# Help with Wildcart Certificate

**URL:** <https://forum.inductiveautomation.com/t/help-with-wildcart-certificate/16360>\
**Category:** Ignition\
**Created:** [December 19, 2017, 3:02pm UTC](https://forum.inductiveautomation.com/t/help-with-wildcart-certificate/16360 "2017-12-19T15:02:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![klehman](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@klehman](https://forum.inductiveautomation.com/u/klehman)\
**Post date:** [December 19, 2017, 3:02pm UTC](https://forum.inductiveautomation.com/t/help-with-wildcart-certificate/16360/1 "2017-12-19T15:02:03Z")

</div>

I have tried quite a few ways to install a wildcard cert for my install but I have not had any luck. I tried using the pfx that I use on my other subdomains and servers (apache, IIS, but not tomcat), but Igntion will not start afterward.

Here is the command that I ultimately ended up getting the closest with, it imports the cert OK into to the keystore when I check using keystore - list -keystore but when I copy the ssl.key over, the gateway wont restart.

Am I missing someing? Do I need to isntall the CA cert also?

keytool -importkeystore -srckeystore source.pfx -srcstoretype PKCS12 -srcalias srcalias -destkeystore ssl.key -deststoretype JKS -deststorepass ignition -destalias tomcat

Thanks!

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [December 19, 2017, 3:49pm UTC](https://forum.inductiveautomation.com/t/help-with-wildcart-certificate/16360/2 "2017-12-19T15:49:47Z")

</div>

> [@klehman](#):
>
> Here is the command that I ultimately ended up getting the closest with, it imports the cert OK into to the keystore when I check using keystore - list -keystore but when I copy the ssl.key over, the gateway wont restart.

Can you look in the wrapper.log file (in the `logs` directory in the installation directory) and see why it's not restarting?

---

<div class="post-metadata">

**Author:** ![klehman](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@klehman](https://forum.inductiveautomation.com/u/klehman)\
**Post date:** [December 19, 2017, 4:38pm UTC](https://forum.inductiveautomation.com/t/help-with-wildcart-certificate/16360/3 "2017-12-19T16:38:07Z")

</div>

Well, that made it easier! WIth some googling, here is what I did to fix it.

Here is what I found in there.

```auto
INFO | jvm 1 | 2017/12/19 01:26:01 | I [o.e.j.s.ServerConnector] [06:26:01]: Started ServerConnector@4b6628{SSL,[ssl, http/1.1]}{0.0.0.0:8060} 
INFO | jvm 1 | 2017/12/19 01:26:01 | WrapperSimpleApp Error: Encountered an error running main:
INFO | jvm 1 | 2017/12/19 01:26:01 | WrapperSimpleApp Error: java.security.UnrecoverableKeyException: Cannot recover key

```

So I googled and found this this page [https://community.oracle.com/thread/2334304](https://community.oracle.com/thread/2334304) , which says it has something password protection on pfx files, which is confusing because my source pfx had a password.

So…I ran these commands:

```auto
openssl pkcs12 -in source.pfx -out temp (where source.pfx is your cert)

```

followed by

```auto
openssl pkcs12 -export -in temp -out tomcat.pfx 

```

I then had to extract the alias in the existing pfx to be able to give it an alias of tomcat later:

First, import to JKS into a temporary keystore…

```auto
keytool -importkeystore -srckeystore tomcat.pfx -srcstoretype PKCS12 -destkeystore temp.key -deststoretype JKS -deststorepass ignition

```

Then list the Keystore with -v to show alias

```auto
keytool -v -list -keystore temp.key

```

The output of that command shows that the alias is 1

```auto
Your keystore contains 1 entry

Alias name: 1

```

Sooo…Finally.

```auto
keytool -importkeystore -srckeystore tomcat.pfx -srcstoretype PKCS12 -srcalias 1 -destkeystore ssl.key -deststoretype JKS -deststorepass ignition -destalias tomcat

```

I copied that to my install folder and it worked properly! This was done on a test enviroment, I plan to do a runthough once more before deploying on production server, if there is a change, I will update it here.

There was likely an easier way, no doubt…but this worked!