title: Use my OpenDJ keystore for an Apache web site link: https://onemoretech.wordpress.com/2015/05/14/use-my-opendj-keystore-for-an-apache-web-site/ author: phil2nc description: post_id: 9685 created: 2015/05/14 15:39:11 created_gmt: 2015/05/14 19:39:11 comment_status: closed post_name: use-my-opendj-keystore-for-an-apache-web-site status: publish post_type: post

Use my OpenDJ keystore for an Apache web site

Put more precisely: how do I export the TLS key and cert from my OpenDJ directory to x509 format so it can be used by an Apache server with the same host name. It turns out this isn't nearly as hard to do as you'd think. First of all, you'll need to make sure you're OpenDJ instance isn't still using the default cert generated during installation. See my article on replacing that default OpenDJ cert here. Exporting the key and certificate from OpenDJ's keystore into their x509 counterparts is a two step process. In this example we'll image that $DSHOME is /usr/local/opendj, and the server name is ldap.example.com (which may in fact be just a CNAME for the actual host). 1. Convert the keystore from JKS to PKCS#12 format. Keytool can't export to x509 format. It can export to PKCS#12, which can then be converted to x509 using the openssl utility. [code language="bash" gutter="false"] keytool -importkeystore \ -srckeystore $DSHOME/config/keystore \ -destkeystore ~/keystore.p12 \ -deststoretype PKCS12 [/code] Keytool will ask first for a password to assign to the new keystore, then for the existing keystore's password (If you haven't changed things from the Java default the password for the existing keystore will be "changeit"). The result of this command will be a new file called "keystore.p12". 2. Extract the certificate and key from the PKCS#12 keystore into separate x509 formatted files. First the certificate: [code language="bash" gutter="false"] openssl pkcs12 -in keystore.p12 -nokeys -out ldap.example.com.crt [/code] Then the key: [code language="bash" gutter="false"] openssl pkcs12 -in keystore.p12 -nodes -nocerts -out ldap.example.com.key [/code] Now you can take the resulting files (ldap.example.com.crt and ldap.example.com.key), and copy them into the directory where your Apache keys and certs are kept (on Red Hat systems this should be the common PKI directories, /etc/pki/tls/certs and /etc/pki/tls/private, respectively). Then simply point your Apache configuration at them (again, on Red Hat systems this should be in /etc/httpd/conf.d/ssl.conf alongside the SSLCertificateFile and SSLCertificateKeyFile directives). NOTES: Whenever possible I store my certs and keys in the common PKI directory for the system. This makes it easier to find them during recovery operations, maintenance or an audit. After many years of using different conventions, I've finally settled on using the fully qualified host name for certificates and keys -- ldap.example.com.crt rather than ldap.crt -- because it leads to less confusion later on. Many examples (including my own) will use the .pem file extension for x509 files, I've now adopted the .crt and .key extensions as simply more descriptive of the file's function, and to be doubly sure they are immediately identifiable. Anyone who can't figure out that a file beginning with the text "-----BEGIN PRIVATE KEY-----" is an x509 ASCII-Armored key file has bigger problems than having a format specific file name extension will solve.

Copyright 2004-2019 Phil Lembo