How to resolve the "Not secure" warning on the browser to make your application secure.
You need to configure the SSL in your application to avoid the -
connection not secure - warning. Based on your application deployed in Weblogic or Tomcat,
below are high level steps to configure that:
Create a Java Keystore
in the application installed server
Generate CSR
Send the CSR to your CA (IT Team)
Get the signed
intermediate and root certs from CA
Import these certs to
keystore with same alias
Adjust Tomcat / WebLogic
settings
Steps for making the
connection secure in Tomcat.
Below two commands generate the
Keystore and CSR with Subject Alternative Names.
Once we receive the CA
signed Root certificate, Intermediate certificate and server certificateà need to import the certificates in the
keystore already created with same alias server for server
certificate.
We will learn how to generate the Subject Alternate Name (or
SAN) certificate in a simple way.
In this post, I plan on:
Explaining what is
the SAN certificate
Explaining how to
create the SAN certificate using the Java keytool
Explaining how to
export the certificate private and public keys using OpenSSL
Explaining how to
create the Certificate Signing Request (CSR) for the SAN certificate using
the Java keytool
Do not forget to follow me
on Twitter
What is
the SAN certificate?
The Subject Alternative Name (SAN) is an extension the X.509
specification. The specification allows to specify additional values for a SSL
certificate. These values added to a SSL certificate via the subjectAltName
field. A SSL certificate with SAN values usually called the SAN certificate.
Why to use the SAN
certificate?
RFC 2818 recommends
to use the SAN certificate instead of a regular SSL certificate :
Although the use of the Common Name is
existing practice, it is deprecated and Certification Authorities are
encouraged to use the dNSName instead.
What are the supported
values?
The full list of supported values listed in RFC 5280.
Recommended to configure the following values (where
applicable):
a DNS name
an IP address
an Internet mail
address
How to
create the SAN certificate?
The command below will create a pkcs12 Java keystore server.jks with
a self-signed SSL certificate:
The snippet below shows the partial output only with the Subject (Owner below)
and SubjectAltName (SubjectAlternativeName below)
fields:
...
Owner: CN=10.100.0.1
...
Extensions:
#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
IPAddress: 10.100.0.1
]
The certificate in a
browser
Configure your webserver to use the certificate and you will be
able to check the certificate in a browser.
The Subject field:
The SubjectAltName field:
Export the certificate private
and public keys
The Java keytool does not support export of a private key
therefore we will need to use OpenSSL. The command below export the private key
to the file serverkey.pem:
