<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">This may work for you.<div><br></div><div><span class="Apple-style-span" style="font-family: Helvetica, Arial, sans-serif; font-size: 13px; line-height: 17px; "><pre style="padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; text-align: left; overflow-x: auto; overflow-y: auto; font-family: 'Courier New', Courier, monospace; line-height: 1.3; ">openssl genrsa -out idp.key 2048
openssl req -new -x509 -nodes -sha1 -days 7305 -key idp.key -out idp.crt</pre></span><div><br></div><div><span class="Apple-style-span" style="font-family: Helvetica, Arial, sans-serif; font-size: 13px; line-height: 17px; "><pre style="padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; text-align: left; overflow-x: auto; overflow-y: auto; font-family: 'Courier New', Courier, monospace; line-height: 1.3; ">openssl pkcs12 -export -in idp.crt -inkey idp.key -out idp.p12
keytool -importkeystore \
-deststorepass changeme \
-destkeypass changeme \
-destkeystore idp.jks \
-srckeystore idp.p12 \
-srcstoretype PKCS12 \
-srcstorepass changeme \
-alias 1</pre><pre style="padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; text-align: left; overflow-x: auto; overflow-y: auto; font-family: 'Courier New', Courier, monospace; line-height: 1.3; "><br></pre><pre style="padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; text-align: left; overflow-x: auto; overflow-y: auto; font-family: 'Courier New', Courier, monospace; line-height: 1.3; ">Jeff</pre><pre style="padding-top: 0px; padding-right: 0px; padding-bottom: 0px; padding-left: 0px; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; text-align: left; overflow-x: auto; overflow-y: auto; font-family: 'Courier New', Courier, monospace; line-height: 1.3; "><br></pre></span><div><br></div></div><div><div><div>On Oct 28, 2011, at 1:52 PM, Leonard Kroll wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Yes, one get generated when I run install.sh to install shibboleth.<br>I was hoping I could avoid taking the install process apart to figure out what the shibboleth install is doing.<br><br><br>Leonard Kroll<br>UNIX / GIS Administrator<br>Univ. Massachusetts Boston<br>Leonard(dot)Kroll(at)<a href="http://umb.edu">umb.edu</a><br>Phone: 617-287-5048<br>fax: 617-287-5224<br><br><br>-----Original Message-----<br>From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [mailto:users-bounces@shibboleth.net] On Behalf Of Chad La Joie<br>Sent: Friday, October 28, 2011 4:49 PM<br>To: Shib Users<br>Subject: Re: how to build keystore for shibboleth?<br><br>You'll need to use whatever tools are provided by whatever system<br>needs the JKS file. Nothing in the IdP uses one. Your container<br>might, which is why we generate one automatically, but that's all done<br>programmatically, not using any particular command line tool.<br><br>On Fri, Oct 28, 2011 at 16:14, Leonard Kroll <<a href="mailto:Leonard.Kroll@umb.edu">Leonard.Kroll@umb.edu</a>> wrote:<br><blockquote type="cite">Hi,<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Just got a cert from our CA EduCause.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I have never done this before, do don't assume I know anything J<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">How do I correctly create the keystore from the cert?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I have server.crt, server,key and server.csr file.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I also have a CA intermediate file with a csr chain in it.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I tried to build the idp.jks file, but when I try to use it I get ssl<br></blockquote><blockquote type="cite">errors.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">What did I miss doing or do wrong?<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Oct 28, 2011 3:58:10 PM org.apache.coyote.http11.Http11Protocol init<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">SEVERE: Error initializing endpoint<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">java.io.IOException: jsse.invalid_ssl_conf<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:755)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:460)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.catalina.connector.Connector.initialize(Connector.java:1007)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.catalina.core.StandardService.initialize(StandardService.java:677)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at org.apache.catalina.startup.Catalina.load(Catalina.java:540)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at org.apache.catalina.startup.Catalina.load(Catalina.java:560)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at java.lang.reflect.Method.invoke(Unknown Source)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Caused by: javax.net.ssl.SSLException: No available certificate or key<br></blockquote><blockquote type="cite">corresponds to the SSL cipher suites which are ena<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">bled.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(Unknown<br></blockquote><blockquote type="cite">Source)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(Unknown<br></blockquote><blockquote type="cite">Source)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> at<br></blockquote><blockquote type="cite">org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:751)<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> ... 15 more<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Leonard Kroll<br></blockquote><blockquote type="cite">UNIX / GIS Administrator<br></blockquote><blockquote type="cite">Univ. Massachusetts Boston<br></blockquote><blockquote type="cite">Leonard(dot)Kroll(at)<a href="http://umb.edu">umb.edu</a><br></blockquote><blockquote type="cite">Phone: 617-287-5048<br></blockquote><blockquote type="cite">fax: 617-287-5224<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">--<br></blockquote><blockquote type="cite">To unsubscribe from this list send an email to<br></blockquote><blockquote type="cite"><a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote><blockquote type="cite"><br></blockquote><br><br><br>-- <br>Chad La Joie<br><a href="http://www.itumi.biz">www.itumi.biz</a><br>trusted identities, delivered<br>--<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>--<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></blockquote></div><br></div></div></body></html>