Search code examples
ssljettyssl-certificatekeytoolexist-db

How to configure SSL in Jetty with CA signed certificate properly?

I am trying to secure my eXist-db app, which means the only port I want to leave open should be 8443 (for using WebDAV and admin app). This is the basic secure port eXist-db have open since the installation. It uses self-signed certificate. I have no problem with replacing default certificate with a new one but the problem is I am not able to do that with CA signed certificate.

I tried:

  1. sudo rm eXist-db/tools/jetty/etc/keystore
  2. cat ServerCertificate.crt Alpiro-TrustProvider-IntermediateCA.crt Root.cer > cert-chain.txt
  3. I cleaned bad ends of lines and verified every certificate starts on a new line.
  4. openssl pkcs12 -export -inkey my-app.key -in cert-chain.txt -out my-app.pkcs12
  5. keytool -importkeystore -srckeystore my-app.pkcs12 -srcstoretype PKCS12 -destkeystore eXist-db/tools/jetty/etc/keystore

After restart, I checked the connection with: openssl s_client -connect xx.xx.xxx.xxx:8443 and everything seems fine. I can see there is my trusted certificate and the connection (handshake) simply works. However, browsers still claim it is not a trusted connection.

When I try to check something over https via XQuery, it throws:

java.security.cert.CertificateException: No subject alternative names matching IP address xx.xx.xxx.xxx found …
Solution

  • The solution is quite trivial. The problem was I had been trying to access the site via IP, not via fully qualified domain name. Certificates are associated with domain names, not IPs!