Loading a new SSL certificate

Hi John,

Please confirm that you have a PFX file. A PFX file is a wrapper containing a x509 certificate and a private key. The PFX file should be password protected. If it is not, you will need to use a tool such as OpenSSL to add a password. If it is not a PFX file and just an x509 certificate and private key, then you will need to convert it into a PFX (again OpenSSL can do that).

Is the certificate signed by an external certificate authority? Windows by default trusts the major certificate authorities. If so there should not be any need to manually add it to the Windows certificate manager. Though unknown (often internal or self-signed) authorities will need to be added manually (or via a domain controller, for example).

Are you preparing a new APP10 environment? Or are you trying to refresh the certificate for an existing environment? If the later IFS has a update_http_certificates.cmd option as well.

Additional details will help to give you the best answer.

Best regards -- Ben

@Ben Monroe When prompted for the keystore password is this prompting for the password of the pfx file?

Hi John,

It is a little complicated to add a password after the fact to an existing PFX file. I would recommend discussing this with your IT manager before proceeding. You will need to extract the x509 certificate and private key from the existing PFX and recreate it, this time with a password. Steps 6) and 7) below may be particularly difficult unless you have such experience.

1) Install OpenSSL if not already available. Linux is easiest through a package manager. There are many builds available for Windows. It is also included in Git for Windows, which may be easiest.

2) Extract the x509 certificate from the existing PFX file.

openssl pkcs12 -in <pfx file> -out temp.pem -nodes

3) Test the extracted temp.pem to ensure it is as expected.

openssl x509 -in temp.pem -text -noout

4) Extract the private key from the existing PFX file.

openssl pkcs12 -in <pfx file> -nocerts -nodes -out key.pem

5) Test the extracted private key to ensure it is as expected. Assuming the key is also not password protected, press Enter when prompted for the password.

openssl pkey -in key.pem -text -noout

6) Verify the certificate chain. Check the output from step 3) for the Issuer field.
Obtain a copy of that issuer certificate. Repeat until you have certificates all the way to the root.
7) Concatenate the non-leaf certificates (intermediate--possibly multiple--and root) into a chain.

type <intermediate certificate 1> <intermediate certificate 2...> <root certificate> > chain.pem

8) Create a new PFX based on the extracted x509 certificate and private key. (Other options are possible.)

openssl pkcs12 -export -in temp.pem -inkey key.pem -chain -CAfile chain.pem -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg sha1 -out <new pfx file>

8) Set a password when prompted.
 

Best regards -- Ben