Create Your CSR with Java Keytool in Tomcat Server

Recommended Method: Use the DigiCert Java Keytool CSR Wizard

You can save time by using the DigiCert Java Keytool CSR Wizard to generate a Keytool command to create your Tomcat keystore and CSR.

Simply fill out the form, click Generate, and then paste your customized Java Keytool command into your terminal.
The Java keytool utility creates both your private key and your certificate signing request, and saves them to two files: your_common_name.jks, and your_common_name.csr.
You can then copy the contents of the CSR file and paste it into the CSR text box in our order form.
Skip to Step 2, part 3: Save and Back-up Your Keystore File.

Do you prefer a more manual approach to generating your Tomcat keystore and CSR? Follow the instructions below.

Step 1: Use Keytool to Create a New Keystore

Important: We recommend you generate a new keystore following the process outlined in this section. Installing a new certificate to an old keystore often ends in installation errors or the SSL/TLS certificate not working properly. Before you begin this process, backup and remove any old keystores.

Run Command

Navigate to the directory where you plan to manage your keystore and SSL/TLS certificate.
Enter the command below

keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore your_site_name.jks

In the command above, your_site_name should be the name of the domain you want to secure with this SSL/TLS certificate. When ordering a Wildcard certificate, do not include the asterisk (*) in the filename (e.g., your_site_name). The asterisk is not a valid keytool character.

Create a Password

When prompted, create a password for your Keystore.

Note: You will specify this password in your Tomcat configuration file and then use it to generate your CSR and to import your certificate.

Store this password somewhere safe, such as a trusted and secured password manager.

Enter your SSL/TLS certificate information.
Important: When prompted for the first and last name, DO NOT type your first and last name. Instead, type the Fully Qualified Domain Name (FQDN) for the site you are securing with this certificate (e.g., www.yourdomain.com, mail.yourdomain.com). Are you are ordering a Wildcard Certificate? Then your FQDN must begin with an asterisk (). (e.g.,.yourdomain.com).
Enter your Organization information.
When prompted to verify your information, type y or yes to confirm.
When asked for a "key password for ", press enter to use the password you just created for the keystore file.
Your keystore file, your_site_name.jks, is now created and in your current working directory.

Step 2: Generate a Certificate Signing Request (CSR) from your New Keystore

Run Command

In Keytool, type the following command:

keytool -certreq -alias server -file csr.txt -keystore your_site_name.jks

In the command above, your_site_name should be the name of the keystore file you created in Step 1: Use Keytool to Create a New Keystore or when using the DigiCert Java Keytool CSR Wizard.

When prompted, enter the password you created earlier (when you created your new keystore).
In your current directory, csr.txt (e.g., your_site_domain.txt) now contains your CSR.

Save and Back-up Your Keystore File

Take note of the path to your keystore file (your_site_domain.jks) as your SSL/TLS certificate will be installed to it later.
We recommend that you create a back-up copy of your Keystore file (your_site_domain.jks) before continuing. Having a back-up of the Keystore file can help resolve issues that may occur during certificate SSL/TLS installation.

Order Your SSL/TLS Certificate

Open the .csr file you created with a text editor.
Copy the text, including the -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- tags, and paste it in to the order form.
Make sure that when you Select Server Software, you select Tomcat.

Install Certificate

After you’ve received your SSL/TLS certificate, you can install it on your Tomcat server.