Setting up as a Certificate Authority
keytool -genkeypair -dname "cn=vinay-ca-root, ou=vinay-ca, o=local, c=SG" -alias root -keypass password -keystore root.jks -storepass password -validity 10000 -keyalg RSA -ext bc:c
keytool -keystore root.jks -alias root -exportcert -rfc --validity 10000 > vinay-ca-root.pem
Generating intermediate key
keytool -genkeypair -dname "cn=vinay-ca-intermediate, ou=vinay-ca, o=local, c=SG" -alias intermediate -keypass password -keystore intermediate.jks -storepass password -validity 10000 -keyalg RSA -ext bc:c
keytool -storepass password -keystore intermediate.jks -certreq -alias intermediate --validity 10000 | keytool -storepass password -keystore root.jks -gencert -alias root -ext BC=0 -rfc --validity 10000 > intermediate.pem
Generating Server SSL certificate
Generating server keystore
keytool -genkeypair -keystore server.jks -alias server -dname "cn=localhost, ou=application, o=local, c=SG" -keypass password -storepass password -validity 365 -keyalg RSA
Signing the server cert by CA keys
cat vinay-ca-root.pem vinay-ca-intermediate.pem > vinay-ca-chain.pem
keytool -storepass password -keystore server.jks -certreq -alias server --validity 365 | keytool -storepass password -keystore intermediate.jks -gencert -alias intermediate -ext ku:c=dig,keyEncipherment -ext SAN=dns:localhost -rfc --validity 365 > server.pem
cat vinay-ca-root.pem vinay-ca-intermediate.pem server.pem > serverchain.pem
keytool -keystore server.jks -importcert -alias server -file serverchain.pem
Generating truststore for mTLS
Generating client keystore
keytool -genkeypair -keystore client.jks -alias client -dname "cn=localhost, ou=application, o=local, c=SG" -keypass password -storepass password -validity 365 -keyalg RSA
Signing the client cert by CA keys (client jks to be used by client like postman/curl command)
cat vinay-ca-root.pem vinay-ca-intermediate.pem > vinay-ca-chain.pem
keytool -storepass password -keystore client.jks -certreq -alias client --validity 365 | keytool -storepass password -keystore intermediate.jks -gencert -alias intermediate -ext ku:c=dig,keyEncipherment -ext SAN=dns:localhost -rfc --validity 365 > client.pem
cat vinay-ca-root.pem vinay-ca-intermediate.pem client.pem > clientchain.pem
keytool -keystore client.jks -importcert -alias client -file clientchain.pem
Generate truststore and import client cert
keytool -import -trustcacerts -keystore truststore.jks -alias client -file client.pem
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent