Confluence with a wildcard certificate
Asked by Mark Kilfoil:

We are running Confluence 4.3.7 with SSL on debian.

We are having trouble importing our new wildcard certificate using the provided tutorial here:

<https://confluence.atlassian.com/display/DOC/Running+Confluence+Over+SSL+or+HTTPS>

Have also tried the tutorial directly from digicert:

<http://www.digicert.com/ssl-certificate-installation-tomcat.htm>

The csr was not generated on the confluence box

Using both tutorials ends with "keytool error: java.lang.Exception: Input not an X.509 certificate"


Answers:
author: Mark Kilfoil
body: That didn't solve the problem either but I decided to go back and read over the errors I have recieved over the last day working on this and with some help from online articles then problem was my keystore password was different then my certificate password. SO I deleted the keystore, remade it with my cert password and everything imported and is now working.

keytool -importkeystore -deststorepass 123456 **-destkeypass 123456** -destkeystore /root/.keystore **-destalias server** -srckeystore star.domain.com.pfx -srcstoretype PKCS12 -srcstorepass 123456


author: Mark Kilfoil
body: I can download multiple bundles for the certificates from digitcert I have tried importing a p7b bundle of all certs with a .cer extension unsuccessfully as well.


author: C. Faysal
body: hey charles...

how was the cert file created?

comments: author: Mark Kilfoil
body: the csr was generated using the OpenSSL CSR Tool on the digicert site.


author: C. Faysal
body: I see. Do you try to import the csr?Thats only the signing request file and not a certificate


author: Mark Kilfoil
body: keytool -importcerts -alias server -file star_domain_com.p7b -keystore \<keystore_name\>

"keytool error: java.lang.Exception: Input not an X.509 certificate"


author: Mark Kilfoil
body: sorry...didn't work.

Input not an X.509 certificate.


author: C. Faysal
body: ok.

please run this on your box

```
openssl pkcs7 -chain -print_certs -in star_domain_com.p7b -out star_domain_com.cer
```

afterwards try importing the cer file.

let me know how it goes

please note: i am not 100% if this will work for you...but i remember not facing any issues using .cer or .crt files...so lets try converting this. don't worry your .p7b still be there.


author: C. Faysal
body: ok i found another way...lets stick with the p7b

```bash plain
keytool -import -trustcacerts -alias server -file star_domain_com.p7b -keystore <keystore_name>

can you try thisone please?

ps: use comment
```


author: C. Faysal
body: maybe this solution will work for you

[http://www.lumension.com/kb/Home/Patch-and-Remediation/Importing-a-Certificate-results-in-Keytool-Error-(.aspx](http://www.lumension.com/kb/Home/Patch-and-Remediation/Importing-a-Certificate-results-in-Keytool-Error-%28.aspx)


author: Mark Kilfoil
body: keytool -importcert -alias server -file star_domain.com.cer -keystore \<keystore_name\>

Enter keystore password:\*\*\*\*\*\*\*\*

keytool error: java.lang.Exception: Input not an X.509 certificate


author: Mark Kilfoil
body: attempting that now, will update you soon.


author: C. Faysal
body: Ok. But now it is in a new keystore in root/. You must tell tomcat which one to use now cause by default it is inside your confluence_dir/jre/security/lib/cacerts if i remember it right


Tags: confluence-administration