Follow these
instructions to generate a Private Key and CSR.
Using the
java keytool
command line utility, the first thing you need to do is create a keystore
and generate the key pair. Do this with the following command: keytool -genkey
-keysize 1024 -keyalg RSA -alias tomcat -keystore mykeystore
Tip: The 1024
in the command above is the key bit length. ipsCA recommends at leat 1024 (2048
for EV SSL).
You will
be prompted for a password for the keystore. Tomcat uses a default password
of "changeit". Hit enter if you want to keep the default password. If you
use a different password, you will need to specify a custom password in the
server.xml configuration file.
You will
be prompted for a password for the private key within the keystore. If you
press enter at the prompt, the key password is set to the same password as
that used for the keystore from the previous step. The key password must be
at least 6 characters long. Make a note of the passwords. If lost they cannot be
retrieved.
You will
be asked for several pieces of info which will be used by ipsCA to create
your new SSL certificate. These fields include the Common Name (aka domain,
FQDN), organization, country, key bit length, etc. Use the CSR Legend in the
right-hand column of this page to guide you when asked for this information.
The following characters should not be used when typing in your CSR input: <
> ~ ! @ # $ % ^
/ \ ( ) ? , &
On some
older versions of the keytool utility, the next field that you will be
prompted for is What is your first and last name? At this prompt, you must
specify the Common Name of your web site (see CSR legend), not your real
first and last name.
You will
then be prompted for your organizational unit, organization, etc.
Now
generate the Certificate Signing Request (CSR) from the private key
generated above using the following command: keytool -certreq -alias tomcat
-file yourdomain.csr -keystore mykeystore This creates a CSR and stores it
in a file named yourdomain.csr.
Save a
copy of your CSR.
Below is an example of what your CSR will look like. This is a
example only and cannot be used to generate your SSL certificate.
