Using StartSSL Class 1 Certificates with Glassfish

StartSSL provides a service that allows frugal site owners to get an HTTPS server with a proper certificate for free. This post documents the steps of setting up Glassfish to work with the certificate.

Before going on, perform a domain name validation in StartSSL.

Once the domain is validated, load up the StartCom Root CA and Class 1 Intermediate Server CA certificates into the key store used by the Glassfish domain as the default Java key stores do not trust StartCom certificates unlike most browsers including Internet Explore, Safari, Chrome and Firefox. The certificates are stored in the config/keystore.jks file of the domain where the default password is changeit. The following commands will do the changes:

cd glassfish/domains/domain1/config
curl http://www.startssl.com/certs/ca.crt > /tmp/ca.crt
curl http://www.startssl.com/certs/sub.class1.server.ca.crt > /tmp/sub.class1.server.ca.crt
keytool -importcert -keystore keystore.jks -storepass changeit \
        -file /tmp/ca.crt -alias startcom.ca -trustcacerts
keytool -importcert -keystore keystore.jks -storepass changeit \
        -file /tmp/sub.class1.server.ca.crt -alias startcom.ca.sub -trustcacerts

The keystore.jks file that gets generated when you first create the domain will contain a private key that is configured with the SSL port that comes with Glassfish called s1as. For this post the same key is just used and the result of the following command is sent as the CSR to StartSSL Certificate Wizard.

keytool -certreq -keystore keystore.jks -storepass changeit -alias s1as

After a few minutes (up to three hours according to the site), the certificate will be available to copy and paste from StartSSL Toolbox. Copy and paste the certificate to a temporary file (e.g. /tmp/www.trajano.net.crt), then import it with the following command:

keytool -importcert -keystore keystore.jks -storepass changeit \
        -file /tmp/www.trajano.net.crt -alias s1as

Then restart Glassfish. Now when accessing the SSL port of Glassfish which is normally :8181 with the host name it should validate successfully.