. I don't want to know how the watch is made - I just want to tell time! In fact there is a GLARING typo on Page 167 of the Snow Leopard Server Security Configuration Manual showing a screenshot of the Certificate Assistant in Server Admin that is just plain wrong!
It's clear there is no way to RENEW the certificate. You have to delete the old one and replace it with a new certificate.
The issue I have is that with all the services using the certificate, I don't know what the impact to the end-users is going to be when I delete that expiring certificate.
It appears that a certificate is created automatically when the OS is installed, although I installed the OS Server on a virtual machine and I didn't see where it got created, nor was I given any input during the creation (like extending the expiration date).
I don't know whether those certificates are critical to the running of the OS or not, but I went through the process of creating a new certificate in Server Admin. I deleted the expiring certificate. Because the two servers on which the expiring certificate was deleted does not have any services running that require a certificate (such as SSL on my mail server), nothing bad seems to have happened or been impacted negatively.
I did, however, name the new certificate the exact same thing as the old certificate and tried to make sure that the parameters of the new certificate were at least as extensive as the old certificate. You can look at the details of the old certficate to see what they were.
Here's the "critical" area of the certificate that was "auto-created" on my virtual server. (It's the same as the one on my "real" server.
http://screencast.com/t/zlVyR2Hsc
Note the "Public Key Info" for "Key Usage": Encrypt, Verify, Derive. Note the "Key Usage" Extension is marked CRITICAL and it's usage is "Digital Signature, Data Encipherment, Key Cert Sign". Extended Key Usage is also critical and it's purpose is Server Authentication.
Here's a screenshot of the default certificate that's created if you create a new self-signed certificate in Server Admin:
http://screencast.com/t/54c2BUJuXO2
Note the differences between the two certificates. It LOOKS to me like the second certificate would be more expansive than the default issued at OS Install? Although I don't really care about Apple iChat Encryption.
Be aware that creating certificates starts to populate your server Keychain.
http://screencast.com/t/JjLb4YkAM
It appears that when you start to delete certificates, it leaves behind private keys.
http://screencast.com/t/XD9zO3n16z
If you delete these keys you get a message warning you about the end of the world if you delete private keys. I'm sorry if your world melts around you, but I'm going to delete them from my Keychain.
OK, now I'm going to try to create a certificate that is similar to the one that is created at start-up.
In Server Admin, highlight your server on the sidebar and click the "Certificates" tab in the icon bar.
Click the "+" button under your existing certificate and select "Create a Certificate Identity". (This is how I created the default certificate we just got through looking at except I clicked through all the defaults.)
Bypass "Introduction".
In the "Create Your Certificate" window I set the "Name" as exactly the same as the name of the expiring certificate. I'm HOPING when I do this for my email server, I won't have to go into the services using the certificate and select the new one. On the other hand, naming it the same as the old one could screw things up - I guess I'll know when I do it later this week.
The "Certificate Type" defaults to "SSL Server" and I think this is OK since that's what I'll be using this certificate for.
You HAVE to check the "Let me override defaults" if you want to, for example, extend the expiry period. So that's what I want to do, so I checked it.
In the next window you set the Serial Number and Validity Period. Don't try typing "9999" (for an infinite certificate) in the "Validity Period" field. Won't work - but you CAN type in 1826 (5 years) - that works - Go Figure!??? You can type in a bigger number than that but I thought 5 years was good for me.
The next part (Key Usage Extension) is where it gets sticky. OF COURSE there is NO DOCUMENTATION on what these parameters mean of how to select what to choose.
(OK here's what one of the "explanations" says: "Select this when the certificate's public key is used for encrypting a key for any purpose. Key encipherment is used for key transport and key wrapping (or key management), blah, blah, blah, blah, blah blah!") I'm sure that's a clear as day to you rocket scientists out there, but for idiot teachers like me - it's meaningless.
Pant, pant...
The next window asks for an email address and location information - this appears to be optional.
Key Pair Information window is OK w/ 2048 bits and RSA Algorithm - that appears to be the same as the original certificate.
Key Usage Extension window
Here's where it gets interesting...
I brought up the screenshot of the OS Install created certificate to guide me through these next couple of windows.
Since the expiring cert had "Digital Signature, Data Encipherment, Key Cert Sign" I selected "Signature, Data Encipherment and Certificate Signing".
Extended Key Usage Extension...
Hoo Boy...Well, this is critical. But under "Capabilities" it lists ANY then more stuff. Wouldn't you THINK that "ANY" would include the other stuff? Apparently not..."Learn More"?
Sorry, folks, I just HAVE to show you the help for this window...
+*The Extended Key Usage Extension (EKU) is much like the Key Usage Extension (KUE), except that EKU values are defined in terms of "purpose" (for example, signing OCSP responses, identifying an SSL client, and so on.), and are easily extensible. EKU is defined with object identifiers called OIDs. If the EKU extension is omitted, all operations are potentially valid.*+
KILL ME NOW!!!
OK (holding my nose) here I go...Well, I need SSL Server Authentication (I THINK), I guess the other stuff that's checked is OK. So...click "Continue".
Basic Constraints Extension...
Well, there is no mention of that on the original certificate, so leave it unchecked.
Subject Alternate Name Extension...
Nothing about that in the original certificate, so I'm going to UNCHECK that box (is your world melting yet?)
DONE!!!! Let's see what the heck we got!
http://screencast.com/t/QgU86suCiQH
Well, I don't know about you but that looks pretty close for Jazz?
I got some extra crap in there but the stuff from the original cert is all there.
Think we're OK??
Out with the old certificate (delete).
Oh oh - extra private key - but which is the extra one? Well, I guess I'll just keep it.
http://screencast.com/t/bydMfhXcBFDH
Oh yeah...one more thing in KeyChain Access...
See the red "X" on the certificate? You can get rid of that by double clicking on the certificate and expanding the "Trust" link.
http://screencast.com/t/GdZfxBkHrea
Select "Always Trust".
I don't know if that does anything other than get rid of the Red "X", but it looks nice. There seem to be plenty of certificates in the Keychain which aren't trusted so maybe it's unnecessary.
I've done this on both my file server and my "test" server. So far...no problems. Thursday I'll go through this for my Mail server which uses SSL. I'm thinking I should keep the name the same and not replace the certificates in the iCal and Mail service which use it and see what happens. If worse comes to worse, I may need to recreate the certificate with a different name and select the new certificate in the two services that use it.
Look...I don't know if this helps anyone, but at least I'm trying to figure this idiocy out. At least if I screw up you can see where it was and, hopefully, avoid it yourself.
If you want to see my rant on Apple's worthless documentation, it's here.
http://discussions.apple.com/thread.jspa?threadID=2613095&tstart=0

to add to countryschool and john orban's experiences:
using the + Create a Certificate Identity button in Server Admin is the same thing as running KeyChain Access and selecting Certificate Assistant from the app menu, and choosing Create a Certificate. Note that you don't need to create a Certificate Authority first.
in the second "extended key usage extension" dialog box, i UN-checked Any, PKINIT Server Authentication, and iChat Encryption. this produced the closest match to the server's default self-installed certificate.
when updating trust settings in Keychain Access, the best match to the original cert are custom settings - set Always Trust for only SSL and X.509 Basic Policy.
supposedly you can use Replace With Signed or Renewed certificate button from Server Admin and avoid needing to re-assign to services. however i was unable to get this to work because my new cert didn't match the private key of the old. for those interested in going further, i did figure out the following which might be helpful:
you can't drag and drop a cert from Keychain Access or Cert Manager. you need the actual PEM file. supposedly you can hold down the option button while dragging, but this didn't work for me. however you can view the certificates directly in etc/certificates. but that folder is hidden by default. a useful shortcut is to use Finder / Go To Folder, and type in "/private/etc/certificates"
now, on my system the modification date was the same for old and new certificates. why? because it seems to be set by when you last viewed them. so how do you know which is which? answer: compare file name to SHA1 Fingerprint at bottom of certificate details.
after you delete the old certificate, it will disappear in Keychain Access from "System" keychains. however in "login" keychains the old one will still be there but the new one won't. it seems to make sense to delete the old one from here and add the new one. somebody tell me if this is a bad idea. the + button does not work easily for this, you need to drag and drop from the etc/certificates folder.
lastly, the "common name" field is the server/host name the client will try to match to. you can use wildcard for this, e.g. *.example.com. if you need to, you can use the Subject Alternate Name to provide an alternative name to match to, in which case the common name field will be ignored, which is why by default the dNSName alternate field defaults to the common name. more info here: http://www.digicert.com/subject-alternative-name-compatibility.htm.
maybe that's hopeful to somebody. but i stopped there since things seem to be working.
last note, which you probably know already - if you don't want to bother installing the certificate in your client computers and phones, you can select Details when the first trust warning pops up and select Always Trust.
now, we'll see how everything works once people start really using it...

How do we create self-signed certificate using java packages

Hi All,
I require some information on creating self-signed certificate using java packages.
The java.security.cert.* package allows you to read Certificates from an existing store or a file etc. but there is no way to generate one afresh. See CertificateFactory and Certificate classes. Even after loading a certificate you cannot regenerate some of its fields to embed the new public key – and hence regenerate the fingerprints etc. – and mention a new DN. Essentially, I see no way from java to self-sign a certificate that embeds a public key that I have already generated.
I want to do the equivalent of ‘keytool –selfcert’ from java code. Please note that I am not trying to do this by using the keytool command line option – it is always a bad choice to execute external process from the java code – but if no other ways are found then I have to fall back on it.
Regards,
Chandra

I require some information on creating self-signed certificate using java packages. Its not possible because JCE/JCA doesn't have implementation of X509Certificate. For that you have to use any other JCE Provider e.g. BouncyCastle, IAIK, Assembla and etc.
I'm giving you sample code for producing self-signed certificate using IAIK JCE. Note that IAIK JCE is not free. But you can use BouncyCastle its open source and free.
**Generating and Initialising the Public and Private Keys*/
public KeyPair generateKeys() throws Exception
      //1 - Key Pair Generated [Public and Private Key]
      m_objkeypairgen = KeyPairGenerator.getInstance("RSA");
      m_objkeypair = m_objkeypairgen.generateKeyPair();
      System.out.println("Key Pair Generated....");
      //Returns Both Keys [Public and Private]*/
      return m_objkeypair;
/**Generating and Initialising the Self Signed Certificate*/
public X509Certificate generateSSCert() throws Exception
    //Creates Instance of X509 Certificate
    m_objX509 = new X509Certificate();
    //Creatting Calender Instance
    GregorianCalendar obj_date = new GregorianCalendar();
    Name obj_issuer = new Name();
    obj_issuer.addRDN(ObjectID.country, "CountryName");
    obj_issuer.addRDN(ObjectID.organization ,"CompanyName");
    obj_issuer.addRDN(ObjectID.organizationalUnit ,"Deptt");
    obj_issuer.addRDN(ObjectID.commonName ,"Valid CA Name");
    //Self Signed Certificate
    m_objX509.setIssuerDN(obj_issuer); // Sets Issuer Info:
    m_objX509.setSubjectDN(obj_issuer); // Sets Subjects Info:
    m_objX509.setSerialNumber(BigInteger.valueOf(0x1234L));
    m_objX509.setPublicKey(m_objkeypair.getPublic());// Sets Public Key
    m_objX509.setValidNotBefore(obj_date.getTime()); //Sets Starting Date
    obj_date.add(Calendar.MONTH, 6); //Extending the Date [Cert Validation Period (6-Months)]
    m_objX509.setValidNotAfter(obj_date.getTime()); //Sets Ending Date [Expiration Date]
    //Signing Certificate With SHA-1 and RSA
    m_objX509.sign(AlgorithmID.sha1WithRSAEncryption, m_objkeypair.getPrivate()); // JCE doesn't have that specific implementation so that why we need any //other provider e.g. BouncyCastle, IAIK and etc.
    System.out.println("Start Certificate....................................");
    System.out.println(m_objX509.toString());
    System.out.println("End Certificate......................................");
    //Returns Self Signed Certificate.
    return m_objX509;
//****************************************************************

Problems with Creating a self-signed Certificate

hi,
I read the keytool Documentation and wanted to create my own self-signed certificate.
ok, I followed the steps :
1) keytool -keyclone -alias origkey -dest my_key
2) keytool -selfcert -alias my_key -dname "cn=Stefan Gross, ou=Computers, o=notintersting, c=D"
3) keytool -certreq -alias my_key (output in mycert.cer)
4)keytool -certreq -alias my_key -sigalg X.509 -file newcert.cer
.. Password Input...
Keytool-Error: java.lang.Exception: Alias <my_key> does not exist.
But it exists, see :
[usr]$ keytool -list
Keystore-Typ: jks
Keystore-Provider: SUN
new_key, 06.05.2003, keyEntry,
So it exists, but why do I get the error ?
So far,
Stefan Gross

stefan hi,
i have tried to produce a certificate my_cert.cer and it went well. as far as i understood you have to create a keystore first. this keystore holds a key pair.
and then using the keystore you can create as many certificates as possible based on the key pair.
try following the steps below. it should work, i mean i have followed them and all was fine. you can find the original form of the following from documentation of keytool (sun).
hope this time it'll work, let me know.
cem.
note: the last step is importing the certificate to the keystore which is not necessary if you only want the certificate.
To set up a digital certificate,
Generate a key pair.
The keytool utility enables you to generate the key pair. The keytool utility that ships with the J2SE SDK programmatically adds a Java Cryptographic Extension provider that has implementations of RSA algorithms. This provider enables you to import RSA-signed certificates.
To generate the keystore file, run the keytool utility as follows, replacing <keystore_filename> with the name of your keystore file, for example, server.keystore. If you are using the Tomcat server, the file must either be named .keystore and located in the home directory of the machine on which Tomcat is running, or you will need to tell Tomcat where the kestore file is by adding a keystoreFile attribute to the <Factory> element in the Tomcat configuration file or by specifying the location of the file on the Connector (8443) node of admintool.
keytool -genkey -keyalg RSA -alias tomcat-server
-keystore <keystore_filename>
The keytool utility prompts you for the following information:
Keystore password--Enter the default password, which is changeit. Refer to the keytool documentation for information on changing the password.
First and last name--Enter the appropriate value, for example, JWSDP.
Organizational unit--Enter the appropriate value, for example, Java Web Services.
Organization--Enter the appropriate value, for example, Sun Microsystems.
City or locality--Enter the appropriate value, for example, Santa Clara.
State or province--Enter the unabbreviated name, for example, CA.
Two-letter country code--For the USA, the two-letter country code is US.
Review the information you've entered so far, enter Yes if it is correct.
Key password for the Web server--Do not enter a password. Press Return.
The next step is generate a signed certificate for this keystore. A self-signed certificate is acceptable for most SSL communication. If you are using a self-signed certificate, continue with Creating a Self-Signed Certificate. If you'd like to have your certificate digitally signed by a CA, continue with Obtaining a Digitally-Signed Certificate.
Creating a Self-Signed Certificate
This example assumes that the keystore is named server.keystore, the certificate file is server.cer, and the CA file is cacerts.jks. Run these commands in your <HOME> directory so that they are created there.
Export the server certificate to a certificate file:
keytool -keystore server.keystore -export -alias tomcat-server -file server.cer
Enter the password (changeit).
Keytool returns the following message:
Certificate stored in file <server.cer>
Import the new server certificate into the Certificate Authority file cacerts.jks:
keytool -import -alias serverCA -keystore <HOME>/cacerts.jks
-file server.cer
Enter the password (changeit).
Keytool returns a message similar to the following:
Owner: CN=JWSDP, OU=Java Web Services, O=Sun, L=Santa Clara,
ST=CA, C=US
Issuer: CN=JWSDP, OU=Java Web Services, O=Sun, L=Santa Clara,
ST=CA, C=US
Serial number: 3e39e3e0
Valid from: Thu Jan 30 18:48:00 PST 2003 until: Wed Apr 30 19:48:00 PDT 2003
Certificate fingerprints:
MD5: 44:89:AF:54:FE:79:66:DB:0D:BE:DC:15:A9:B6:09:84
SHA1:21:09:8A:F6:78:E5:C2:19:D5:FF:CB:DB:AB:78:9B:98:8D:06:8C:71
Trust this certificate? [no]: yes
Certificate was added to keystore
----------------------------------

Can ACE produce a self signed certificate?

Similar Messages

Maybe you are looking for