The keystore must contain a key pair with a certificate signed by a trusted Certification Authority (CA).
How to create a keystore?
We will be using the JDK 'keytool', which is a key and certificate management utility. It allows users to administer their own public/private key pairs and associated certificates for use in self-authentication (user authenticates himself/herself to the service).
To generate the keystore, open a command line and enter the following to generate a key pair and certificate directly into it:
This command will prompt for information about the certificate and for passwords to protect both the keystore and the keys within it. The only mandatory response is to provide the fully qualified host name of the server at the "first and last name" prompt.
Certificate information, for example:
A keystore file is generated with the content encrypted.
To view the certificate explicitly, 'keytool' has a command to export the certificate from the keystore. We can do so with the following command:
This certificate is enough to run SSL. However, this certificate we generated will not be trusted by the browser unless we request a well known Certificate Authority (CA) to sign our key/certificate. Among them are: AddTrust, Entrust, GeoTrust, RSA Data Security, Thawte, ,VISA, ValiCert, Verisign and beTRUSTed.