E-Sourcing importing Certificate to the Keystore

Hi gurus
We are currently stuck while we try to implement LDAP integration. We are trying to import the secure SSL certificate into the keystore under java home on our server and it is not recognising the imported certificate.
Syntax we are using is:
C:\j2sdk1.4.2_14\jre\bin>keytool -import -trustcacerts -alias us01.apmn.org -file D:\eso\keystore\agi76_ssl_response.crt -keystore C:\j2sdk1.4.2_14\jre\lib\security\cacerts
It says successfully imported. However we are not able to Synchronize our Microsoft AD on 636 port.
Our certificates are issued by a Certificate Server not an AD Domain controller. Does this matter?
PLEASE HELP
Thanks
JS
Edited by: JS on Jul 30, 2009 9:34 PM
Edited by: JS on Jul 30, 2009 9:35 PM

I finally succeeded in importing an image with a file location. The problem is the DataLocationID you had to provide. This is a GroupNode and it´s a hierarchical structure. You had to split the filename into the path components and create nodes in the tree for every component.

Similar Messages

I am unable to view imported certificates in the certificate manager in Firefox.

''dupe of https://support.mozilla.org/en-US/questions/909905''
I am unable to view imported certificates in the certificate manager in Firefox.

Many thanks SafeBrowser; I think the Yahoo and Babylon extensions were the problem. Didn't want them anyway!

Error in importing certificate into the BW System

Hi,
I am trying to import the certificate from portal to BW system trough the STRUSTSSO2 transaction it is importing the certificate no issues in that but when i tried to add in the certificate list by using the "Add to certificate list" button i am grtting the error "error occured during import"
plz any one can give input in this.
This is very urgen...i will award the points for useful solution...
eagerly looking for the reply from u
Thanks
ajay

Hi JJ,
Thanks for the response.
I have unziped the file before importing the certificate,
first i went to key Store administrator in the portal and clicked on download verify.der button there it is down loaded in the local machine then i unziped that file in that i got the certificate this certificate i have imported in to the BW system .
the certificate has been imported without any error imported but when i click on the add to certificate list it will throw the eooror in import.
the same error i am getting the R/3 system also.
can u plz give any inputs on this.
Thanks
Ajay

Is it necessary to restart the J2EE after I have imported certificates?

Hi guys,
I have imported certificates into the keystore. Is it necessary to restart the J2EE to make them available?
Thanks, Olian

Hi Olian,
Not necessary to restart the server.
If you have imported server certificates, then you can check it by assigning the certificates to https port in SSL provider and acces the server through https://<server name (FQDN):<https port>.
The explorer should show you the imported certificate.
If you have imported any other certificates , then also its not necessary to restart. You can directly check the functionality for which you have imported the certificates.
Cheers....,
Raghu

Unable to import signed cert in keystore

Hi everybody !
I've been using keytool for years to generate client certificates that I would send to an enrollment server to get it signed by the CA.
Here is the sequence :
(1) Generating the key pair :
keytool.exe -genkey -alias client-cert -keyalg RSA -keystore keystore   (2) Extracting the certificate request :
keytool.exe -certreq -alias client-cert -file client-cert.csr -keystore keystore (3) Sending the request to the enrollment server, getting in return a signedcert.der
(4) Importing CA certificate in keystore :
keytool.exe -import -alias caroot -file ca.der -keystore keystore (5) Importing the signed client certificate in the keystore : keytool.exe -import -alias cert-client -file signedcert.der -keystore keystoreNow we'd like to use openssl to generate the CA certificate and sign the client-cert (which is still generated by keytool).
So instead of (3), we just have :
     openssl ca -config ca-sign.cnf -out signedcert.crt -infiles client-cert.csr
     openssl verify -CAfile ca.crt signedcert.crt
     openssl x509 -in signedcert.crt -out signedcert.der -outform DER     Everything runs fine for (4), but when we finally try to import the signedcert, we get this :
     keytool error: java.security.cert.CertificateException: IOException: X509.Object
     Identifier() -- data isn't an object ID (tag = 48)Some people here have already had the problem but got no answer.
What I'd like to know first is what does such an error MEAN exactly, then how can I manage to put my cert into the keystore.
FYI, we use keytool from JDK 1.3.0 and openssl 0.9.7
(I can post config file ca-sign.cnf if needed)
Thanks for your help
Valerien

I got no answer either, so here's the solution for other unlucky people : use keytool from the latest JDK (1.4.1_01 ran fine).
Thank me very much.

Can't save master password nor import certificates

Hi,
I have a problem trying to sign a document with a certificate. I had imported it when I was using Firefox 3.6 and it used to work ok to identify myself to log in to some site. However, I never tried to sign a document with that certificate. (I work with a Mac, in case that is relevant.)
I recently uploaded to Firefox 4, and now I try to sign a document. Ok, so Firefox asks me for my master password. I had not set one (or I can't remember), so what I did is to "reset" the master password. Now, I try to set a new master password: I fill in the fields, click "Accept"... but it doesn't do anything, so the master password can't be set.
Also, if I try to import a certificate (which was removed when I reset the master password), I can choose the file and choose a password for it, but again when I click "Accept" the password is not set: simply nothing happens.
Has anyone else had these problems? Is it a Firefox4 issue or did it also happen before? How can I solve it?
Thanks in advance!
jordimp

Hi, I had the same problem, and I read somewhere that according to a mozilla knowledgebase article, the master password is a requirement for importing certificates (although the corresponding KB page is now unavailable)
I tried the following and it worked for me:
- export the certificates to the desktop
- delete the certificates from firefox
- set a master password on firefox (preferences - security - use master password)
- import the backed up certificates
You should now be able to sign.
Hope this helps

Importing Certificates into Blackberry Z10 Key Store.

Currently, on the development network, we have stood up a BES10 server with a few Blackberry Z10 phones deployed. Using BES10, we are able to push the Root CA certificate for our developmental CA. We are currently unable to import the client's certificates (identity, encryption or signing) in *.p12 or *pfx format onto the device. We have tried numerous methods with limited success. Originally, we emailed a certificate using the work email exchange server and were able to view the certificates on the BB device. We are even able to select "Import certificate," submit the correct password and are presented with a messages stating "Certificate successfully imported." However, looking at the trust store or the S/MIMIE settings, none of the client's certificates are avaliable.
After some research, we followed the steps highlighted in tech support listed at http://docs.blackberry.com/en/smartphone_users/deliverables/47561/als1342708099072.jsp. After following the instructions on screen, selecting the appropriate certificates to import and presenting the correct PIN, the device attemps to import the certs. The device then states "0/3 certificates succesfully imported" and the process has failed.
Is there a log file avaliable to see what is causing the import to fail or is there an additional step we are missing? Any support would be helpful, thank you in advance.

Hey Shah_jeet,
Welcome to the BlackBerry® Support Community Forums.
Are you importing the certificate using a USB connection or using a Wi-Fi connection?
Thanks.
-HB
Come follow your BlackBerry Technical Team on twitter! @BlackBerryHelp
Be sure to click Kudos! for those who have helped you.Click Solution? for posts that have solved your issue(s)!

How to load the certificate authority into the keystore for the weblogic8.1

how to load the certificate authority into the keystore for the weblogic8.1
==================================================
Getting the message below when trying to improt the certificate to the weblogic 8.1 web server. Received this certificate from our internal IT certificate authority. Trying to import the certificate to our test sytem.
===================================================
keytool error: java.lang.Exception: Failed to establish chain from reply
Import failed. Verify that the Certificate Authority that signed 'certi.pem'
has been loaded into your keystore 'keystore\pskey'
To view keystore contents issue 'PSkeymanager -list -keystore keystore\pskey [-v
To preview a certificate file issue 'PSkeymanager -previewfilecert -file certi.pem'

You need to populate that field using cmod code. Find out from which table that field is and go to transaction cmod then enter project name and select component radio button then display.
Now select the FM EXIT_SAPLRSAP_001 if your datasource is transactional dataource
EXIT_SAPLRSAP_002 for master data attibute
EXIT_SAPLRSAP_003 for Hierarchies
EXIT_SAPLRSAP_004 for text
then populate code .
After your code then delete data from ods then reinit to populate the enhanced field.
Hope it helps..

Certificates from CA's and the keystore

Hello all,
I have tracked through a series of forum topics that seem to ask similar questions and receive similar answers regarding both signing jars and using the certificates for communications.
Forgive the overlap, but I have a slightly related question.
Is the only way to use the keystore (and keytool to manage the keystore) when signing jars by generating a key pair at the start? Is that why all the examples always start with that option, and none of them start from a scenario that is different?
Is it possible to come in with an existing CA signed certificate, and the CA's root certificate and sign the jars? Would that setup work for communication at all?
I have tried this for signing, and both certificates end up as trustedCertEntries within the keystore, but this does not allow the signing of jars since there is no keyEntry. The error message is:
"jarsigner: Certificate chain not found for: and. and must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain."
I have not tried it for communication.
Is there some other alternative to generating the key-pair directly in the keystore, exporting the csr, and getting the CA to sign and reply to that csr?
My question stems from a customer wanting to only provide the certificate they want to use, and maybe the CA root cert if necessary.
Thanks much in advance!
Edited by: gennadius on Dec 19, 2007 3:52 PM

Is it possible to come in with an existing CA signed certificateBut this isn't the beginning of the process.
A signed certificate results from a Certificate Signing Request (CSR) being submitted to a CA.
A CSR is generated from a private key/public key pair. But it only contains the public key. So you have to get it signed and then re-import it to the same keystore which originally contained the private key, to complete the association between the signed cert and the private key.
The signed certicificate is a public authentication that the owner of this certificate uniquely owns this public key, which corresponds to a private key. Without the private key the entire exercise can't get started.
So unless you can find a way to get the private key from whereever it was when the CSR process was started, just importing the signed certificate doesn't give you a prioviate key. Without a private key, you can't sign things, decrypt, be an SSL authenticated endpoint, etc.
And if you could cart private keys around like that, they wouldn't be private, so the entire point of PKI is lost.

How do I import a renewed certificate to the other DAG members?

Hi
I have just run through the process of renewing an internal certificate on one of our Exchange 2010 servers. I requested a renewal, ran through the wizard on the internal CA, then completed the process on the Exchange server. I have
assigned services to the new certificate and it looks ok in the EMC. Now I need to import the same certificate to our 2 other Exchange servers but I don't see how. if I use the Import Certificate wizard it asks for a private key which I don't have.
Is there a way to import the same certificate or do I have to submit a request from each server (that doesn't sound right to me).
Cheers

Hi,
Here are the steps to export the certificate with Private Key and import it.
http://msexchangeguru.com/2013/06/29/import-cert-e2013/
Kottees :My Blog Please mark it as an answer if it really helps you.

Import and trust a self-signed CA certificate from the Terminal

Hello there,
i have a problem: I would like to import and trust a self-signed CA(root) certificate from the Terminal to the System.keychain.
My request is to create a installation script to install the Cisco AnyConnect VPN Client and the needed certificates.
For the import i have used the following command:
    sudo security import certificate.cer -k "/Library/Keychain/System.keychain" -A
    The Option "-A" says:
Allow any application to access the imported key without warning (insecure, not recommended!) <- From the Mac Developer Library
The command reportet: 1 certificate is importet ... but ... the certificate is not trusted.
What do i need to do to set this certificate as trustworthy at the terminal?
Thanks for your help and best regards
Benjamin
P.S. The command: sudo security add-trusted-cert -d -r trustRoot -k “/Library/Keychains/System.keychain” “/private/tmp/certs/certname.cer” doen't run, i get an error message. Found on http://derflounder.wordpress.com/2011/03/13/adding-new-trusted-root-certificates -to-system-keychain/

Hello Linc Davis,
thanks for your answer and sorry for my mistake, because i had already changed the last argument but for this discussion i had only copy this example.
But your answer show me the right way, big thanks.
I had entred the following command (see the last argument):
     sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "~/Downloads/mycert.cer"
... and i get the following message:
    ***Error reading file ~/Downloads/mycert.cer
     Error reading file ~/Downloads/mycert.cer
Today i changed the last argument to:
   /Users/User/Downloads/mycert.cer
and its run.
Many thanks!
Benjamin

Import failed, because the sources are not contained in the archive

Hi,
I need to customized some configuration in the Component CPRXRPM_UI.
So I have created a Track to Modify the CPRXRPM_UI Component. When I am trying to Import the Compoent I am gettting the below error,
20090625182941 Info   :Starting Step Repository-import at 2009-06-25 18:29:41.0130 +5:00
20090625182941 Info   :Component:sap.com/CPRXRPM_UI
20090625182941 Info   :Version :MAIN_PPM45VAL_C.20080919144429
20090625182941 Info   :1. propagation request is of type TCSSoftwareComponent
20090625182941 Fatal :import failed, because the sources are not contained in the archive
20090625182941 Info   :Step Repository-import ended with result 'fatal error' ,stopping execution at 2009-06-25 18:29:41.0131 +5:00
Can any one suggest the solution for the issue

Hi Baskar,
I am facing the same issue.
Wondering if you have figured out a way.
Please let me know what you did to achieve the desired result.
Regards,
Sumit Oberoi

When viewing the Contact Certificates, I can see the Import option, but I do not see the option to actually save the Certificate from the original email.

The title pretty much explains it. In Outlook 2013 when I add a new contact, their certificate is not getting added to their contact page. When I look at the contact certificates section, it is blank with only import as an option.
I have been able to export a cert from the email and then import it to the contact but it says "Persona not validated"
Thanks for any insight you may have.

In Outlook 2013 when I add a new contact, their certificate is not getting added to their contact page. When I look at the contact certificates section, it is blank with only import as an option.
Yes, this is the behavior when you didn't import any Locate Certificate into Outlook contact item. How you export the cert from email? A bit more exact steps how you got to this point would be helpful.
Thanks,
Tony Chen
Forum Support
Come back and mark the replies as answers if they help and unmark them if they provide no help.
If you have any feedback on our support, please contact
[email protected]

How to import the certificate into the credential store

When SSL is configured everywhere in the Environment:
The components present are:
1)oc4j Web Server(machine 1)
2)Presenattaion Services(machine 1)
3)oc4j Web Server for Publisher(machine 2)
4)Publisher(machine 2)
5)BI Server(machine 2)
The Pres Server and the BI Server is all set in Place.
But I am trying to configure Publisher currently in the environmnet.
As a part of the deployement
■ “Exporting the Web Server Certificate to the truststore”
At teh end of this step its refeered as the following...
"Import the exported web server certificate to the BI Presentation Services Credential Store. The
credential store of each instance of BI Presentation Services in your deployment must contain
this certificate."
May I know how can we do this...?
■ “Modifying the AdvancedReporting tag in instanceconfig.xml”
■ “Modifying BI Publisher Settings”
The doc used is : Link:http://download.oracle.com/docs/cd/E10415_01/doc/bi.1013/b40058.pdf
Thanx
KK

Did you find an answer to this post?

Help : How to import .pfx file to keystore

Hi,
I need to generate digital signature for some data string. I got the pfx file with password blank.
it shows the following detailsusing keytool.
keytool -list -keystore rating/ebs/scripts/MPay_certificate_11072003.p12 -storetype pkcs12
unknown attr1.3.6.1.4.1.311.17.1
Enter keystore password:
unknown attr1.3.6.1.4.1.311.17.1
***************** WARNING WARNING WARNING *****************
* The integrity of the information stored in your keystore *
* has NOT been verified! In order to verify its integrity, *
* you must provide your keystore password. *
***************** WARNING WARNING WARNING *****************
Keystore type: pkcs12
Keystore provider: SunJSSE
Your keystore contains 1 entry
c1e673ff559b00e86a399a1b21e4aed2_6ee3fa08-8ba8-4ff1-a8fd-01031842a3a3, Aug 18, 2003, keyEntry,
How can I generate the keystore file and know the private key alias so that i can generate the sign using sign().
thanks in advance.
Ranjan

It is possible to import a .p12 file into a keystore with a small Java program...
I found a sample to do this about a year ago, the source page is no longer valid. I have made some slight modifications to the original program, but left credit to the original author in the top (to the best of my knowledge).
Sample execution being:
$ java KeyStoreMove PKCS12 ~/igo.p12 p12-pas JKS ~/.keystore key-pas
Source alias: lester igo id #2
Rename alias to [<return> to keep original alias]: my-cert
New alias: my-cert
importing key lester igo id #2
keystore copy successful
* This code has been downloaded from the internet and contained no license.
* The Source for this was: http://home.istar.ca/~neutron/Thawte/KeystoreMove.txt
* The Page referencing it was: http://home.istar.ca/~neutron/Thawte/index.html
* The author appears to be:
* Michel I. Gallant
* [email protected]
import java.io.*;
import java.security.*;
import java.util.*;
public class KeyStoreMove {
public static void main(String args[]) throws Throwable {
java.security.Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
if (args.length<6) {
System.out.println(
"\nKeyStoreMove Usage: \njava KeyStoreMove <source> <destination> where\n" +
" <source> and <destination> are " +
"<storetype> <keystore> <password>\n");
System.out.println(" - Requires jsse for PKCS12 keystore support \n" +
" - source storetype can be JKS or PKCS12\n" +
" - destination storetype must be JKS type (PKCS12 write not supported)\n") ;
System.exit(0);
FileInputStream in;
// -------- Load source keystore to memory ---------
in = new FileInputStream(args[1]);
KeyStore ksin = KeyStore.getInstance(args[0]);
char[] pwin = args[2].toCharArray();
if (pwin.length==0) { pwin = null; }
ksin.load(in,pwin);
in.close();
// -------- Load destination keystore initial contents to memory ---------
in = new FileInputStream(args[4]);
KeyStore ksout = KeyStore.getInstance(args[3]);
char[] pwout = args[5].toCharArray();
if (pwout.length==0) { pwout = null; }
ksout.load(in,pwout);
in.close();
//--------- Main Loop to get keys/certs from source keystore ------------
BufferedReader stdin = new BufferedReader(new InputStreamReader(System.in));
Enumeration en = ksin.aliases();
while (en.hasMoreElements()) {
String alias = (String) en.nextElement();
if (ksout.containsAlias(alias)) {
System.out.println(args[4] + " already contains " + alias + " Key will not be copied.");
continue;
// ------- Ask user if alias of source key/cert should be renamed -----------
System.out.println("Source alias: " + alias);
System.out.print("Rename alias to [<return> to keep original alias]: ") ;
String newuseralias = stdin.readLine().trim() ;
if (newuseralias.equals("")){
newuseralias=alias;
System.out.println("Original alias used") ;
else {
System.out.println("New alias: " + newuseralias) ;
if (ksin.isCertificateEntry(alias)) {
System.out.println("importing certificate " + alias);
ksout.setCertificateEntry(newuseralias, ksin.getCertificate(alias));
if (ksin.isKeyEntry(alias)) {
System.out.println("importing key " + alias);
ksout.setKeyEntry(newuseralias, ksin.getKey(alias,pwin), pwout,ksin.getCertificateChain(alias));
//--------- End main loop ----------------------
//--------- Overwrite the destination keystore with new keys/certs --------------
FileOutputStream out = new FileOutputStream(args[4]);
ksout.store(out,pwout);
out.close();
System.out.println("keystore copy successful\n") ;
System.exit(0);

E-Sourcing importing Certificate to the Keystore

Similar Messages

Maybe you are looking for