Edu-IT Posted February 13, 2015 Posted February 13, 2015 Comodo have sent me a chunk of code they say is PEM, and a chunk of code they say is PKCS7. How on earth do I get a .p12 or a .pfx file out of these two things? Majorly confused and Google'ing just confuses me more so I am hoping somebody can explain in plain english?
kmount Posted February 13, 2015 Posted February 13, 2015 (edited) Hi, The PKCS7 will likely be the chain or the cert + chain but won't include the key. The PEM could be anything, hard to tell without knowing whether it's got lots of begin and ends or whatnot. You need the cert, chain and key to make your pfx/.p12. Presumably you have the key from when you made your CSR to send to Comodo yeah? You may find it easier to use a tool like - https://www.sslshopper.com/ssl-converter.html (also a good explanation of the various names/types here) This will take various bits and convert it into something you want. (it makes pfx's pretty well in my experience). Edited February 13, 2015 by kmount
Edu-IT Posted February 13, 2015 Author Posted February 13, 2015 I just keep getting: [h=4]There was a problem converting that certificate. It may be corrupt or it may be in a different format than the one you selected. You can try using a different format or running the OpenSSL commands on your own machine. The private key also may not match the certificate that you uploaded. Go back[/h]
Edu-IT Posted February 13, 2015 Author Posted February 13, 2015 The PEM could be anything, hard to tell without knowing whether it's got lots of begin and ends or whatnot. Edit: Actually, no, it only has one start/end.
kmount Posted February 13, 2015 Posted February 13, 2015 OK, lets gather some info first.. 1) Did you create a CSR? (if so, whatever machine you made it on has your private key which you're going to need to do anything useful!) 2) If you did NOT create a CSR and Comodo provided it all for you they will provide you with a key too. Once we know where the key is, that PKCS7 will become useful. The PEM file if it only has one start/end just sounds like your actual cert e.g. kmount.com ... so that plus your PKCS7 (the chain presumably!) and your key will create the pfx.
Edu-IT Posted February 13, 2015 Author Posted February 13, 2015 Yes I did create a CSR. I did it through the software though, as opposed to Windows. SSL/HTTPS Key Generation Under section using a custom signed SSL key. I have something called my-ssl-keystore and jetty.csr
kmount Posted February 13, 2015 Posted February 13, 2015 (edited) OK cool, so you have a java keystore and the CSR. I've not used Papercut so you'll have to bear with me. The PEM you have, does it have BEGIN CERTIFICATE / END CERTIFICATE or something else? If it is just BEGIN / END CERTIFICATE it should just be a case of calling it jetty.crt keytool -keystore [app-path]\server\custom\my-ssl-keystore -import -alias jetty -file jetty.crt -trustcacerts (we might need to convert the pkcs7 into individual intermediate certs if papercut doesn't have them but lets come back to that later) Hopefully the above keytool command will complete and your my-ssl-keystore will be ready to progress to - http://www.papercut.com/products/ng/manual/apdx-ssl-key-generation.html#apdx-ssl-import-keystore Edited February 13, 2015 by kmount
Edu-IT Posted February 13, 2015 Author Posted February 13, 2015 (edited) The PEM has a beginning and an end as you describe. So if I just whack that code into notepad and save it as jetty.crt, and see how it goes? Edited February 13, 2015 by Edu-IT
kmount Posted February 13, 2015 Posted February 13, 2015 Yep, though just for comfort, before you paste it into notepad paste it into https://www.sslshopper.com/certificate-decoder.html and make sure it says the server name you bought the SSL for etc. (Don't be disheartened if it all appears to work etc but you still get a browser warning, it might need the intermediates pulled in but we'll cross that bridge later)
kmount Posted February 13, 2015 Posted February 13, 2015 G'night, I'm checking out now. Hope you get it working. If not I'll be back in the morning and we can kick it some more.
Edu-IT Posted February 13, 2015 Author Posted February 13, 2015 Right, sorry for delay, took me some time to transfer the files to the right place. Anyway, I've got the certificate in place now but I do need to get the CA root there. I have this 'code' but what file type do I save it as? It has a single begin and end. I also have an intermediate bundle which has multiple beginning and ends.
kmount Posted February 14, 2015 Posted February 14, 2015 You woud save just the PEM one (single begin certificate / end certificate) as jetty.crt and run through the keytool command. Once you've done that and copied the keystore into place it might just work. (if the intermediates/root is in place within papercut) - If you find that the ssl cert is in then but you still get warnings then you may need the intermediate/root which can be done after converting the pkcs7 to individual certs.
Edu-IT Posted February 14, 2015 Author Posted February 14, 2015 Seems it hasn't worked. The issuer of the SSL is myself, and the validity is only 3 months. Even though the .crt file decodes as being all right. So it's either not importing the right certificate or it's just being awkward.
kmount Posted February 14, 2015 Posted February 14, 2015 Yes, sounds like it's not loading the correct one if it's showing the wrong issuer. Did you do this bit? -- Your new keystore file my-ssl-keystore is now ready and should be moved to the location [app-path]/server/custom.
kmount Posted February 14, 2015 Posted February 14, 2015 Oh, and this bit ... SSL/HTTPS Key Generation 1
Edu-IT Posted February 14, 2015 Author Posted February 14, 2015 Yes I did all that. Ran through importing the jetty.crt again and seems to have worked this time. Hurrah! Maybe I had tired eyes last night and was doing something stupid, or, maybe it just realised how angry I was getting and decided to work. Anyhow, I really appreciate your help @kmount.
Edu-IT Posted February 16, 2015 Author Posted February 16, 2015 (edited) Now... any advice on how to get this into IIS7 Edit: Sorted! :-) Edited February 16, 2015 by Edu-IT
plexer Posted February 16, 2015 Posted February 16, 2015 Now... any advice on how to get this into IIS7 Edit: Sorted! :-) Please share in order the assist others. Ben
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now