Java Keytool CSR Wizard
The fastest way to create your CSR for Tomcat (or any platform using Keytool).
Fill in the details, click Generate, then paste your customized Keytool CSR command into your terminal.
Note: After 2015, certificates for internal names will no longer be trusted.
|
Common Name (Server Name)
The fully qualified domain name that clients will use to reach your server. To secure https://www.example.com, your common name must be www.example.com or *.example.com for a wildcard certificate. Less commonly, you may also enter the public IP address of your server.
Department (optional)*
This information is not required. You can leave this field blank. For private TLS/SSL certificates, this is the department within your organization that you want to appear in the certificate. It will be listed in the certificate's subject as Organizational Unit, or "ou." *Note: Industry regulations no longer allow Certificate Authorities (CAs) to include the department (organization unit) in public TLS/SSL certificates. See our knowledge base article: DigiCert will deprecate the Organizational Unit field.
City
The city where your organization is legally located.
State or Province
The state or province where your organization is legally located.
Country
We guessed your country based on your IP address, but if we guessed wrong, please choose the correct country. If your country does not appear in this list, there is a chance we cannot issue certificates to organizations in your country.
Organization name
The exact legal name of your organization. Example: "DigiCert, Inc." Less commonly, if you do not have a legal registered organization name, you should enter your own full name here.
Key Size
Key sizes smaller than 2048 are considered insecure.
Now just copy and paste this command into a terminal session on your server. Your CSR will be written to ###FILE###.csr.
|
For other OS/Platform instructions, see SSL Certificate Installation Instructions & Tutorials.
After you create a Certificate Signing Request (CSR) and order your certificate, you still need to install it.
See Tomcat Web Server SSL Certificate Installation or SSL Certificate Installation :: Java Web Servers.
You can run this command wherever you have the keytool command available—most likely on your server, but you can also run it on your own computer if you have Java installed. Just make sure you keep track of your keystore file after you create your CSR, because you'll need that file because it will contain your private key, and it will be required to install your certificate.
The keytool program has to exist in your PATH. You can find out if it is by typing 'keytool' into your terminal session and seeing if you get a 'command not found' error. If keytool is not in your PATH environment variable, you can either add your JDK's bin directory to the PATH, or adjust the two keytool commands in the customized CSR command you generated above. What happens when I run this command?You will be asked to choose a keystore password to protect your new keystore file. Then press RETURN to use the same password for the certificate's private key. Then you will be asked to type the keystore password once more to create the CSR file.
The Java keytool utility creates both your private key and your certificate signing request, and saves them to two files: your_common_name.jks, and your_common_name.csr. You can then copy the contents of the CSR file and paste it into the CSR text box in our order form.
What if I need Subject Alternative Names?
Multi-Domain (SAN) Certificates allow you to assign multiple host names—known as Subject Alternative Names or SANs—in one certificate.
Use your primary server name as the Common Name for your CSR, then place an order for a Multi-Domain Certificate and specify the other names during the order process. Our Multi-Domain Certificate ordering process will let you specify all the names you need without making you include them in the CSR.
Related:
