How, having IIS pfx with L1K, creat CSR for L1M and have cert returned compatible with Tomcat?

Question

I have IIS server with pfx containing L1K cert. I need to request a new L1M cert for it, AND will need to also be able to import the returning cert to a java keystore as the URL in question will move from IIS to Apache Tomact.

Help!

Answer 1

I think I found the way to do this.

*credit to this site: https://www.jamf.com/jamf-nation/discussions/4646/converting-a-windows-pfx-or-windows-pkcs12-keystore-to-a-jks-keystore

• 1 - use keytool to import PFX into JKS

keytool -importkeystore -srckeystore .pfx -srcstoretype pkcs12 -destkeystore .jks -deststoretype JKS

• 2 - get details such as Alias from PFX file

keytool -v -list -storetype pkcs12 -keystore .pfx

• 3 - generate CSR file from new JKS file

keytool -certreq -alias -keystore .jks -file .csr -storepass

So far the resulting CSR files are validated successfully by my CA Authority's online tool.