TomCat SSL Cert Change

@sabrina.oconnor Are you trying to upload the .cer file in the upload step? If so, that will not work, you need to upload the .jks file that was created using the keytool utility in Java. The .jks file needs to be 'injected' with the .cer info, this process also uses the keytool utility. Do you know if you have the previous .jks file somewhere that was used for the Jamf server? If so, try to upload that file.

Keytool (on Windows server): C:Program FilesJavajrex.x.xin

Process for net new cert:
1. Create .jks with keytool.
2. Create CSR with the .jks file, also using keytool.
3. Request SSL cert with above CSR.
4. Once you have the .cer file it has to be injected into the .jks file using keytool (also any trusted CA's).
5. The .jks file is then uploaded into the jamf console.

Hey @MTurnerFMRCO

I've been using a pfx file, trying to manually upload on JSS (Tomcat). I know on the server (mac mini), if I follow the file path: JSS -> Tomcat....

There is quite a bit of files under there. One says "TomcatSSLKeystore" the other is "license" both just show as text documents. It looks like that was originally created in 2014.

I found this article earlier: https://www.jamf.com/jamf-nation/articles/115/enabling-ssl-on-tomcat-with-a-public-certificate

Minus the part about the keytool, it seems pretty straight forward. I'm guessing it would replace what is in the above folder (Tomcat).

Might be worth checking your Java config? On our JSS that is hosted on Windows, I had to run the tomcat8w.exe util and make sure that Java settings were pointing at the jdk1.8 java virtual machine. It was set at 1.7 and wouldn't accept our password when trying to upload a signed certificate.

@sabrina.oconnor

Have you gone to your SSL vendor's site and looked through their KBs for Tomcat installation instructions?

Each vendor's instructions for installing their certificate with Tomcat are usually slightly different, which is why our KB https://www.jamf.com/jamf-nation/articles/115/enabling-ssl-on-tomcat-with-a-public-certificate is pretty vague in terms of its instructions.

Your SSL certificate's vendor should have detailed instructions on how to get their cert working with Tomcat, so I'd definitely look there if you haven't already.

Were Wulff
Jamf Support

Here is where I'm stuck at now. @MTurnerFMRCO / @were.wulff / @allanp81

I got the .cem back from the CA (after giving them the .csr). We use AlphaSSL as a company. I had to inject the root & intermediate certificate into the .jks file (it was not happy with just the root). Then took that and combined it with the .cem from the CA. All commands from terminal said it worked for each step and was happy.

I then take that .jks file and try to upload it to Tomcat on the JSS URL. I choose HTTPS -> 3rd party -> upload file -> enter password -> it then says to choose the type of certificate, "Tomcat" "intermediate" or "root"

None of the above options work, I always get the following error:

I've edited the server.xml file for Tomcat on the server to match the instructions from the above link. https://www.jamf.com/jamf-nation/articles/115/enabling-ssl-on-tomcat-with-a-public-certificate

I'm not sure why it will not accept the .jks file on the webportal. I'm at a loss.

Any ideas/experience with this?

@sabrina.oconnor

I'd suggest using AlphaSSL's instructions for getting Tomcat to use their certificate and seeing if that helps, if the webapp is not accepting either a .jks or a .keystore file on the "Upload Keystore" step.

AlphaSSL's instructions can be found here: https://www.alphassl.com/support/install-ssl/tomcat.html

Were Wulff
Jamf Support

@were.wulff

I've tried uploading the root and intermediate cer file to the .jks. Said it was successful. Took that .jks file and tried JSS no go. Then tried a file where I combined the root and intermediate, same thing, didn't work

I was following the instructions: https://www.alphassl.com/support/install-root/tomcat.html

On the one you provided, the first two steps do not match. Root shows being injected into the .jks, however the second step is not intermediate. It is not happy without the intermediate file. Also the last step for the server.xml, I've tried comparing what the document has to what is in the file, no where in it is anything remotely similar (looked for Connector Classname, factory classname etc) since it does not exist, not sure if I need to manually enter it or not.

:sigh: I'm so over this whole process.

@s.oconnor got a link to "Simple SSL"? Searches come up with nothing.

update: jamf support sent it to me. great tool.

@JAMF Support, Could i get that tool also? thanks

@JAMF support, could you send me this tool as well?

Thanks.

What version is the tool up to now? I got it back in 2016

Any Chance I can get a copy as since we have uploaded out SSl Cert doing terminal all macs are reporting The Jamf binary could not connect to the JSS because the web certificate is not trusted.

And even deleting certs and re-adding via trustJSS does not work, or recon or re-enrol. We have even tried removemdmprofile and re-adding still the same issue.

help

can anyone please send me a link to Simple SSL

Could use some help as well. After successfully adding a GD cert in the Apache Tomcat settings we're getting: "The jamf binary could not connect to the JSS because the web certificate is not trusted."

Not sure what I'm missing.

Ditto, can anyone please send me a link to Simple SSL?

Wave... me too?

@JAMF could have use for the tool myself :) thanks!

@JAMF Support - may I please have the "Simple SSL" tool also? Thanks! :)

add me to the list of folks who'd like that simple ssl tool as well =)

Hi @allanp81, just wanted to say thanks 6 years on from your comment above. I ran into this exact problem with our Windows Jamf Pro server this week. Ended up updating to latest Amazon Corretto Java version and pointed Tomcat to use that version and boom, Jamf Pro let me change the cert.

Nice one!

I have problem just like you. How did you fix that issue?