Generate and Import a Certificate

Using HTTPS with Single Sign-On › How to Set Up HTTPS for CA Single Sign-On › Set Up SSL Certificates › Generate and Import a Certificate

Generate and Import a Certificate

If you do not already have an SSL certificate, you can generate one using the keytool command. This procedure explains how to generate a self-signed certificate and install it in the keystore.

Follow these steps:

Run the following command:

cd installDirectory/PerformanceCenter/jetty/etc

Create a backup of the existing jetty keystore file by renaming it using the following commands:
```
mv installDirectory/PerformanceCenter/jetty/
etc/keystore installDirectory/PerformanceCenter/
jetty/etc/keystore.bak
```
Important! You must remove the old keystore. If you do not, an error appears in later steps: "Keystore was tampered with, or password was incorrect."
Generate a private key and a public, self-signed certificate using the following command:
```
keytool -genkeypair -keystore keystore -storepass storepasswd -keyalg RSA -keysize 2048 -keypass keypasswd -alias capc
```
storepasswd

Determines the password to access the keystore.

keypasswd

Determines the password to access the key within the keystore.

Important! Remember these passwords—they cannot be recovered.
Export the self-signed certificate from the keystore using the command:
```
keytool -exportcert -keystore keystore -storepass storepasswd -alias capc -file filename.cer
```
filename.cer

Determines the file to which the certificate is exported. We recommend using a full pathname that does not place the file in the current directory.

Example: /tmp/capcCert.cer.

Note: We recommend backing up the cacerts file before continuing.
Import the self-signed certificate into the java trusted certificates keystore using the command:
```
keytool -importcert -keystore installDirectory/jre/lib/security/cacerts -storepass cacertspasswd -alias capcSelfSigned -file filename.cer
```
Note: The default password for the cacerts keystore is "changeit."

cacertspasswd

Specifies the password for the cacerts keystore.

Default: changeit

filename.cer

The file to which the certificate was exported in a previous step.
Back up the cacerts file.
(Optional) For more security, change the password of the java trusted certificates keystore using the following command:
```
keytool -storepasswd -keystore installDirectory/jre/lib/security/cacerts
```
You are prompted to provide the existing password and the new password.
Verify that your imported keystore is available. Use the following command:
```
keytool -list -keystore installDirectory/jre/lib/security/cacerts
```
Important! To enable the web services, the self-signed certificate must be in the cacerts keystore. Otherwise, you see an error in the log that reports that PKIX did not find a certificate.
Restart each CA Performance Center service using these commands:
```
/sbin/service caperfcenter_sso restart
```
```
/sbin/service caperfcenter_devicemanager restart
```
```
/sbin/service caperfcenter_console restart
```
Your self-signed SSL certificate is generated and installed in the keystore.

Next steps: