Changing The Location Of Certificate Files; Using Java Secure Socket Extension (Jsse) Tools; Using The Keytool Utility - Sun Microsystems GlassFish Enterprise Server 2.1 Administration Manual

Using Java Secure Socket Extension (JSSE) Tools

Changing the Location of Certificate Files

The keystore and truststore files provided for development are stored in the domain-dir/config
directory.
Use the Admin Console to add or modify the value field for the new location of the certificate
files.
-Dcom.sun.appserv.nss.db=${com.sun.aas.instanceRoot}/NSS-database-directory
where NSS-database-directory is the location of the NSS database.
Using Java Secure Socket Extension (JSSE) Tools
Use keytool to set up and work with JSSE (Java Secure Socket Extension) digital certificates. In
the Developer Profile, the Enterprise Server uses the JSSE format on the server side to manage
certificates and key stores. In all the profiles, the client side (appclient or stand-alone) uses the
JSSE format.
The J2SE SDK ships with keytool, which enables the administrator to administer
public/private key pairs and associated certificates. It also enables users to cache the public keys
(in the form of certificates) of their communicating peers.
To run keytool, the shell environment must be configured so that the J2SE /bin directory is in
the path, or the full path to the tool must be present on the command line. For more
information on keytool, see the keytool documentation at
http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/keytool.html.

Using the keytool Utility

The following examples demonstrate usage related to certificate handling using JSSE tools:
112 Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008
In the Developer Profile, on the server side, the Enterprise Server uses the JSSE format,
which uses keytool to manage certificates and key stores. In the Clusters and Enterprise
Profile, on the server side, the Enterprise Server uses NSS, which uses certutil to manage
the NSS database which stores private keys and certificates. In both profiles, the client side
(appclient or stand-alone), uses the JSSE format.
By default, the Enterprise Server is configured with a keystore and truststore that will work
with the example applications and for development purposes. For production purposes, you
may wish to change the certificate alias, add other certificates to the truststore, or change the
name and/or location of the keystore and truststore files.