Import an existing SSL certificate and private key to Tomcat

To import an existing SSL certificate and private key to Tomcat, do the following:

Convert the certificate and private key to a PKCS12 file

You cannot directly import private key information to a keystore using keytool. You must convert the certificate and private key into a PKCS12 (.p12) file, and then you can import the PKCS12 file to your keystore.

Run the following command:
```
openssl pkcs12 -export -in [filename-certificate] -inkey [filename-key] -name [host] -out [filename-new-PKCS-12.p12]
```
Import the certificate to your keystore
1. Import the PKCS12 certificate by executing the following command:
```
keytool -importkeystore -deststorepass [password] -destkeystore [filename-new-keystore.jks] -srckeystore [filename-new-PKCS-12.p12] -srcstoretype PKCS12
```
  where the [password] is the password you specified when you created the private key.
2. Run one of the following commands:
  - If you have a CA bundle file, import it by running the following command:
```
keytool -import -alias bundle -trustcacerts -file [ca_bundle] -keystore [filename-new-keystore.jks]
```
  - If you do not have a CA bundle file, import certificates by running the following command:
```
keytool -import -alias [certificate-type] -trustcacerts -file [certificate-file] -keystore [filename-new-keystore.jks]
```
    where the [certificate-type] is the type of certificate, for example, root or intermediate.

Configure PPM.

In the server.conf file, add the following parameters:

#turn on SSL login 
com.kintana.core.server.ENABLE_SSL_LOGIN=true

#if you use http_port 8080 then https_port will be set to 8443. Please verify if your IIS is using port 443, otherwise you have to choose either stop IIS or use a different http_port and https_port here
com.kintana.core.server.HTTPS_PORT=8443
#
com.kintana.core.server.HTTPS_WEB_THREAD_MIN=5

#
com.kintana.core.server.HTTPS_WEB_THREAD_MAX=75
#keystore file physical location on PPM machine created from step 2-a
com.kintana.core.server.HTTPS_KEYSTORE_LOCATION=C:/Java/keystore_ppm_dev

#Encrypted keypassword. By default it is changeit, and you need to run kEncrypt.sh to encrypt this password. Each PPM instance has its own encryption content. 
com.kintana.core.server.HTTPS_KEYPASSWORD=#!#7w:x?vv=MdXJ}2&bJbrykTMY3FI>R1{<+Kw^fjN=hjw8hz2HrTd_X8w+~|Tx19ZiO_oS }rpTHSX(B@)LM{A~c~M<N9GVw,2jLOf(e=WZNbLo)xarUny.mKp|p{ +1LySpZS flrG{v3&:?k8|<y.y0 b`Kp|G/`s^q.GR|4?s}&jD$rtamfkqZr?$UT-#!#

Modify the following parameters:

#if your IIS on the same PPM machine has to use port 443, then you must change PPM http_port to something else other than 8080 and also update https_port parameter
com.kintana.core.server.HTTP_PORT=8080

#the domain name must match the name that you specified when you created the private key
com.kintana.core.server.BASE_URL=
http://itprojectsystem_dev.xyz.com:8080/

Save the file.
Stop PPM Server and run kUpdateHtml.
Start PPM Server and test the login using BASE_URL such as http://itprojectsystem_dev.xyz.com:8080/.