I'm setting up a dev server and wanted to import a certificate. I followed the steps but when i import keytool -import -alias tomcat -keystore tomcat.keystore -file <name> I get an error "signed fields invalid". Also, because the IT Contracting agency manages the certificates they applied it to the server i needed to export the PFX file to use in the keytool script. Any thoughts???
Solved
https keystore certificate error signed fields invalid.
Best answer by jlutherthomas
Update for this question:
Through direct support the HTTPS/SSL configuration got to a nearly good place, with the FME Server web ui working, but jobs wouldn't run: 'Error submitting the job'.
In the tomcat localhost log we identified a pkix path building error.
In order to resolve this issue, we configured FME Server using the steps in this article, put together to help any other users who may be importing pfx certificates.
This post is closed to further activity.
It may be an old question, an answered question, an implemented idea, or a notification-only post.
Please check post dates before relying on any information in a question or answer.
For follow-up or related questions, please post a new question or idea.
If there is a genuine update to be made, please contact us and request that the post is reopened.
It may be an old question, an answered question, an implemented idea, or a notification-only post.
Please check post dates before relying on any information in a question or answer.
For follow-up or related questions, please post a new question or idea.
If there is a genuine update to be made, please contact us and request that the post is reopened.
+2Hi @brianapeters
If you're importing a pfx you may want to read this and follow these steps: https://knowledge.safe.com/questions/25131/how-can-i-use-an-ssl-wildcard-certificate-from-a-p.html
One thing you'll need to make sure is when you create the tomcat keystone file it needs to have the exact same password as the certificate that you're importing.
Hi @brianapeters
If you're importing a pfx you may want to read this and follow these steps: https://knowledge.safe.com/questions/25131/how-can-i-use-an-ssl-wildcard-certificate-from-a-p.html
One thing you'll need to make sure is when you create the tomcat keystone file it needs to have the exact same password as the certificate that you're importing.
cancelled"
I did use the same password when creating the keystore using fme instructions and exporting the pfx. My fme appliction serivce will not start? I dont see logs files in the folder mentioned? If i delete the tomcat.keystore and run the import again it will create another but still dont work? I must be missing something?
+2Thank you, this got me a step further. The: "keytool -importkeystore -srckeystore c:\\temp\\my_keystore.pfx -srcstoretype pkcs12" Seemed to work with "Import command completed: 1 entries successfully imported, 0 entries failed or
cancelled"
I did use the same password when creating the keystore using fme instructions and exporting the pfx. My fme appliction serivce will not start? I dont see logs files in the folder mentioned? If i delete the tomcat.keystore and run the import again it will create another but still dont work? I must be missing something?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
Is it in Windows Services where the FME Server Web Application won't start?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
--------------------------------------------------------------------------------------
19-Sep-2018 10:37:45.653 SEVERE [main] org.apache.tomcat.util.digester.Digester.fatalError Parse Fatal Error at line 108 column 5: The string "--" is not permitted within comments.
--------------------------------------------------------------------------------------
This is the error i get?
--------------------------------------------------------------------------------------
19-Sep-2018 10:37:45.653 SEVERE [main] org.apache.tomcat.util.digester.Digester.fatalError Parse Fatal Error at line 108 column 5: The string "--" is not permitted within comments.
--------------------------------------------------------------------------------------
Is it in Windows Services where the FME Server Web Application won't start?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
Is it in Windows Services where the FME Server Web Application won't start?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
+2making progress... looksl ike there was a type-o and a missing "-->" after i went line by line reviewing.
That's great that you managed to find it. Does the web app server start now?
+2I'm still having issues... but different. I can connect using https://localhost/ but the issued url https://fme-dev.company.com/ is not working?
What are the service urls set to?
making progress... looksl ike there was a type-o and a missing "-->" after i went line by line reviewing.
What's the hostname of FME Server that you gave when you installed it?
What are the service urls set to?
What's the hostname of FME Server that you gave when you installed it?
What are the service urls set to?
+2Jennifer, do you have time to talk and maybe take a look at this? It just isnt working.
Hi Brian. You can raise a support case here. However if you can log into FME Server ok and it's just the browser reporting that the certificate is unsecured, that'd be best addressed with your security/certificate people to make sure your certificate is good and properly verified through a Certificate Authority, or you can look at how to import/trust the certificate with your browser.
+2Update for this question:
Through direct support the HTTPS/SSL configuration got to a nearly good place, with the FME Server web ui working, but jobs wouldn't run: 'Error submitting the job'.
In the tomcat localhost log we identified a pkix path building error.
In order to resolve this issue, we configured FME Server using the steps in this article, put together to help any other users who may be importing pfx certificates.