Certificate Keystore Creation

Key dns SSL-Certificate

Audience

Staff

Overview

How to create a Certificate Keystore with multiple DNS names (Subject Alternative Names).

Creating The Keystore

Run the KeyStore GUI 5.1.1 as Administrator
From the File menu choose "open keystore" Or click the icon in the middle of the screen.
Browse to E:\Certs\ and select commonname.jks Double click to open it.
You will be prompted to enter a password. Enter the keystore password Old= "changeit" New = "itarget"
Now that your keystore is opened or created you must begin by generating a Key Pair. There are two ways to perform this one is to use the File Menu under tools and the second is to click the Key icon on the menu bar.
The Key Pair Dialog box will be displayed. You will need to adjust the setting as shown below
1. Choose RSA
2. Use 4096 key size
4. click OK
The Key Pair Certificate Dialog box will be displayed. You will need to adjust the setting as shown below
Certs are now 1 year only
Use SHA 256 with RSA
Click the icon to the right of the name field to display dialog box:
Fill in the appropriate information for the server/sites.
1. Common Name (CN) the URL of the site e.g. myservername.hs.pitt.edu
2. Organization Unit (OU): iTarget
3. Organization Name (O): University of Pittsburgh
4. Locality Name (L): Pittsburgh
5. State Name(ST): Pennsylvania
6. Country (C): US
7. svc-ssladmin@pitt.edu
9. Click OK
After clicking OK it will take you back to this window where we can now click Add Extensions if you need to add multiple names for Subject Alternative Names:
Click the green plus to add an extension and select subject alternative name and check critical extension then click OK:
Now you will have to add the alternative names. Click the green plus and fill in the info. Make sure you select DNS Name. Once you are done click OK (in this case we want to add jiratest.hs.pitt.edu and pittfalltest.hs.pitt.edu):
Click OK once you see this window:
Click OK here as well:
Make the alias domain{_}NEW if there is already a cert in use. Otherwise enter the alias to be the URL of the server and hit OK e.g. www.hsconnect.pitt.edu
Enter the key pair entry password. This should be the password of the "itarget")
You should now receive a message that the keypair was successful
You should also see your new keypair in the keystore. for example pnf.hs.pitt.edu_new
Right click on the new keypair generated and choose "Generate CSR"
For the certificate Request use the below settings:
1. PKCS #10
2. SHA-256 with RSA
3. Challenge field: leave blank
Browse to E:\Certs enter filename with today's date for the certificate request.(csr).txt will be easier to open later. i.e. (myservername.hs.pitt.edu_08_02_2021.csr.txt). Select Choose.
You should receive a Generate CSR successful message, click OK
Once the CSR has been created, the padlock icon in keystore will be open.
SAVE THE KEYSTORE

Using the CSR file to request a SSL Certificate from Pitt.

You can now go to the Pitt website to request the Incommon Certificate.

Browse To:
1. https://cert-manager.com/customer/InCommon/ssl?action=enroll
2. Enter the access code: UPitt
3. Enter email address svc-ssladmin@pitt.edu
4. Click the "Check Access Code" button.
Select the Certificate type:
1. For a single hostname, select the "InCommon SSL" option
2. For more than one hostname, select the "InCommon Multi Domain SSL" option and enter all of the hostnames in the "Subject Alternative Names" field
Select your Certificate Profile: InCommon SSL (SHA-2) OLD=Choose Microsoft IIS 5.x and later
Certificate Term: Select 1 year
Paste the CSR, from the file you saved in E:\Certificates, into the textbox on the form
Click the "Get Common Name from CSR" button. Make sure it is correct
Select the certificate term 1 year
Enter and verify a pass-phrase for the certificate. Pass-phrase should be "itarget" all lower case, no quotes
External requester: svc-ssladmin@pitt.edu
Click the "Enroll" button.
You will now see a message indicating your request has been submitted successfully.
After CSSD has processed the request you will receive another email from which you can download the certificate. Download ALL the certs and save them in the E:\certs Directory.
Now we must add the appropriate certificates to the keystore we created.
Run As Administrator From the keytool GUI of the appropriate keystore, right click the new keypair and choose "Import CA Reply - From File". The cert reply file is " commonname_cert.cer"
Repeat the steps in 15 to add "commonname.cer" to add the rest of the cert chain.
Adding the " commonname.crt" adds the AAA certificate services level:
Save the keystore
Stop and restart the appropriate service on the server if necessary.
Open a web browser, go to the site and check that the site shows the new certificate expiration date.