When working with SSL-enabled web servers it is often useful to create self-signed certificates for testing and development. This is much quicker and more convenient than going through an external CA when all you need to do is run some tests on your development machine. Unfortunately Web Server 6.1 (formally, Sun Java System Web Server 6.1 (which you may also have met under the SunONE or the older iPlanet brand names)) does not support creating self-signed certificates through the admin UI. On the bright side, it is actually quite easy to create these certificates using the NSS tool certutil.
First: Create the NSS databases
You can do this through certutil, but let’s do it through the supported admin UI interface. “Servers” -> “Manage Servers” -> select server, click ‘Manage’. Then click “Security” tab. Enter password twice into the fields and submit. Popup says “Success”! -> Click OK.
Second: Create a local CA
Despite the title of this entry, instead of directly creating a self-signed cert, I’ll first create a local CA for myself and then use it to sign the server cert, so I can demonstrate both possibilities. If you prefer, skip the hierarchy and generate a self-signed server cert directly.
Go to the alias directory under the install root. That is where the NSS database files live in 6.1. At this point you should have at least the files shown below in the alias directory.
Note that boqueron.virkki.com here is the host and domain name, your files will have names corresponding to your installation. For all subsequent commands in this example, substitute the corresponding names for your instance in place of these.
$BASE/alias% ls -1 https-boqueron.virkki.com-boqueron-cert8.db https-boqueron.virkki.com-boqueron-key3.db secmod.db
You can use certutil -L to list all the certs in the database. If you just created the database through the UI like I did, it’ll be empty:
$BASE/alias% certutil -L -d . -P "https-boqueron.virkki.com-boqueron-" certutil -L -d . -P "https-boqueron.virkki.com-boqueron-"
Now, I will create a sample CA with certutil (note this is a single command line, which I’ve split here only for readability). I have ommitted some of the output for brevity:
$BASE/alias% certutil -S -P "https-boqueron.virkki.com-boqueron-"
-d . -n SelfCA -s "CN=Self CA,OU=virkki.com,C=US" -x -t "CT,CT,CT"
-m 101 -v 99 -5
Generating key. This may take a few moments...
0 - SSL Client
1 - SSL Server
2 - S/MIME
3 - Object Signing
4 - Reserved for futuer use
5 - SSL CA
6 - S/MIME CA
7 - Object Signing CA
Other to finish
Enter 5 since we want a CA.
0 - SSL Client
1 - SSL Server
2 - S/MIME
3 - Object Signing
4 - Reserved for futuer use
5 - SSL CA
6 - S/MIME CA
7 - Object Signing CA
Other to finish
Enter 9 to end.
Is this a critical extension [y/n]?
Enter y.
Third: Use this local CA to sign your server cert
$BASE/alias% certutil -S -P "https-boqueron.virkki.com-boqueron-"
-d . -n MyServerCert -s "CN=boqueron.virkki.com,C=US" -c SelfCA -t "u,u,u"
-m 102 -v 99 -5
Generating key. This may take a few moments...
0 - SSL Client
1 - SSL Server
2 - S/MIME
3 - Object Signing
4 - Reserved for futuer use
5 - SSL CA
6 - S/MIME CA
7 - Object Signing CA
Other to finish
Enter 1
0 - SSL Client
1 - SSL Server
2 - S/MIME
3 - Object Signing
4 - Reserved for futuer use
5 - SSL CA
6 - S/MIME CA
7 - Object Signing CA
Other to finish
Enter 9 to end.
Is this a critical extension [y/n]?
Enter y.
Try certutil -L again, this time you’ll see both your CA and your server cert:
$BASE/alias% certutil -L -d . -P "https-boqueron.virkki.com-boqueron-" certutil -L -d . -P "https-boqueron.virkki.com-boqueron-" MyServerCert u,u,u SelfCA CTu,Cu,Cu
Also try looking at them from the admin UI. Under “Security” ->”Manage Certificates”, you will see these newly created certificates listed.
That’s it! You can now assign the MyServerCert to any of your SSL-enabled listeners.
For example, if you want to change one of your non-SSL listeners to enable SSL and use the new certificate, you can follow this sequence in the admin UI: “Preferences” -> “Edit Listen Socket” -> click on an ls ID to edit. Then check the security box and click OK. Once again, “Edit Listen Socket” -> click on the same ls. This time you see SSL options, change any if desired and then click OK. Finally Apply to apply the changes.
I used quite a few options to certutil which I didn’t describe in any detail to keep this brief. Run certutil -H to read the description of every option I used (and the ones I didn’t) so you can tailor the options to your needs.