TOMCAT SSL Error: Alias name does not identify a key entry

Question

I am trying to configure Tomcat 6 using SSL with a certificate provided to us (by someone). My SSL experience only spans a few days, but I still have to configure the darn thing.

I was provided a certificate (downloaded from IE) in DER format.

Next I created a keystore:

keytool -import -alias btIEgen -file MyCompany.der -keystore b2b.keystore

Say I used "password" for password

I configured this in Tomcat's server.xml in the SSL section:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
    maxThreads="150" scheme="https" secure="true"
    keystoreFile="webapps/b2b.keystore" keystorePass="password" keyAlias="btIEgen" 
    clientAuth="false" sslProtocol="TLS" />

Upon starting Tomcat I get the darn error.

I then did a keytool -list on b2b.keystore, and noticed that the alias is in all lowercase, so after updating server.xml and restarting, I still get the same error, but for the lower case alias.

Then I though that perhaps I need a root CA. So I recreated the b2b.keystore as follows:

keytool -import -alias root -file myCA.cer -keystore b2b.keystore

Then I re-executed my keytool command against MyCompany.der

But I still get the same error, that the alias does not identify a key entry.

I am wondering if I am making some fundamental error in configuring tomcat, or should this thing be working and I'm just making a stupid careless mistake?

Any guidance would be greatly appreciated.

Answer 1

What Tomcat needs is the certificate and its private key. The certificate is public information that any of your user can see, but the private key should be yours only: this is what prevents others from running a website with your certificate. By importing MyCompany.der, you're only importing the certificate.

You would need to find where you private key is first. (Normally, even the person who issued the certificate to you shouldn't know its private key.)

The private key may have been generated within your browser during the certificate application process. Try to see if you can export in .p12/.pfx (PKCS#12) format: this should bundle the private key too if it's there. If so, you should be able to use the resulting file as a keystore directly using the PKCS12 store type: keystoreFile="store.pfx" keystorePass="password" keystoreType="PKCS12" (you probably won't need a key alias, since there will only be one key entry).