I'm setting up a dev server and wanted to import a certificate. I followed the steps but when i import keytool -import -alias tomcat -keystore tomcat.keystore -file <name> I get an error "signed fields invalid". Also, because the IT Contracting agency manages the certificates they applied it to the server i needed to export the PFX file to use in the keytool script. Any thoughts???
Solved
https keystore certificate error signed fields invalid.
Best answer by jlutherthomas
Update for this question:
Through direct support the HTTPS/SSL configuration got to a nearly good place, with the FME Server web ui working, but jobs wouldn't run: 'Error submitting the job'.
In the tomcat localhost log we identified a pkix path building error.
In order to resolve this issue, we configured FME Server using the steps in this article, put together to help any other users who may be importing pfx certificates.
+2Hi @brianapeters
If you're importing a pfx you may want to read this and follow these steps: https://knowledge.safe.com/questions/25131/how-can-i-use-an-ssl-wildcard-certificate-from-a-p.html
One thing you'll need to make sure is when you create the tomcat keystone file it needs to have the exact same password as the certificate that you're importing.
jlutherthomas wrote:
Hi @brianapeters
If you're importing a pfx you may want to read this and follow these steps: https://knowledge.safe.com/questions/25131/how-can-i-use-an-ssl-wildcard-certificate-from-a-p.html
One thing you'll need to make sure is when you create the tomcat keystone file it needs to have the exact same password as the certificate that you're importing.
cancelled"
I did use the same password when creating the keystore using fme instructions and exporting the pfx. My fme appliction serivce will not start? I dont see logs files in the folder mentioned? If i delete the tomcat.keystore and run the import again it will create another but still dont work? I must be missing something?
+2brianapeters wrote:
Thank you, this got me a step further. The: "keytool -importkeystore -srckeystore c:\\temp\\my_keystore.pfx -srcstoretype pkcs12" Seemed to work with "Import command completed: 1 entries successfully imported, 0 entries failed or
cancelled"
I did use the same password when creating the keystore using fme instructions and exporting the pfx. My fme appliction serivce will not start? I dont see logs files in the folder mentioned? If i delete the tomcat.keystore and run the import again it will create another but still dont work? I must be missing something?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
jlutherthomas wrote:
Is it in Windows Services where the FME Server Web Application won't start?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
--------------------------------------------------------------------------------------
19-Sep-2018 10:37:45.653 SEVERE [main] org.apache.tomcat.util.digester.Digester.fatalError Parse Fatal Error at line 108 column 5: The string "--" is not permitted within comments.
--------------------------------------------------------------------------------------
brianapeters wrote:
This is the error i get?
--------------------------------------------------------------------------------------
19-Sep-2018 10:37:45.653 SEVERE [main] org.apache.tomcat.util.digester.Digester.fatalError Parse Fatal Error at line 108 column 5: The string "--" is not permitted within comments.
--------------------------------------------------------------------------------------
jlutherthomas wrote:
Is it in Windows Services where the FME Server Web Application won't start?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
jlutherthomas wrote:
Is it in Windows Services where the FME Server Web Application won't start?
What does the catalina log file say? You should be able to find this in the tomcat log folder in your FME Server System Share resources folder.
+2brianapeters wrote:
making progress... looksl ike there was a type-o and a missing "-->" after i went line by line reviewing.
jlutherthomas wrote:
That's great that you managed to find it. Does the web app server start now?
+2brianapeters wrote:
I'm still having issues... but different. I can connect using https://localhost/ but the issued url https://fme-dev.company.com/ is not working?
What are the service urls set to?
brianapeters wrote:
making progress... looksl ike there was a type-o and a missing "-->" after i went line by line reviewing.
jlutherthomas wrote:
What's the hostname of FME Server that you gave when you installed it?
What are the service urls set to?
jlutherthomas wrote:
What's the hostname of FME Server that you gave when you installed it?
What are the service urls set to?
+2brianapeters wrote:
Jennifer, do you have time to talk and maybe take a look at this? It just isnt working.
jlutherthomas wrote:
Hi Brian. You can raise a support case here. However if you can log into FME Server ok and it's just the browser reporting that the certificate is unsecured, that'd be best addressed with your security/certificate people to make sure your certificate is good and properly verified through a Certificate Authority, or you can look at how to import/trust the certificate with your browser.
+2Update for this question:
Through direct support the HTTPS/SSL configuration got to a nearly good place, with the FME Server web ui working, but jobs wouldn't run: 'Error submitting the job'.
In the tomcat localhost log we identified a pkix path building error.
In order to resolve this issue, we configured FME Server using the steps in this article, put together to help any other users who may be importing pfx certificates.
Reply
Rich Text Editor, editor1
Editor toolbars
Press ALT 0 for help
Helpful Members This Week
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.