Finish import-certificate.jsp page

Description

We need to finish import-certificate.jsp and make it official. Pending tasks are:
1) Let admins paste the certificate chain. This could be done in the same textarea where the signed certificate is pasted or in a new textarea.
2) Let admins import root certificates to the truststore. We need to support this so that root certificates in the chain can be trusted.

Environment

None

Activity

Show:

Erik Dykema April 24, 2009 at 5:31 AM

Hi-
As of 4/23/09 , this still isn't quite working yet. Per the description: "1) Let admins paste the certificate chain" , I'm not able to import a certificate / chain.
I did the following:

1) Create a private key & CSR using OpenSSL (PEM format)
2) Had my CSR signed by the CA (GoDaddy)
3) Installed the key & cert into my webserver (apache2, same machine), to make sure the key & cert work.
4) Attempted to copy & paste the PEM key & PEM cert into openfire (Failed b/c of chain).

Then, I tried to do the following:
5) Use keytool to import the intermediate GoDaddy certs into the /etc/openfire/security/truststore (OK)
6) Add the certs via the admin interface (fail)

Then, I tried to do the following:
7) Use a 3rd party java program called ImportKey to create a "keystore" containing the key & certificate (OK)
8) Gave it the same default password (changeit)
9) Restarted Openfire.
10) Error messages via the admin web interface. Tried to connect anyway, no dice.

I realize this is a bug with the import-certificate page, and not really a bug on the finish-import-certificate page task, but I couldn't figure out how to create new tasks with this bug tracker.

Nick Barkas April 18, 2007 at 8:26 AM

Thanks Gaston. The certificate was created with OpenSSL, but I'll try out Keyman and see if it can help me out.

Gaston Dombiak April 11, 2007 at 1:15 AM

Hey Nick, you can certainly do that using command tools or Java truststore keytools like Keyman (http://www.alphaworks.ibm.com/tech/keyman). If certs were created with openssl then things could get a bit tricky but it is still possible to import cert chains.

Nick Barkas April 10, 2007 at 12:42 PM

Is there currently any way to import chained certificates into Openfire? I see that it isn't possible with import-certificate.jsp yet, but I'm wondering if I can do it with a keytool or something. I have a chained certificate I'd like to use now, if possible.

Fixed

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Priority

Created February 21, 2007 at 6:33 AM
Updated April 24, 2009 at 5:31 AM
Resolved November 30, 2007 at 7:45 AM

Flag notifications