**DRAFT** Dashboard v3 Certificate Considerations

CIS-CAT Pro Dashboard v3 supports the following two file types / formats for organizational certificates:

• .p12 (PKCS 12)

• .jks (Java Key Store)

Below are some potential challenges encountered when applying these to the application, and suggested solutions.

How do I identify the “Alias” of my Certificate?

The certificate Alias can be shown using the Java keytool, which is installed by default with any JRE/JDK, and a copy of which can be found in the Dashboard \jre\bin\ directory. Run the following command from an elevated command prompt:

keytool -v -list -keystore C:\certs\mycert.jks
(where C:\certs\mycert.jks is the path to your .p12 or .jks certificate)

The output will show the Alias under “Alias name”:

In this example, the Alias name is “db31cert”.

Chrome returns an “ERR_CERT_COMMON_NAME_INVALID“ error or “Subject Alternative Name Missing“

The ERR_CERT_COMMON_NAME_INVALID SSL error can occur with a valid and non-expired certificate if it does not contain a SAN (Subject Alternative Name), which Google Chrome requires with all newer browser versions. You can view the exact certificate error details by opening the Dashboard page in Chrome, then accessing Developer Tools (Control + Shift + I on Windows) and selecting the “Security” tab.

The below Digicert resource explains what this record is and how to check for it:
https://www.digicert.com/faq/subject-alternative-name.htm

This StackOverflow thread deals with the topic and offers several methods on remedying it during certificate creation:
https://stackoverflow.com/questions/43665243/invalid-self-signed-ssl-cert-subject-alternative-name-missing

Importing a .p12 Certificate to the Java Trust Store returns “Not an X.509 Certificate“

This error can occur if the .p12 file is encrypted with a password and its content cannot be read. To have the Java keytool prompt you for the source keystore password, use the following command:

keytool -v -importkeystore -srckeystore C:\certs\mycert.p12 -srcstoretype PKCS12 -destkeystore "C:\Program Files\CCPD\jre\lib\security\cacerts" -deststoretype JKS

• -srckeystore is the path to your .p12 certificate to be imported (in this example, C:\certs\mycert.p12)

• -destkeystore is the path to your Dashboard cacerts keystore, typically in \jre\lib\security\

This command will prompt for the destination Dashboard keystore password (changeit by default), followed by your source keystore password.

Content by Label

• Page:
  Feature Enhancement Requests for CIS Products