Jar signing

[Marco R.]

Hi all,

I've always used a keystore with a self-signed certificate.
Now I've bought a certificate from a CA.

The CA had sent me 3 certificates, I suppose that 1 is my own certificate, 1 is the authority, and 1 is an intermediate certificate.
Watching on your wiki page, I've found this phrase:

The signed certificate (+ any required intermediate certificate) received from the SSL supplier need to be imported into the keystore.
The signed .crt file can be imported into the keystore using the following command:

Code: Select all

keytool -import -alias MyPlugins -keystore mykeystore.ks -trustcacerts -file mykeystore.crt

Now my questions are:

1 - Is there a specific order in wich I have to import these certificates into my keystore? Because I've imported just one certificate.
2 - The keystore was created AFTER the certificate request from CA (this because initially the Certificates would be used to sign our website), this could be a problem (I'm thinking about the CSR)?

I'm making these questions because I've tried to import our website-certificate into the keystore sucefully, but once I've used the signed jar under the application server, I've received a warning for not trusted certificate (I suspect for the point 1 because I've imported just one certificate).

Sorry but I'm new in this argument

Thanks in advance

Marco Rossi

[IT2Be]

Hi Marco,

Are you using a code signing certificate for Java jars?

I ask because you are talking bout the certificate for your website...

[Marco R.]

That's it. I've made confusion between this two kind of certificate.
Thanks Marcel, I'll buy a "signing certificate".

Just to don't buy others useless certificates:
Is that the kind of certificate I need:
http://www.instantssl.com/code-signing/ ... 3goduEwAFA ?

Would anyone suggest me other cheapest vendor?


Thanks


Marco

[IT2Be]

Hmm, I don't know. When I bought it GlobalSign was the cheapest but not anymore I believe.

Please make sure that their documentation is ok, it is a troublesome process in any case but without good documentation even worse.