title: Converting PEM Certificate for use in JAVA Spring Framework
body: <p>I have a web application running on Ubuntu 16.04.3 server and in a development environment, I have a self signed X509 certificate generated and configured under Apache2.0.48. This all works just fine.</p>
  
  <p>An example command that I use within a build script to generate the X509 is as follows:</p>
  
  <pre><code>openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /var/www/ssl/selfSigned.key -out /var/www/ssl/selfSigned.crt -subj "/C=US/ST=California/L=Somewhere/O=SomeGroup/OU=SomeOU/CN=192.168.0.150"
  </code></pre>
  
  <p><strong>Certificate Issues</strong></p>
  
  <p>I've recently introduced a 3rd party JAVA application (Spring framework apparently) within my application and I've been working to integrate it into my application. Their support team have been fantastic in getting things working in an HTTP environment, and have directed me to <a href="https://www.thomasvitale.com/https-spring-boot-ssl-certificate/" rel="nofollow noreferrer">this link</a> to set up a Spring application under HTTPS using self signed X509s.</p>
  
  <p>I update my application.properties file with changes as follows:</p>
  
  <pre><code>server.port=8181
  security.require-ssl=true
  server.ssl.key-store-type=PKCS12
  server.ssl.key-store=/var/www/secure/ssl/keystore.p12
  server.ssl.key-store-password=123456
  server.ssl.key-alias=server1
  </code></pre>
  
  <p>Using the simple import command (as per 1.b on the link) </p>
  
  <pre><code>keytool -import -keystore /var/www/ssl/keystore.p12 -storepass 123456 -noprompt -alias server1 -file /var/www/ssl/self-signed.crt
  </code></pre>
  
  <p>the certificate appears to get inserted into the keystore ok, but when I restart the 3rd party service to read the new parameters, I get this</p>
  
  <pre><code>Jun 15 19:32:08 ubuntu java[7016]: ***************************
  Jun 15 19:32:08 ubuntu java[7016]: APPLICATION FAILED TO START
  Jun 15 19:32:08 ubuntu java[7016]: ***************************
  Jun 15 19:32:08 ubuntu java[7016]: Description:
  Jun 15 19:32:08 ubuntu java[7016]: The Tomcat connector configured to listen on port 8181 failed to start. The port may already be in use or the connector may be misconfigured.
  Jun 15 19:32:08 ubuntu java[7016]: Action:
  Jun 15 19:32:08 ubuntu java[7016]: Verify the connector's configuration, identify and stop any process that's listening on port 8181, or configure this application to listen on another por
  Jun 15 19:32:08 ubuntu systemd[1]: 3ps.service: Main process exited, code=exited, status=1/FAILURE
  Jun 15 19:32:08 ubuntu systemd[1]: 3ps.service: Unit entered failed state.
  Jun 15 19:32:08 ubuntu systemd[1]: 3ps.service: Failed with result 'exit-code'.
  </code></pre>
  
  <p>I wondered if it was the certificate, so I then decided to use keytool to generate one instead of openssl (note the use of a test keystore which I updated my application.properties to use):</p>
  
  <pre><code>keytool -genkeypair -alias server1 -keyalg RSA -keysize 2048 -keystore /var/www/secure/ssl/test.p12 -storetype PKCS12 -validity 3650
  </code></pre>
  
  <p>When I use this, the service at least starts (even if the application doesn't work as expected) so I can only assume that the certificate needs to be converted.</p>
  
  <p>Googling shows that it's reasonably simple to convert my existing certificates from PEM  (<strong><em>PKCS10 format I assume, as I'm using "req"?</em></strong>) to PKCS12 so I try that with the following command:</p>
  
  <pre><code>openssl pkcs12 -export -out certificate.pfx -inkey self-signed.key -in self-signed.crt
  </code></pre>
  
  <p>(I leave the export password as blank so as not to keep having to type it in when services restart). Then I take my new PKCS12 certificate and import it (noting a new keystore too):</p>
  
  <pre><code>keytool -import -keystore test2.p12 -storepass 123456 -noprompt -alias server1 -file certificate.pfx
  </code></pre>
  
  <p>But that command fails with <strong>keytool error: java.lang.Exception: Input not an X.509 certificate</strong></p>
  
  <p>I've also tried</p>
  
  <pre><code>openssl crl2pkcs7 -nocrl -certfile self-signed.crt -out self-signed.p7b
  keytool -import -keystore test.p12 -storepass 123456 -noprompt -alias server1 -file self-signed.p7b
  </code></pre>
  
  <p>... and get the same error (not an X.509 certificate)</p>
  
  <p>I've Googled how to convert these certificates between various formats and into a format that keytool can use (and the service starts correctly) but I seem to be getting into a never-ending loop and no further forward.</p>
  
  <p>From what I initially see, I don't believe that there's anything wrong with the 3rd party application itself, as it runs under HTTP just fine; and adding HTTPS to Spring appears to be very simple. I'm not a JAVA guru and so I can only surmise that something's amiss with the certs.</p>
  
  <p>Can anyone see where I'm going wrong? </p>