Creating a Keystore File for Use in Smart Client HTTPS Connections

A Java KeyStore (JKS) is a repository of security certificates, either authorization certificates or public key certificates plus corresponding private keys. They can be used in SSL encryption and for https connections with a Smart Client.

The following procedure describes how to create keystore certificates to manage https connections for a Smart Client.

Prerequisites

You should install the Java Development Kit (JDK). It contains the utility keytool required for the generation of the keys for use in HTTPS connection. JDK can be downloaded from https://www.oracle.com/technetwork/java/javase/downloads/index.html. It is recommended, though not essential, to download the same version that Capital uses.

Procedure

1. Generate a .keystore file using the keytool command, as shown in the following example:

keytool -genkey -keyalg RSA -keysize 2048 -validity 365 -keystore keystore -alias selfsigned

When you run the command you are prompted to choose a keystore password and details related to the certificate.

Note: Remember this password because you will need it later while importing a Certification Authority (CA) certificate.

After you have entered the details, a keystore file is generated. It contains a self-signed certificate.

Note: You can use this keystore, as it is, for the https communication but web browsers will not recognize it and errors may be reported for the pages. However, the browsers will allow you to proceed to web pages with a security caution.

Steps 3 to 5 below are required only if you decide to have the certificate signed by a Certification Authority (CA).

2. View the details of the self-signed certificate by running the command:

keytool -list -v -keystore keystore

You can see various details of the certificate, for example issuer, owner, validity, and so on.

3. Generate a certificate signing request (CSR) from the .keystore file. Use the same alias name and the password that you used to generate the keystore file.

This creates a certificate .csr file in the current working directory for the .keystore file.

4. The .csr file must be sent to a Certification Authority (CA) who can generate a certificate (for example: https://www.geocerts.com/).

5. Once the certificate is received from a Certification Authority, you must import the certificate into the .keystore file using the following command. Use the same alias name and password again.

keytool -import -trustcacerts -alias selfsigned -keystore keystore -file capital.crt

Parent Topic: Viewing HTML, Capital Explorer and Change Illustrator Service Documentation

Related Topics: Using or Replacing the Self-signed Certificate in an Existing Smart Client Package