Page Comparison

CIS-CAT Pro Dashboard v3 supports the following two file types / formats for organizational certificates:

• .p12 (PKCS 12)

• .jks (Java Key Store)

Below are some potential challenges encountered when applying these to the application, and suggested solutions.

Frequently Asked Questions

My certificate is not in .p12 or .jks format

If your current certificate file includes a Private Key, you may be able to convert it into .p12 / .jks format, and several guides and tools to do so can be found online. As the CIS Product Support team cannot assist with organizational certificate conversions or any resulting errors, please contact your certificate provider (such as DigiCert) or your certificate administrator if you require further assistance.

I receive an “Alias does not identify a key entry” error and Tomcat does not start

The certificate Alias provided during installation has to match the one contained in the cert exactly, or Tomcat will not be able to utilize it and return this error message.

The certificate Alias can be shown using the Java keytool, which is installed by default with any JRE/JDK, and a copy of which can be found in the Dashboard \jre\bin\ directory. Run the following command from an elevated command prompt:

keytool -v -list -keystore C:\certs\mycert.jks
(where C:\certs\mycert.jks is the path to your .p12 or .jks certificate)

The output will show the Alias under “Alias name”:

In this example, the Alias name is “db31cert”.

Chrome displays “Not Secure” and returns an “ERR_CERT_COMMON_NAME_INVALID“

or “Subject Alternative Name Missing“ Error

The ERR_CERT_COMMON_NAME_INVALID SSL error can occur with a valid and non-expired certificate if it does not contain a SAN (Subject Alternative Name), which Google Chrome requires with for all newer browser versions. You can view the exact certificate error details by opening the Dashboard page in Chrome, then accessing Developer Tools (Control + Shift + I on Windows) and selecting the “Security” tab.The below Digicert resource explains what this record is and how to check for it

The DigiCert page linked below includes further details on this record:
https://www.digicert.com/faq/subject-alternative-name.htmThis StackOverflow thread deals with the topic and offers several methods on remedying it during certificate creation:
https://stackoverflow.com/questions/43665243/invalid-self-signed-ssl-cert-subject-alternative-name-missing

You can view the certificate rejection cause by opening your Dashboard webpage in Chrome, then accessing Developer Tools (Control + Shift + i on Windows) and selecting the "Security" tab.

Image Added

Importing a .p12 Certificate to the Java Trust Store returns “Not an X.509 Certificate“

This error can occur if the .p12 file is encrypted with a password , and its content cannot be read without supplying the password or passphrase. To have the Java keytool prompt you for the source keystore password, use the following command:

keytool -v -importkeystore -srckeystore C:\certs\mycert.p12 -srcstoretype PKCS12 -destkeystore "C:\Program Files\CCPD\jre\lib\security\cacerts" -deststoretype JKS

• -srckeystore is the path to your .p12 certificate to be imported (in this example, C:\certs\mycert.p12)

• -destkeystore is the path to your Dashboard cacerts keystore, typically found in \jre\lib\security\

This command will prompt for the destination Dashboard keystore password (which is changeit by default), followed by your source keystore password.

Please see here for instructions on Replacing Expired Dashboard TLS Certificate

Content by Label