@jspecht after quite a learning journey, I'm to the point now where I am trying to hot load the new cert into the gateway. I'll state the problem here and then provide more detail below:
Problem
When loading the new PKCS12 in the gateway, the CMD output looks good and I can see this in the logs after I restore the backup. But when I first load the new cert and do gwcmd -g, the SSL lock stays on, but nothing will display in the gateway when you try to navigate, everything is blank. Restoring the back up cert puts things back to normal.
Here, entry 2 is the backup restore, 1 is when the new cert was loaded. Both look successful but the first one is seemingly not:
If I look at the new cert and the original (known working SSL) in key store explorer, both look the same and open with the same passwords:
New (doesn't behave right in the gateway)
Original ( works correctly )
In both cases, the command line didn't give any indication of issue
Background
When we get the cert back from API call, it is in a string. It is then converted to a key store and then the password and alias are changed:
// workflow
KeyStore ks = stringToKeyStore(certAsString, downloadPass);
ks = changePassword(ks, downloadPass);
saveKeyStore(ks, pass, filePath);
// Functions
public static KeyStore stringToKeyStore (String certAsString, String password) {
char[] certPass = password.toCharArray();
byte[] decodedBytes = Base64.getDecoder().decode(certAsString);
try {
InputStream inputStream = new ByteArrayInputStream(decodedBytes);
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(inputStream, certPass);
return ks;
} catch (Exception e) {
System.out.println("Issue encountered converting string to PKCS12");
return null;
}
}
public static KeyStore changePassword(KeyStore ks, String currentPassword) {
Enumeration<String> aliases = ks.aliases();
while (aliases.hasMoreElements()) {
String alias = aliases.nextElement();
Certificate cert = ks.getCertificate(alias);
if (((X509Certificate) cert).getSubjectDN().toString().contains(commonName)) {
Key key = ks.getKey(alias, currentPassword.toCharArray());
Certificate[] chain = ks.getCertificateChain(alias);
ks.setKeyEntry(pass, key, pass.toCharArray(), chain);
ks.deleteEntry(alias);
}
}
return ks;
}
public static Boolean saveKeyStore(KeyStore ks, String password, String outputPath) {
try {
FileOutputStream fos = new FileOutputStream(outputPath, false);
ks.store(fos, password.toCharArray());
fos.close();
return true;
} catch (Exception e) {
System.out.println(String.format("Issue encountered when trying to save [%s]", outputPath));
System.out.println(e);
return false;
}
}
Still working on it but the fact that when I load the new keystore into the gateway and it doesn't throw any error but the gateway then shows blank pages is where I'm a bit confused on how to fix.
Thanks,
Nick
.
