Skip to content

Tomcat

 

How to generate a CSR in Tomcat with Keytool

**NOTE**: You must generate a new keystore by following this process. If you try to install a new certificate to an old keystore your certificate will not work properly.
Backup and remove any old keystores if necessary before beginning this process.

Of course if you prefer to build your own shell commands to generate your Tomcat CSR, just follow our old instructions below:
 

Create a New Keystore

  1. You will be using the keytool command to create and manage your new Keystore file. You may need to add the java /bin/ directory to your PATH before the keytool command is recognized. When you are ready to create your keystore go to the directory where you plan to manage your Keystore and certificates.

    Enter the following command:

    keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore your_site_name.jks

    Note: Replace "your_site_name" with the primary domain you will be securing with the certificate. If you are generating the CSR for a wildcard, enter the domain name with an asterisk (*.yourdomain.com).

  2. You will be prompted to choose a password for your keystore.
    You will then be prompted to enter your Organization information.

    Note: When prompted to enter your First and Last Name, input your “domain name” instead of your personal name.

  3. After you have completed the required information confirm that the information is correct by entering 'y' or 'yes' when prompted. Next you will be asked for your password to confirm. Make sure to remember the password you choose.

    Your keystore file named your_site_name.jks is now created in your current working directory.

          Generate a CSR from Your New Keystore

Next, you will use keytool to create the Certificate Signing Request (CSR) from your Keystore. Enter the following command:

keytool -certreq -alias server -file csr.txt -keystore your_site_name.jks

Type the keystore password that you chose earlier and hit Enter.

Your CSR file named csr.txt is now created in your current directory. Open the CSR with a text editor, and copy and paste the text (including the BEGIN and END tags) into the Sectigo web order form.

**Be careful to save the keystore file (your_site_name.jks) as your certificates will be installed to it later**

From the newly created keystore, generate your CSR by running the following keytool command:

keytool -certreq -alias server -file csr.txt -keystore your_domain_name.jks

Enter your keystore password and press Enter.

Your CSR has been created in the current directory.

Locate and open the newly created CSR in a text editor such as Notepad and copy all the text including:

-----BEGIN CERTIFICATE REQUEST-----
And
-----END CERTIFICATE REQUEST-----

Return to the Generation Form on our website and paste the entire CSR into the blank text box and continue with completing the generation process.