Creating a Self Signed Certificate

Caution - the certificates generated here are not suitable for Production use

Browsers may object to connecting to a site secured by a self signed certificate, and you'll need to follow the instructions to add the site as an exception

Intro

I needed to create a SSL certificate for testing a Groovy script against Jira's REST API via a secured connection. It was not a straightforward as I thought it should be and I have documented the steps (an a bit of my method) as an aid memoire

Most of the steps are taken from an IBM Knowledge Base article as these mostly worked and just needed a final tweak to work with JIRA (or other Tomcat based applications

These instructions create a PKSC12 certificate

1. Create a .certs hidden directory in the application user's home directory

2. Check the ownership of .rnd - if its owned by a user other than the application user then execute sudo chown $USER:$USER ~/.rnd. On the Vagrant image of Ubuntu 16.04, the ownership of the .rnd directory was incorrectly set to root, and the openssl certificate generation failed with unable to write 'random state' error

3. Note the IP address or full qualified domain name (FQDN) for the server. eg 192.168.30.10 or myserver.mycompany.com. This will be the "Common Name" needed in the next step

4. Generate the key openssl req -newkey rsa:2048 -nodes -keyout jirakey.pem -x509 -days 3650 -out jiracert.pem (This example create a certificate with a 10 year validity). Answer the questions and enter the Common Name from before.

5. Check the certificate openssl x509 -text -noout -in jiracert.pem

6. Combine the Key and Certificate files into a PKCS#12 bundle: openssl pkcs12 -inkey jirakey.pem -in jiracert.pem -export -out jiracert.p12 -name jira

Enter (and record) the password requested Note the -name jira. This is the keyAlias that is set in Tomcat server.xml along with the password so that it can find and read the certificate

Example Tomcat Connector configuration

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxHttpHeaderSize="8192" 
               SSLEnabled="true"
               maxThreads="150" 
               minSpareThreads="25"
               enableLookups="false" 
               disableUploadTimeout="true"
               acceptCount="100" 
               scheme="https" secure="true"
               sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2,TLSv1.3"
               clientAuth="false" 
               useBodyEncodingForURI="true"
               keyAlias="jira" 
               keystoreFile="/home/ubuntu/.certs/jiracert.p12" 
               keystorePass="xxxxx" 
               keystoreType="pkcs12"/>