Convert certificate in PKCS12 format for tomcat / JKS Keystore

Question

I have following wildcard certificate files from GlobalSign Authority.

root.crt
intermediate.crt
private.key 

I want to configure tomcat HTTPS using above cert files. I believe Tomcat support PKCS12 format.

How do i convert those certificate files in PKSC12 format? also how do i import them in tomcat keystore, specially intermediate cert?

Solution

Use openssl to create your PKCS12 file

First create a single intcacerts.pem file with your intermediate(s) and CA, pasted one after each other (they must be in PEM format).

Then call openssl

openssl pkcs12 -export -in myservercert.pem -inkey private.key -certfile intcacerts.pem -name "aFriendlyName" -out keyandcerts.p12

(myservercert.pem is the server certificate in PEM, intcacerts.pem contains the intermediate(s) and CA as described above, private.key is the private key associated with the server certificate)

The documentation for openssl pkcs12 is here

To convert the generated PKCS12 into a JKS keystore, do something like this

keytool -importkeystore -srckeystore keyandcerts.p12 -srcstoretype PKCS12 -destkeystore myJKS.jks