how to build keystore for shibboleth?

[Jeff Mccullough]

This may work for you.

openssl genrsa -out idp.key 2048
openssl req -new -x509 -nodes -sha1 -days 7305 -key idp.key -out idp.crt

openssl pkcs12 -export -in idp.crt -inkey idp.key -out idp.p12
keytool -importkeystore \
-deststorepass changeme \
-destkeypass changeme \
-destkeystore idp.jks \
-srckeystore idp.p12 \
-srcstoretype PKCS12 \
-srcstorepass changeme \
-alias 1

Jeff


On Oct 28, 2011, at 1:52 PM, Leonard Kroll wrote:

> Yes, one get generated when I run install.sh to install shibboleth.
> I was hoping I could avoid taking the install process apart to figure out what the shibboleth install is doing.
> 
> 
> Leonard Kroll
> UNIX / GIS Administrator
> Univ. Massachusetts Boston
> Leonard(dot)Kroll(at)umb.edu
> Phone: 617-287-5048
> fax:      617-287-5224
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
> Sent: Friday, October 28, 2011 4:49 PM
> To: Shib Users
> Subject: Re: how to build keystore for shibboleth?
> 
> You'll need to use whatever tools are provided by whatever system
> needs the JKS file.  Nothing in the IdP uses one.  Your container
> might, which is why we generate one automatically, but that's all done
> programmatically, not using any particular command line tool.
> 
> On Fri, Oct 28, 2011 at 16:14, Leonard Kroll <Leonard.Kroll at umb.edu> wrote:
>> Hi,
>> 
>> Just got a cert from our CA EduCause.
>> 
>> I have never done this before, do don't assume I know anything J
>> 
>> 
>> 
>> How do I correctly create the keystore from the cert?
>> 
>> I have server.crt, server,key and server.csr file.
>> 
>> I also have a CA intermediate file with a csr chain in it.
>> 
>> 
>> 
>> I tried to build the idp.jks file, but when I try to use it I get ssl
>> errors.
>> 
>> What did I miss doing or do wrong?
>> 
>> 
>> 
>> Oct 28, 2011 3:58:10 PM org.apache.coyote.http11.Http11Protocol init
>> 
>> SEVERE: Error initializing endpoint
>> 
>> java.io.IOException: jsse.invalid_ssl_conf
>> 
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:755)
>> 
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:460)
>> 
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
>> 
>>         at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
>> 
>>         at
>> org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
>> 
>>         at
>> org.apache.catalina.connector.Connector.initialize(Connector.java:1007)
>> 
>>         at
>> org.apache.catalina.core.StandardService.initialize(StandardService.java:677)
>> 
>>         at
>> org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
>> 
>>         at org.apache.catalina.startup.Catalina.load(Catalina.java:540)
>> 
>>         at org.apache.catalina.startup.Catalina.load(Catalina.java:560)
>> 
>>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> 
>>         at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
>> 
>>         at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
>> 
>>         at java.lang.reflect.Method.invoke(Unknown Source)
>> 
>>         at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
>> 
>>         at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
>> 
>> Caused by: javax.net.ssl.SSLException: No available certificate or key
>> corresponds to the SSL cipher suites which are ena
>> 
>> bled.
>> 
>>         at
>> com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(Unknown
>> Source)
>> 
>>         at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(Unknown
>> Source)
>> 
>>         at
>> org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:751)
>> 
>>         ... 15 more
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> Leonard Kroll
>> UNIX / GIS Administrator
>> Univ. Massachusetts Boston
>> Leonard(dot)Kroll(at)umb.edu
>> Phone: 617-287-5048
>> fax:      617-287-5224
>> 
>> 
>> 
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>> 
> 
> 
> 
> -- 
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111028/dbda2317/attachment-0001.html