How to Generate a CSR for an Apache Tomcat Web Server (ECC)

To generate a Certificate Signing Request (CSR) for an Apache Tomcat webserver, perform the following steps. When you have completed this process, you will have a CSR ready to submit to TRUSTZONE in order to be generated into an SSL certificate.

Note: Currently, only Java SE 7 supports ECC

Note: We recommend running cmd.exe as an administrator on a Windows installation. The location of the keytool is usually \Program Files\Java\javaversionhere\bin

Note: Change mydomain.com to the website you wish to create the CSR for

1. Create a certificate keystore and private key with the following command:
keytool -genkey -alias mydomain -keyalg EC -keysize 2048 -keystore mydomain.jks

2. Specify the password. It must be at least 6 characters long 3. Input the information for the Certificate Signing Request. This information will be displayed in the certificate.

First and last name: This is the common name. Must match the URL you plan to secure exactly – is usually your fully-qualified domain name (e.g. trustzone.dk or mail.trustzone.dk). Remember the www. is important – include it if you want to secure https://www.mydomain.com & exclude it if you want to secure https://mydomain.com

Organization: The legal (officially registered) name of your organization/company include Inc., LLP., Pvt, Plc. Ltd. SARL., etc

Organizational unit: The name of your department within the organization (this is often “IT,” “Web,” or is just left blank)

City/locality: The city or town in which your organization is located

State/Province: The state in which your organisation is located

Country: Click here for the official list of ISO country codes for this field

Enter the password for yourdomain or enter “RETURN” if it is the same as the keystore password

4. Create the Certificate Signing Request file using:
keytool -certreq -keyalg EC -alias mydomain -file yourdomain.csr -keystore mydomain.jks

5. Enter the keystore password

6. You now have a “yourdomain.csr” file. The file is encoded in PEM format and can be entered into the website. Be sure to include the beginning and end tags:

—–BEGIN NEW CERTIFICATE REQUEST—–
—–END NEW CERTIFICATE REQUEST—-