Jetty Keystore Trouble with jetty-base provided in Shibboleth 3

[Cantor, Scott]

On 7/14/15, 9:28 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

>Accordingly, I have keys, X509 certs, etc for the existing configuration that have worked fine in Apache, but I'm having a difficult time getting them to work with Jetty using the jetty-base that ships with Shibboleth 3. 

As Rod said, that's not right. We provide material on configuring Jetty in the wiki.

>cat cert.crt intermediate-reverse.crt > cert-chain.txt
>openssl pkcs12 -export -inkey example.key -in cert-chain.txt -out example.pkcs12

I use a command like this with the intermediate in a separate file.

openssl pkcs12 -export -out file.p12 -inkey private.key -in public.crt -certfile chain.crt

>Then I use keytool like this:
>keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -destkeystore keystore

That will create what you don't want, a keystore.

-- Scott