16.16 Apache Services Fails to Use the Certificate Key Store

When you import CA-signed or third-party certificates into iPrint Appliance using the Management Console, the Apache service continues to use the old certificates.

To work around this issue, you must manually replace the certificates. Ensure that the certificate you want to replace is in the .crt format, and that you have the .key file. If you have the certificate in a different format, (for example, .pfx, .p12, or .pem), you must extract, or convert them to .crt and .key formats. You might also have a third file (intermediate CA certificate) also in .crt format.

NOTE:If you have a .pfx file you must first extract the .crt and .key files. To learn how to extract these files, see Section 16.16.1, Extracting Certificates and Key From PFX File. After you have extracted the files, follow the procedure below.

  1. Login to iPrint Appliance using SSH.

  2. Navigate to the /vastorage/conf/certs/ directory.

  3. Backup the existing certificate files to a backup directory by using the mv command.

    Ensure that you move all the files. The files include vaserver.*, keystore, and keystoredb. Keystoredb may not always exist.

  4. Copy all certificates, and the key file (.crt and .key) to the /vastorage/conf/certs/ directory by using the command scp, or the winscp application.

    If you have extracted the files from a .pfx file, and have the .crt and .key files stored in the appliance, copy the files using the cp command.

  5. Rename the .crt file to vaserver.crt.

  6. Rename the .key file to vaserver.key.

  7. Rename the intermediate CA certificate file to CACert.crt.

  8. Convert the certificates and the key file to .pfx format so that it can be imported to the Java keystore.

    1. Run the command openssl pkcs12 -export -out vaserver.pfx -inkey vaserver.key -in vaserver.crt -certfile CACert.crt.

    2. When prompted for a pass phrase for vaserver.key, specify the pass phrase that you used while generating the key.

    3. When prompted for the export password, specify changeit.

    4. Verify the export password by specifying changeit.

  9. Import the .pfx file to keystore.

    1. Run the command keytool -importkeystore -srckeystore vaserver.pfx -srcstoretype pkcs12 -destkeystore keystore.

    2. For all the prompts that follow, specify changeit.

  10. In the file /etc/apache2/vhosts.d/vhost-ssl.conf, search for SSLCertificateChainFile.

  11. Uncomment the line #SSLCertificateChainFile /etc/apache2/ssl.crt/ca.crt. by removing the #.

  12. Modify the path to the location of the CACert.crt file. For example, SSLCertificateChainFile /vastorage/conf/certs/CACert.crt.

  13. Save and close the vhost-ssl.conf file.

  14. Edit the /etc/ssl/servercerts/passphrase.sh file, then add the key pass phrase.

    1. Replace the string changeit, with the pass phrase that you used while generating the key.

  15. Restart apache using the command rcapache2 restart.

  16. Restart jetty using the command rcnovell-jetty restart.

16.16.1 Extracting Certificates and Key From PFX File

  1. Copy the .pfx file to any location on iPrint Appliance by using the command scp, or the winscp application.

  2. Extract the certificate file from the .pfx file by using the command openssl pkcs12 -in <file_path.pfx> -clcerts -nokeys -out vaserver.crt.

  3. Extract the key file from the .pfx file by using the command openssl pkcs12 -in <file_path.pfx> -nocerts -nodes -out vaserver.key.

  4. Extract the CA certificate from the .pfx file by using the command openssl pkcs12 -in <file_path.pfx> -nodes -nokeys -cacerts -out CACert.crt.