This is version 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 . It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]

Here is an example on how to make a certificate request for an authority.

(I am going to use GoDaddy for my example, but the same would be similar for other certificate authorities as well.) I purchased a cheap chained certificate from godaddy. I chose the "Tomcat" type of certificate as CrushFTP works the same way as tomcat for certificates. I substituted "crushftp" instead of "tomcat" though. It really doesn't matter however.

• PART 1

Here are the commands I issued from an OS X terminal: (These commands work on windows, linux, etc. They are Java commands, and not OS X commands. Download a Java JDK for windows, and use the applications in the BIN directory in the same way as I list out below.)

keytool -genkey -keysize 2048 -alias crushftp -keyalg RSA -keystore crushftp.keystore

You will be prompted for a password here...REMEMBER it!

Re-enter the password.

What is your first and last name?

Be sure to enter the domain name as it will appear in the browser. Do not enter your name.

  [Unknown]:  www.crushftp.com
What is the name of your organizational unit?
  [Unknown]:  server
What is the name of your organization?
  [Unknown]:  Ben Spink
What is the name of your City or Locality?
  [Unknown]:  YourCityHere
What is the name of your State or Province?
  [Unknown]:  YourStateHere
What is the two-letter country code for this unit?
  [Unknown]:  US
Is CN=www.crushftp.com, OU=server, O=Ben Spink, L=YourCityHere, ST=YourStateHere, C=US correct?

<i>***type "yes" if the above is accurate and correct</i><br/> no: yes<br/> Enter key password for -crushftp-<br/> <i>***do yourself a favor and use the same password (just hit return, or re-key it.)</i><br/> (RETURN if same as keystore password): <br/> <br/> </font> <b>PART 2</b><br/> That was the easy part. You now have a cert waiting to be signed. Now we get a certificate request that we give to GoDaddy to generate our certificate.<br/> <br/> <i>(" " indicates the beginning of a line, and " " indicates the end. You should not enter those two characters in terminal though.</i><br/> <br/> <font size="-2" face="courier"> keytool -certreq -keyalg RSA -alias crushftp -file crushftp.csr -keystore crushftp.keystore <br/> Enter keystore password: <br/> <i>***enter your password you used from above.</I><br/> <br/> </font> Now you take this resulting "crushftp.csr" file and copy its contents and paste into GoDaddy's CSR request page.<br/> <br/> <i>***KEEP your "crushftp.keystore" file! You must have it to finish the steps once you get your certificate from GoDaddy.</i><br/> <br/> <b>PART 3</b><br/> After completing the cert request through GoDaddy, you will be given a link to download your certificate package. This .zip file expands into a folder with the following files:<br/> gd_bundle.crt<br/> gd_cross_intermediate.crt<br/> gd_intermediate.crt<br/> www.crushftp.com.crt<br/> <br/> (Instead of www.crushftp.com.crt, you will have one corresponding to your domain.)<br/> You still need one more file. Go to GoDaddy to get their root certificate:<br/> https://certificates.starfieldtech.com/Repository.go<br/> <br/> Download the "valicert_class2_root.crt" file. Place it in the same folder with all the other certificates.<br/> <br/> Copy in your "crushftp.keystore" file created above in Part 1. Be sure to use a COPY in case anything goes wrong!<br/> <br/> Now use OS X terminal again to finish building your fully trusted certificate.<br/> <br/> <i>(" " indicates the beginning of a line, and " " indicates the end. You should not enter those two characters in terminal though.</i><br/> <br/> <font size="-2" face="courier"> <i>***import the root certificate</i><br/> keytool -import -alias root -keystore crushftp.keystore -trustcacerts -file valicert_class2_root.crt <br/> <i>***enter your password from above</i><br/> Trust this certificate? no: yes<br/> <i>***enter "yes"</i><br/> Certificate was added to keystore<br/> <br/> <i>***import the "cross" certificate</i><br/> keytool -import -alias cross -keystore crushftp.keystore -trustcacerts -file gd_cross_intermediate.crt <br/> <i>***enter your password from above</i><br/> <br/> <i>***import the "intermediate" certificate</i><br/> keytool -import -alias intermed -keystore crushftp.keystore -trustcacerts -file gd_intermediate.crt <br/> <i>***enter your password from above</i><br/> <br/> <i>***finally import your signed certificate which updates your pre-existing unsigned certificate</i><br/> keytool -import -alias crushftp -keyalg RSA -keystore crushftp.keystore -trustcacerts -file www.crushftp.com.crt <br/> <i>***substitute your certificates name instead of "www.crushftp.com.crt"</i><br/> <i>***enter your password from above</i><br/> <br/> </font> Now the resulting crushftp.keystore is a complete signed certificate chain. Place this file where ever you like, but that might as well be in the CrushFTP folder. Then go to the preferences of CrushFTP. Choose encryption on the left, then SSL. Browse and locate your crushftp.keystore file.<br/> <br/> For the passwords, enter in the password you used above everywhere. Set both the keystore password and the cert password. They should be the same as long as you followed directions above.<br/> <br/> Lastly, either restart CrushFTP, or choose stop all servers, start all servers to make the server items load the new certificate.<br/> <br/> If you already have a certificate for Apache, you may be able to convert it to a Java keystore and use it with CrushFTP. I provide this information untested, but it in theory looks like it would work.<br/> <a href="http://www.ks.uiuc.edu/Research/biocore/localServer/install/installCert.shtml">Install Apache Cert</a><br/>