I am setting up a HTTPS server using Spring boot. I followed the Configure SSL on Spring Boot Docs.
My application.properties file is as follows.
# SSL
server.port = 8443
server.ssl.key-store = classpath:keystore.jks
server.ssl.key-store-password = rootroot
But when I access https://localhost:8443 . The server returns no response and server is temporarily down.
Can you guide me what is going wrong?
Finally, I found the answer. I was using the keystore.jks generated from another machine instead of generating in server machine.
Now I solved the problem by using the keystore generated by keytool on server machine and everything went well.
Anyway, thank you for your answers.
Your information did not work for me, then I've did some researches and now it's working after I followed the below steps:
openssl pkcs12 -export -in <mycert.crt> -inkey <mykey.key> -out <mycert.p12> -name tomcat -CAfile <myca.ca> -caname root -chain
(I ran the above command to generate a pkcs12 in my digitalcert, which the only file that does not exists yet is the mycert.p12)
After that I've copied the mycert.p12 to src/main/resources
And finally this is my application.properties file configuration:
server.context-path=/cv2
server.port=8880
server.ssl.key-store=classpath:java_admin_checkverification_com.p12
And now everything is working like a charm!
PS: The configuration server.ssl.key-store was not working for me when I was at the version 1.2.4, because it was not finding the file in the classpath at all... Always throwing FileNotFoundException, so I updated to 1.3.5, with the above configurations and now everything is working.
I've had the same problem and adding the key-store-type fixed it:
server.ssl.key-store-type: JKS
"Tomcat requires the key store (and trust store if you’re using one) to be directly accessible on the filesystem, i.e. it cannot be read from within a jar file. This limitation doesn’t apply to Jetty and Undertow."
by default tomcat is used
If someone has same issue -
my settings are
server.port=8443
server.ssl.key-store=classpath:certs/localhost.keystore
server.ssl.key-store-password=somepass
server.ssl.key-password=somepass
I had a problem with my request - Ive been sending request to 127.0.0.1:8443, but my certificate had name localhost! I fixed request to localhost:8443 and all went right.
Reinstalling my cert with certbot fixed it for me. Just ran certbot and 1: Attempt to reinstall this existing certificate. I already had my config setup like the other answers. I'm not sure how this fixed it, but I figure I'd leave this answer here. I'm using Nginx.
Related
I have .cer and .p7b certificate I tried to apply it on my ssl config file but my apache suddenly crash so I retain the previous settings which is ca.crt and the apache return to active status.
Question 1 should I need to convert my .cer file to .crt before applying it on my ssl config?
Question 2 How to convert the file and make it compatible with my server/ssl?
If you need more details, let me know. Thank you!
My domain is: https://www.neasy.de
I ran this command:
git clone https://github.com/certbot/certbot
cd certbot
./certbot-auto certonly -a standalone -d neasy.de -d www.neasy.de
cd /etc/letsencrypt/live/neasy.de
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname root
It produced this output:
My web server is (include version):
The operating system my web server runs on is (include version): linux
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don’t know):yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):certbot 0.31.0
4 month ago i first used letsencrypt and I was success to use it. I learned I have to generate certificate
with and without www. prefix and it is important. My company has changed the domain name from neasy.app to neasy.de and for that I deleted my old certificate and generate new one for neasy.de
Now i am in a new trouble that if i write in my browser neasy.de it does not work even if i write www.neasy.de it does not work. But for at least once time if I write https://neasy.de or https://www.neasy.de it works, and for the next time i dont need to write https:// prefix.
This issue really seems weird to me any help will be appreciated. If you already tried writting https://neasy.de then you can open firefox browser private window
Since you're using Ubuntu please follow this guide:
https://certbot.eff.org/lets-encrypt/ubuntuxenial-apache.html (jus make sure to choose your ubuntu release from the dropdown).
this will guide you through the whole process without manual work.
Just make sure to run all apt-related commands.
Was there a route for the old domain neasy.app which was redirecting the http traffic to https ? It looks like you forgot to update that route with the new domain name.
Usually when you enter any new website in the address bar of browser it by default uses http protocol. On the server site you have to do a 301 redirect from http to https.
I am new to SSL setup, please excuse me if my question is wrong.
I have deployed a Spring Boot application on AWS EC2 (Windows) instance with bunch of restful services, exposed through public IP address (AWS), i am able to access them publicly(http). I want to SSL(https) them now. I am in process of purchasing certificate, in one of the steps to setup, they have given these lines to validate a text file, is anyone aware of this ? Can you please suggest where i need to create ./well-known/pki-validation folder on my Spring Boot application(Tomcat) ?
The issuing vendor will provide you with a simple text-based file to place in sub-folders /.well-known/pki-validation/ in your site’s "home directory". If done properly, the vendor can view this file via HTTP:// and then issue the certificate upon confirmation.
1 Install certboot in the server.
git clone https://github.com/certbot/certbot
cd certbot
./certbot-auto --help
2 Obtain the certificate
In order to obtain the certificate you need to expose trough the server certain files. I do that using the target folder of spring boot tomcat.
./certbot-auto certonly --webroot -w {SpringBootProjectDir}/target/classes/static/ -d {yourDomain.com}
This command obtains the certificates and leaves them in:
/etc/letsencrypt/live/{yourDomain.com}/
Tomcat can't read the certificate provided since its not in p12 format. We have to generate the cert in this format. Use this command
sudo openssl pkcs12 -export -in /etc/letsencrypt/live/{yourDomain.com}/fullchain.pem -inkey /etc/letsencrypt/live/{yourDomain.com}/privkey.pem -out /etc/letsencrypt/live/{yourDomain.com}/keystore.p12 -name tomcat -CAfile /etc/letsencrypt/live/{yourDomain.com}/chain.pem -caname root
It will ask you a password. Keep the password.
3 Configure the server
server.port=443
server.ssl.enabled=true
server.ssl.key-store: /etc/letsencrypt/live/{yourDomain.com}/keystore.p12
server.ssl.key-store-password: {password}
server.ssl.keyStoreType: PKCS12
server.ssl.keyAlias: tomcat
Restart the server and Thats it!
Well, My problem starts with Google Maps API. Working local everything is fine, but When i published my system in web (Digital Ocean Host) i discovered that Google Maps API only works with HTTPS protocol.
So, searching in the internet i found the https://letsencrypt.org/ , a good way to use HTTPS without pay, beacause i'm justing testing, not production yet.
But i'm using a JBOSS EAP 7 and i didn't found any tutorial in letsencrypt.org to JBOSS, so i found this link: https://knowles.co.za/creating-renewing-a-lets-encrypt-certificate-for-apache-and-wildfly/.
Following the WildFly tutorial i tried execute this step:
sudo openssl pkcs12 -export -in /etc/letsencrypt/live/YOURDOMAIN/fullchain.pem -inkey /etc/letsencrypt/live/YOURDOMAIN/privkey.pem -out YOURKEYSTORENAME.p12 -name KEYSTOREALIAS
PS: I changed the YOURDOMAIN to my domain.
I got the following error:
No such file or directory fullchain.pem
This file didn't should be created automatically ?
My objective, is to configure the Jetty in such a way that it enables HTTPS request for Geoserver.
To be a bit specific, I am downloading the Geoserver Windows Installer.
As tested both version 2.9-RC1 and 2.10.2, they throw the warning
"Module not found [ssl]" as soon as it is started.
Jetty version: 9.2.13.v20150730
I am referring to the info here to try setup the simplest test (self-signed) for the jetty, but still no luck.
What I did:
Use Keytool create a self-signed keystore
Replace the keystore generated from 1) to directory etc/keystore
Edit the jetty-ssl.xml, replace the password (attribute default) with mine
Edit the file start.ini, add --module=https, jetty.secure.port=8443
Launch the batch file.
What did i miss?
P.S.: Geoserver works perfectly in HTTP. This post is asking about configuration for HTTPS.
Here are the steps to enable jetty to run geoserver on https, port:8443
• Configuring Jetty for SSL
follow this link to create ssl certificate and keystore. https://www.eclipse.org/jetty/documentation/9.1.5.v20140505/configuring-ssl.html
Now open jetty-ssl.xml file present in Geoserver/etc folder and replace the KeyStorePassword, KeyManagerPassword, TrustStorePassword with the new password which is created while creating keystore.
Open & check jetty.xml file in same folder, on which port https will run.
• Add new Keystore in Geoserver
Copy the created keystore file and replace with the existing available in etc folder of geoserver ex: C:\GeoServer\etc.
Now check if ssl.mod file is present in modules folder or not, ex: C:\GeoServer\modules.
If present, then open the file and replace the password in jetty.keystore.password, jetty.keymanager.password and jetty.truststore.password with the new password. Otherwise download it from “http://central.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.2.13.v20150730/jetty-distribution-9.2.13.v20150730.tar.gz.
NOTE : Please make sure password entered should be same as in jetty-ssl.xml.
Open start.ini file present in C:\GeoServer folder add --module =ssl, --module=https and jetty.secure.port=8443 (if https is running on Port 8443.
Run geoserver, enter url https://localhost:8443/geoserver (assuming geoserver on local system).
The https module has a dependency on the ssl module. The error is stating it cannot find ssl.mod in the ${jetty.home}/modules (or, depending on your config, ${jetty.base}/modules) directory.
The ssl module comes standard as part of the Jetty distribution so it has either been deleted, moved or renamed as part of your implementation.
For Geoserver 2.12.1, I manually installed "ssl.mod" from jetty-distribution-9.2.13.v20150730.tar.gz in Geoserver's etc/modules directory. Then the warning message didn't occur again in the log.
remember to add --module=ssl to start.ini
complete password and keystore/truststore location in jetty-ssl
port in jetty-https default 443
port in jetty xml can stay at default 8443
open ssl mod in a text editor and comment out the keystore under the [files] tag
ini-template tag --jetty secure port can stay at 8443
Comment out anything that refers to jetty keystore as these are set in jetty-ssl
open https mod and change https port to 443, restart geoserver.
Geoserver should now run over jetty https:// with no port number.