Commit fcfa8f4f authored by Gradl, Tobias's avatar Gradl, Tobias
Browse files

Info on creation of Java keystore

parent 7f956ee0
......@@ -21,15 +21,16 @@ In cases that do not require user detail persistence, no implementation of the *
Based on a X.509 keypair and certificate chains, the required Java keystore can easily be consolidated with `openssl` and the `keytool` (comes with Java installation). The followings steps show the commands for the example of the keystore for dfa.de.dariah.eu and the appropriate input. Please modify accordingly:
**Convert pem/pem keypair to p12 for easier input:**
For the -name argument make sure to chose the later alias of the keypair in the keystore -- specified in the following step with the -alias argument.
```
$ openssl pkcs12 -export -in dfa-de-dariah-eu-signed.pem -inkey dfa-de-dariah-eu-privatekey.pem > dfa-de-dariah-eu.p12
$ openssl pkcs12 -export -name dfa.de.dariah.eu -in dfa-de-dariah-eu-signed.pem -inkey dfa-de-dariah-eu-privatekey.pem > dfa-de-dariah-eu.p12
```
**Import p12 keypair and create Java keystore**
```
$ keytool -importkeystore -srckeystore dfa-de-dariah-eu.p12 -destkeystore dfa-de-dariah-eu.jks -srcstoretype pkcs12
$ keytool -importkeystore -alias dfa.de.dariah.eu -srckeystore dfa-de-dariah-eu.p12 -destkeystore dfa-de-dariah-eu.jks -srcstoretype pkcs12
```
**Import required trusted ca certificates (in our case the chain of our keypair and the trusted SAML metadata provider keychains)**
......@@ -40,4 +41,12 @@ $ keytool -import -trustcacerts -alias dfn-aai -file dfn-aai.pem -keystore dfa-d
$ keytool -import -trustcacerts -alias dfn-aai-g2 -file dfn-aai.g2.pem -keystore dfa-de-dariah-eu.jks
```
A more or less convenient option to view and edit Java keystore can be found in the [KeyStore Explorer](http://keystore-explorer.org/)
\ No newline at end of file
A more or less convenient option to view and edit Java keystore can be found in the [KeyStore Explorer](http://keystore-explorer.org/)
**Specify configuration parameters**
```
saml.keystore.path = /path/to/dfa-de-dariah-eu.jks
saml.keystore.pass = password # as entered in step 2 (keytool -importkeystore)
saml.keystore.alias = dfa.de.dariah.eu
saml.keystore.aliaspass = password # as entered in step 1 (openssl pkcs12 -export)
```
\ No newline at end of file
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment