Using a wildcard SSL Certificate for Portfolio

Using a wildcard SSL Certificate for Portfolio


If a certificate from Microsoft Certificate Manager is exported as a PKCS12 certificate file, with the entire certificate chain and the key pair in the file, keytool can convert it into a JKS keystore for Portfolio.

To get the certificate alias for -srcalias from the .pfx file:

keytool -list -keystore <path to .pfx file> -storetype pkcs12

Certificates exported from Microsoft Certificate Manager will have a UUID as the alias; other sources may use "1" as the alias.

Converting into a keystore

To convert the .pfx file into a keystore, run the following command in Terminal (macOS) or Command Prompt (Windows). Parameters are listed on separate lines for clarity; they should be on a single line:

keytool -importkeystore 
        -srckeystore <path to .pfx file>
        -srcstoretype pkcs12
        -srcalias <certificate alias>
        -srcstorepass <password for .pfx file>
        -destkeystore keystore
        -deststoretype JKS
        -destalias extensis
        -destkeypass kaq8thefUphuTrexeSW3sp3m
        -deststorepass kaq8thefUphuTrexeSW3sp3m

The command will prompt the user for the password in the source certificate.

  • -srckeystore the path to keystore file we are importing
  • -srcstoretype the type of keystore we are importing
  • -srcalias the alias of the key pair, and its associated certificates, to import (see below)
  • -srcstorepass the password to use for the source keystore; if this parameter isn't used then keytool will prompt the user to enter it
  • -deststoretype the type of keystore we are exporting
  • -destkeystore the path to keystore file to export to; if the file does not exist, it is created
  • -destalias the alias to use for the key pair in the new keystore
  • -destkeypass the password to use for the alias in the keystore; Portfolio requires the alias password to match the store password
  • -deststorepass the password to use to open the destination keystore; since we are creating a new keystore, it sets the store password on the newly-created keystore instead

Once you have the new keystore file, you can drop it into Portfolio's data folder and restart the Portfolio services.

      • Related Articles

      • SSL Certificates in Portfolio

        The process of getting a certificate involves creating a request file, sending the request to a Certificate Authority, receiving a certificate file in return, and then importing the certificate file. Creating the Request To create the request file: ...

      • Adding SSL for secure connections

        By default, Portfolio uses a self-signed certificate for secure client connections. You can request and add a signed certificate in Portfolio Administration, without resorting to the command line. This certificate allows secure (i.e., https) ...

      • Portfolio Glossary

        Following are some terms used throughout Portfolio and its documentation. Some are technical (“computer”) terms that relate to Portfolio features and services, some are fundamental concepts within Portfolio, and some are terms that relate to Digital ...

      • Using Map view

        Map view allows you to filter and view assets that contain valid location information, either a GPS point or a bounding rectangle. To view your assets in relation to the world map, click . In Map view, assets that are geographically close together ...

      • Portfolio checklist

        Use this checklist to help you make sure you are ready to install and configure Portfolio. License Administrator Be sure to have the Extensis account information (email address and password) for your Portfolio License Administrator. You need this ...