KB 180009
Using chained certificates for IAS webadmin.
Creation date: 07/12/2015
Last Review: 4/01/2016
Document type: How To
Revision number: 2
Security status: EXTERNAL
Summary
This KB explains how configure IAS to make use of chained / custom / commercial /
multi-level certificates for web administration. (I.e. certificates issued by an
intermediate / sub-CA). This KB is valid as from IAS 3.6.8.
Problem symptoms / details.
Some customers prefer not to make use of the SSL certificate generated by the IAS
configuration wizard for the web administration website.
Instead, they have certificates issued by either their own or a commercial certification
authority. Often those certificates are not signed by the root Certification Authority
directly, but by a lower-level / intermediate CA. On top of that, the certificates
provided by the commercial CA’s are not always in the PEM format.
This article explains how to make use of these kind of certificates for securing the
communication between the browser and the IAS web administration site.
Problem Solution.
The Tomcat used as from IAS 3.8 makes use of a Java key store and no longer directly
reads certificates from a PEM file. The procedure below instructs how to create such a
key store containing your (chained) certificates and how to configure Tomcat to make
use of this freshly created key store.
Section 6.4 from the IDENTIKEY Server Administrator Guide partially explains this,
however it does not describe the scenario where an intermediate CA is used, nor how
to convert certificates from 1 format to another.
Steps to take:
1. Using a text editor, create a blank file named new_webadmin_cert.pem
2. Ensure you have the certificates you want to use in .pem format. If you
received them in another format, convert them first. Here are some commands
Applies to: IDENTIKEY Authentication Server
KB 180009– 4/01/2016
2015 VASCO Data Security. All rights reserved.
Page 1 of 3
that will help with the conversion:
Convert a DER file (.crt .cer .der) to PEM
openssl x509 -inform der -in certificate.cer -out certificate.pem
Convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to
PEM:
openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes
3. Add the following contents in this exact order to this
“new_webadmin_cert.pem”. To do so, you can copy/paste the appropriate
sections from PEM formatted files.
Private key matching the server certificate
Server certificate (for the IAS web administration site)
Certificate of the intermediate CA (that signed the server certificate)
… eventually the certificate(s) of any additional intermediate CA used in
the chain …
5. Certificate of the root CA certificate
1.
2.
3.
4.
In the end, the content of this “new_webadmin_cert.pem” file should look like:
-----BEGIN RSA PRIVATE KEY----Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,E5DEDA743A5951FF
VMLbbaQvq8uN+vOI1fK0are3rLeUUtq3vRCrAwe3NVGWZgct9qxz+JprvGWh0Tzq
... (3.1.) Webadmin private key (some data omitted for readability) ...
aHHPNYfndNrPDWKn+1PGVufqxpr4mnumV1zHtKdLEfM9m/5nnlkk8w==
-----END RSA PRIVATE KEY---------BEGIN CERTIFICATE----MIIGUTCCBDmgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBpDELMAkGA1UEBhMCQkUx
... (3.2.) Webadmin certificate (some data omitted for readability)...
DaWjxvGL1bhYMddNOd2qWzsikdjSnspZ+XRPGrTAMCzyUSHv+g==
-----END CERTIFICATE---------BEGIN CERTIFICATE----MIIGYTCCBUmgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBozELMAkGA1UEBhMCQkUx
... (3.3.) .Subordinate CA certificate (signer of the webadmin certificate, some data omitted for readability)
6Eba3KVvWOIWyEfhxlUtMgyZ0mgwB0RGIQysu5gBqSqDk+6JmXEwvfg1b0kegOCJ
Qvs7sk4=
-----END CERTIFICATE----(3.4.) in case there are multiple subordinate CA’s, paste their certificates here in hierarchical order (low to high) just as
you would for the previous one (c.)
-----BEGIN CERTIFICATE----MIIFVTCCBD2gAwIBAgIJAN6KLPAP2iosMA0GCSqGSIb3DQEBBQUAMIGjMQswCQYD
... (3.5) ROOT CA certificate (some data omitted for readability)...
Jb/PZ8fG441qPXwnNxMIbEZ78+mvcl7JUnQXYLn0j012FKJHntk+rbeA2v1xd/OZ
gru+S0Xzx0s2VqwoDe8lt+rkmtMc8wwi8w==
-----END CERTIFICATE-----
Applies to: IDENTIKEY Authentication Server
KB 180009– 4/01/2016
2015 VASCO Data Security. All rights reserved.
Page 2 of 3
4. Convert this pem file to the .p12 format using openSSL.
Note, a version of openssl comes installed together with IAS, you can find it in
the installation\bin folder.
openssl pkcs12 -export -in new_webadmin_cert.pem -passin pass:Test1234 –out new_
_tomcat_cert.p12 -passout pass:Test1234 -name ias-tomcat
Where:
-passin pass:Test1234 => Replace Test1234 with the password protecting the private key in the
PEM file
-passout pass:Test1234 => Replace Test1234 with the password protecting the private key in the
p12 file
5. Create a new Java keystore file based on the p12 file you created.
Note that keytool comes delivered together with Java.
keytool -importkeystore -deststorepass Test1234 -destkeystore new_keystore.jks -srckeystore
new_tomcat_cert.p12 -srcstoretype PKCS12 -srcstorepass Test1234
The command above should result in: “Entry for alias ias-tomcat successfully
imported. Import command completed: 1 entries successfully imported, 0
entries failed or cancelled”
There is a caveat over here: ensure that the password used to protect the Java
keystore is the same as the password used to protec the private key (step 3).
6. Make the Tomcat use this new key store:
Update the connector in the Tomcat server.xml file.
On Windows, this file can typically be found on:
“C:\Program Files\VASCO\Tomcat 8.0\conf\server.xml”
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
scheme="https" secure="true" SSLEnabled="true" clientAuth="want"
sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
ciphers="<cipher_suite_1>,<cipher_suite_2>" keystoreFile="C:\Program
Files\VASCO\IDENTIKEY Authentication Server 3.8\bin\new_keystore.jks" keyAlias="iastomcat" keystorePass="Test1234" />
Note: update the keystorePass parameter to the appropriate password defined
in step 5.
7. Restart Tomcat
8. Ensure your browser(s) has the root CA in the list of Trusted Root CA’s.
Applies to: IDENTIKEY Authentication Server
KB 180009– 4/01/2016
2015 VASCO Data Security. All rights reserved.
Page 3 of 3
">
