Jetty Keystore Trouble with jetty-base provided in Shibboleth 3

[Rod Widdowson]

If you are deploying your own jetty you should really be basing your work on https://wiki.shibboleth.net/confluence/display/IDP30/Jetty9
rather on the jetty configuration which is shipped.

However it is a reasonable template for a deployment (so long as you don't just accept it) so...

> Accordingly, I have keys, X509 certs, etc for the existing configuration that
> have worked fine in Apache, 

This being for the "browser facing" port (443)?

> From what I've gathered, as the keys and certs are separate files, that I need
> to convert them to PKCS12. I've done so based on thes example from Jetty's
> documentation:

Right.  Eschew keystores.

> Then I use keytool like this:
> keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -
> destkeystore keystore

I wouldn't do that.
 
> And then I edit jetty-base/start.d/idp.ini to have the
> jetty.browser.keystore.path point to the absolute location of the certificate,
> in JKS format, and then I set the password and the keystore type to JKS.

Make sure that jetty.browser.keystore.type is PKCS12 and jetty.browser.keystore.password is correct. Job done.

Except:

> Then when I start Jetty up, invariably, I get complaints about the keystore
> format being invalid. 

What does it say exactly?