Generate Entrust Certificates

The following images are thumbnails.  Click on an image to enlarge.

1) The Entrust site is IE browser specific.  If your servers are Linux or Solaris based several files will need to be moved from and to your Windows machine to your server machine.
Go to: https://evaladminservices.managed.entrust.com/cda-cgi/clientcgi.exe?action=start
On the left – Select CA Certificates \ Install

2) When this pop-up window appears, select Open

3) The certificate details for the DComRootCA will be displayed. Select “Install Certificate…”

4) Navigate through the Wizard, Select Next

5) Select the option to “Place all certificates in the following store”
Then Browse to select “Trusted Root Certification Authorities”

6) The confirmation window will show your setting. Select Finish.

7) Confirm the installation, by selecting “Yes”.

8) Then acknowledge the import by clicking “OK”.

9) To verify the installation of the certificate, select the “Tools” dropdown, then “Internet Options” to bring up the Internet Options pop-up window. Select the Content tab.

10) Select the “Certificates” button to bring up the Certificates pop-up. Select the Trusted Root Certification Authorities tab, and confirm the presence of the DComRootCA certificate in the list.
You may now Close and exit the pop-ups.

11) To be able to generate your Web Certificate you will email to Adrian Anderson [Adrian.Anderson@hhs.gov] your full computer name to use as your domain name. This will be something like: “SC075311.cs.myharris.net”. They will return to you in 2 separate emails an Authorization Code and a Reference Number which you will then use to create your signed certificate.

12) Create a work area such as: C:\Sun\AppServer\certificaterequests
Create your gateway.jks keystore in this work directory. For your domain name you must use the Reference Number provided to you as the common name, “nhin-test” as the organizational unit, and “entrust” as the organization:

13) Confirm the contents of your gateway.jks keystore:

Note: You’ll be prompted for the keystore password (changeit)

14) Generate the certificate signing request:

15) Verify this certificate request:

16) From the Entrust web site: https://evaladminservices.managed.entrust.com/cda-cgi/clientcgi.exe?action=start Select the “Create Certificate from PKCS#10 Request”
Enter in your Reference Number, Authorization Code, and put the text from your Certificate Request (self-signed certificate that was created earlier) into the text box.
Select “Submit Request”

17) This will generate your Web Server Certificate.
Select Download to save the servercert.bin file

18) Confirm your Web Server Certificate is a NetscapeCertType that provides both SSL Client and SSL Server capabilities

19) On the left hand side of the window select “Install” in the CA Certificates area. Select the “Save” button to save the cacert.crt file.

20) On the left hand side of the window select “Display list” in the Cross-Certificates area.
Select the complete text from "BEGIN CERTIFICATE" to "END CERTIFICATE". Copy this into a file called cross.crt.

21) Create a backup of your cacerts.jks file. Make a copy of this file in your C:\Sun\AppServer\certificaterequests work directory. Then import the entrust root certificate, the intermediate cross certificate, and the web server certificate into the truststore:

After viewing the certificate and confirming the Owner references DComRootCA, type yes to trust this certificate.
Continue to insert the intermediate certificate and then your machine specific certificate.

22) Confirm the contents of your cacerts.jks keystore includes the gateway cert:

Note: You may not have 40 entries, it all depends on what certificates are in your truststore at that point in time.

23) The gateway.jks keystore will need all three certificates added in order to form the Chain of Trust. First import the root certificate:

Confirm the DComRootCA owner and type yes to accept this certificate.

24) Next import the Intermediate certificate authority:

25) Finally import the Web Server Certificate:

26) Verify the contents of the gateway.jks keystore:

27) Make sure your Glassfish Application Server is stopped, then navigate to your domain configuration directory (i.e. C:\Sun\AppServer\domains\domain1\config) and make sure you have a backup of your domain.xml and your cacerts.jks files. Now copy the gateway.jks and the cacerts.jks from your certificate work directory into the domain configuration directory.

28) Edit the domain.xml file to set up to use the new certificates.
a. Find all occurrences of s1as and replace with gateway.

b. Set the jvm-options to use the new keystores:

Windows:

Solaris:

c. Enable 2-way SSL and turn on extra logging if desired:

29) Restart Glassfish to verify jvm settings and keystores.