Renewing a CA-Signed Certificate in a Keystore¶

A digital certificate has a validity period, after which the certificate expires. Once a certificate expires, it is no longer valid, and it can cause the client-server communication to fail at the SSL handshake level. Therefore, it is important to plan certificate renewal ahead of time. Neglecting certificate renewal can eventually lead to a catastrophic situation such as major service outage.

Important

Use the same certificate authority that you used when you first got the public certificate. If you use a different certificate authority for certificate renewal, you will have to import the new CA-certificate as well as the intermediate certificates to the keystore and the client’s trust store.
If the certificate authority’s certificate is not in the keystore, you will get the following error when you try to import the CA-signed certificate to the keystore:

keytool error: java.lang.Exception: Failed to establish chain from reply

To overcome the above error, be sure to first import the CA-signed certificate as well as the intermediate certificates to the keystore in the correct order.

Now let's take a look at each high level step in detail .

Step 1: Check the validity period of the certificate¶

Follow one of the steps below to view the validity period of a certificate:

If you have a public hostname, go to https://www.sslshopper.com/ssl-checker.html and specify the hostname of your server. SSL hopper lists all the information about the server certificate.
If you have a java keystore, execute the following keytool command to view the certificate information:
```
keytool -list -keystore <keystore_name.jks> -alias <cert_alias> -v
```
This prompts for the keystore password. Once you specify the password, you can view the certificate information in a human readable format where the validity period is displayed as follows:
```
Valid from: Sun Jun 18 19:26:25 IST 2017 until: Sat Jun 19 19:26:25 IST 2027
```

If you have the certificate file, execute the following openssl command:

openssl x509 -in <certname.cer> -text -noout

This displays the validity as follows:

Validity
    Not Before: Jun 18 13:56:25 2017 GMT
    Not After : Jun 19 13:56:25 2027 GMT

If it is a website, you can view the certificate information via the browser. All major browsers provide the capability to view certificate information.

Once you view the validity period of a certificate and if it says that the certificate is about to expire or has already expired, the next step you should generate a Certificate Signing Request (CSR) and get a new certificate generated from the CA.

Step 2: Generate a certificate signing request¶

Depending on the type of keystore you have, follow one of the steps below to generate a CSR:

If you have a java keystore, execute the following command:
```
keytool -certreq -alias <cert_alias> -file <CSR.csr> -keystore <keystore_name.jks>
```
Note

If you want generate a CSR with a subject alternative name (SAN), be sure to use the -ext attribute in the keytool command to specify required SAN.

Following is a sample keytool command that includes a SAN:
```
keytool -certreq -alias test -file test.csr -keystore test.jks -ext SAN=dns:test.example.com
```

If you have the private key and public key, execute the following command:

openssl x509 -x509toreq -in <cert_name.crt> -out <CSR.csr> -signkey <private_key.key>

Once you generate the CSR, you need to submit the CSR to your certificate authority to get a new CA-signed certificate. For testing purposes you can go to http://www.getacert.com/signacert.html and submit your CSR to obtain a new CA-signed certificate for free.

After you obtain a new certificate, you have to import the new certificate to a keystore if you are using a java keystore.

Step 3: Import the new certificate to a keystore¶

Execute the following command to import a new certificate to a keystore:

keytool -import -v -trustcacerts -alias <current_alias> -file <ca_signed_cert.cer> -keystore <keystore_name.jks>

Tip

If you want to view information related to the renewed certificate, execute the following keytool command:

keytool -list -keystore <keystore_name.jks> -alias <cert_alias> -v