Skip to main content
Version: 3.8.x.x LTS

Replace HTTPs certificate

The HTTPs certificate used by nevisAdmin 3 is self-signed and not trusted by browsers. Thus, there will be a certificate warning when you access the nevisAdmin GUI. This section explains how to replace the certificate.

info
  • In the following steps, we assume that the keytool can be found via PATH. If this is not the case, you can use /opt/adnjdk18/bin/keytool instead.
  • This is a non-trivial task. The exact steps depend on your requirements. Not all sections may be applicable.

  1. Stop nevisAdmin.

  2. Make a backup of the nevisAdmin instance directory.

  3. Delete the existing certificate from the container keystore:

keytool -delete -keystore
/var/opt/adnglassfish/nevisadmin/nevisadmin/config/keystore.jks -alias s1as

Enter the keystore password to delete the certificate. The default password is: "changeit". See the following section: Change Keystore Password, on how to change the password later on.

  1. Generate a new private key using the fully qualified hostname of nevisAdmin (as visible to the browser):
keytool -genkey -keystore
/var/opt/adnglassfish/nevisadmin/nevisadmin/config/keystore.jks -alias s1as -
keyalg rsa -validity 9999 -dname "CN=<hostname>, O=<your company>, C=CH" -ext san=dns:<hostname>

Use the same password for the keystore and the alias.

  1. Now that you have created a new key pair, you can export a certificate request:
keytool -keystore
/var/opt/adnglassfish/nevisadmin/nevisadmin/config/keystore.jks -certreq -alias s1as -
keyalg rsa -ext san=dns:<hostname> -file /tmp/request.csr
  1. Sign the certificate request with your CA. In this example, we assume your CA is managed by nevisKeybox:
neviskeybox sign -ca myCA -file /tmp/request.csr
  1. Add the CA certificate to the container keystore:
keytool -import -keystore
/var/opt/adnglassfish/nevisadmin/nevisadmin/config/keystore.jks -file
/var/opt/neviskeybox/default/myCA/ca_cert.pem -alias myCA
  1. Import the new HTTPs certificate into the glassfish keystore:
keytool -import -keystore
/var/opt/adnglassfish/nevisadmin/nevisadmin/config/keystore.jks -file /tmp/new_cert.pem
-alias s1as