Share this page

# Import an existing SSL certificate and private key to Tomcat

To import an existing SSL certificate and private key to Tomcat, do the following:

1. Convert the certificate and private key to a `PKCS12` file

   You cannot directly import private key information to a keystore using `keytool`. You must convert the certificate and private key into a `PKCS12` (`.p12`) file, and then you can import the `PKCS12` file to your keystore.

   Run the following command:

       openssl pkcs12 -export -in [filename-certificate] -inkey [filename-key] -name [host] -out [filename-new-PKCS-12.p12]

2. Import the certificate to your keystore

   1. Import the `PKCS12` certificate by executing the following command:

          keytool -importkeystore -deststorepass [password] -destkeystore [filename-new-keystore.jks] -srckeystore [filename-new-PKCS-12.p12] -srcstoretype PKCS12

      where the `[password]` is the password you specified when you created the private key.

   2. Run one of the following commands:

      - If you have a CA bundle file, import it by running the following command:

            keytool -import -alias bundle -trustcacerts -file [ca_bundle] -keystore [filename-new-keystore.jks]

      - If you do not have a CA bundle file, import certificates by running the following command:

            keytool -import -alias [certificate-type] -trustcacerts -file [certificate-file] -keystore [filename-new-keystore.jks]

        where the `[certificate-type]` is the type of certificate, for example, root or intermediate.

3. Configure PPM.

   1. In the `server.conf` file, add the following parameters:

          #turn on SSL login
          com.kintana.core.server.ENABLE_SSL_LOGIN=true

          #if you use http_port 8080 then https_port will be set to 8443. Please verify if your IIS is using port 443, otherwise you have to choose either stop IIS or use a different http_port and https_port here
          com.kintana.core.server.HTTPS_PORT=8443
          #
          com.kintana.core.server.HTTPS_WEB_THREAD_MIN=5

          #
          com.kintana.core.server.HTTPS_WEB_THREAD_MAX=75
          #keystore file physical location on PPM machine created from step 2-a
          com.kintana.core.server.HTTPS_KEYSTORE_LOCATION=C:/Java/keystore_ppm_dev

          #Encrypted keypassword. By default it is changeit, and you need to run kEncrypt.sh to encrypt this password. Each PPM instance has its own encryption content.
          com.kintana.core.server.HTTPS_KEYPASSWORD=#!#7w:x?vv=MdXJ}2&bJbrykTMY3FI>R1{<+Kw^fjN=hjw8hz2HrTd_X8w+~|Tx19ZiO_oS }rpTHSX(B@)LM{A~c~M<N9GVw,2jLOf(e=WZNbLo)xarUny.mKp|p{ +1LySpZS flrG{v3&:?k8|<y.y0 b`Kp|G/`s^q.GR|4?s}&jD$rtamfkqZr?$UT-#!#

   2. Modify the following parameters:

          #if your IIS on the same PPM machine has to use port 443, then you must change PPM http_port to something else other than 8080 and also update https_port parameter
          com.kintana.core.server.HTTP_PORT=8080

          #the domain name must match the name that you specified when you created the private key
          com.kintana.core.server.BASE_URL=
          http://itprojectsystem_dev.xyz.com:8080/

   3. Save the file.

   4. Stop PPM Server and run `kUpdateHtml`.

   5. Start PPM Server and test the login using `BASE_URL` such as `http://itprojectsystem_dev.xyz.com:8080/`.

https://admhelp.microfocus.com PPM 8942
Tips to improve your search results... OpenText™ Project and Portfolio Management Help Center PPM Help 26.2-26.3 All View Local Help Center View Online Help Center Version: