MQSeries.net :: View topic

dextermbmq · Posted: Sun Jan 17, 2016 8:06 am Post subject:

Hello All,

We are using a SSL self signed certificate in our Broker Keystore. It had expired 2 days ago so there was an urgent need to renew the certificate. We followed the following approach ::

1-)We created a new JKS repository :

Keytool -genkey -keyalg RSA -alias <ALIAS NAME> -keystore <LOCATION> -validity 3650 -keysize 2048

There after if prompted for CN,OU,O and CK details which I provided. As a result we got a new JKS repos. I replaced the pld JKS with this JKS file(both had same names)...Everything worked fine

Now I have a question :

Can we delete the alias pointing to the expired self signed certificate in the old/existing KEYSTORE and then import the new keystore into old keystore using command

keytool -importkeystore -srckeystore <NEW KEYSTORE> -destkeystore <OLD KEYSTORE> -srcalias <ALIAS NAME IN NEW JKS> -destalias <ALIAS NAME IN OLD JKS> -srcstorepass <> -deststorepass<>

============

NOTE : My concern here is that , IS PRIVATE KEY KEYSTORE SPECIFIC OR WE CAN HAVE MULTIPLE CERTIFICATE CHAINS EACH HAVING DIFFERENT PRIVATE KEY WITHIN A KEYSTORE?

When we create a new keystore , we will have a certificate chain(Certificate + public key) along with Private key identified by an ALIAS...Will it be a problem as the old keystore where we are importing the new certificate chain will already have a PRIVATE KEY and the new certificate chain will have a separate PRIVATE KEY....