Search code examples
javaopensslkeystorejks

Enable HTTPS in a Spring Boot Java application with a P7B certificate

I want to enable https in a spring boot java application with a p7b certificate.

server.ssl.key-store=cert.p7b
server.ssl.keyStoreType=PKCS7

But PKCS7 is not supported, that's why I tried to convert it to a java key store file (JKS), but I failed.

First I tried to import it with the key tool

keytool -importcert -trustcacerts -file cert.p7b -keystore newkeystore.jks –storetype JCEKS

but I get an Exception

java.lang.Exception: Input not an X.509 certificate

Then I tried to convert it to a pem file, which works

openssl pkcs7 -inform der -print_certs -in cert.p7b -out cert.pem

but then failed to convert it to a jks file because I did not have the a private key.

keytool -importcert -trustcacerts -file cert.pem -keystore newkeystore.jks –storetype JCEKS

Any kind of help is highly appreciated

Solution

  • To secure your SpringBoot application (enabling HTTPS), you need the private key along with the p7b certificate chain you have.

    This is how a p7b is issued:

    • First you create a key pair (private key and a public key)
    • Create a CSR (PKCS#10) from the key pair created above
    • Send the CSR to a Certificate Authority (CA) to get it signed
    • The CA signs it a give a certificate chain back in p7b (PKCS#7) format

    These are the steps you do after you receive the p7b:

    • Associate the certificate chain (p7b) to the private key you created in the very first step.

    Now you will have a signed key pair which you can use to secure your application.

    To answer your question, you need to find the keystore which you first created, which contains the private key and public key (self-signed certificate). And then you import/associate the certificate chain (p7b) to the private key using keytool.

    If you managed to find the keystore containing the private key, you can simple run this keytool command to associate the certificate chain.

    keytool -importcert -keystore [KEYSTORE] -storepass [KEYSTORE_PASSWORD] -file [P7B_FILE] -trustcacerts -alias [ALIAS_OF_KEY_PAIR] -keypass [KEY_PAIR_PASSWORD].

    After importing, this will be the keystore you use to secure your SpringBoot application.