Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry Enterprise Mobility Server 3.7
  3. Configuring BEMS-Core
  4. Importing and configuring certificates
  5. Replacing the autogenerated SSL certificate
  6. Steps to replace the autogenerated SSL certificate with a self-signed certificate for one BEMS node
  7. Create a new keystore, generate a CSR request, and obtain a signed certificate from a CA

Create a new keystore, generate a CSR request, and obtain a signed certificate from a CA

  1. If necessary, verify that the PATH system variable includes the path to the
    Java
     bin directory.
    1. In a command prompt, type
      set | findstr "Path"
      .
    2. Press
      Enter
      .
    For instructions to set the Path system variable, see 'Configure the Java Runtime Environment' in the installation content.
  2. On the computer that hosts
    BEMS
    , create a temporary folder (for example,
    C:\bemscert
    ).
  3. Create a new
    Java
     keystore and key pair.
    1. Open a command prompt.
    2. Navigate to the folder that you created in step 1.
    3. Type
      keytool -genkeypair -alias serverkey -keyalg RSA -keystore bemsnew.pfx -storetype PKCS12 -keysize 2048 -dname "CN=<
      FQDN of BEMS host
      >, OU=<
      BEMS name
      >, O=<
      domain
      >, L=<
      location
      >, S=<
      state or province
      >, C=<
      country
      >" -validity <
      number of days before the certificate expires
      > -storepass <
      mystorepassword
      >
      .
      For example,
      keytool -genkeypair -alias serverkey -keyalg RSA -keystore bemsnew.pfx -storetype PKCS12 -keysize 2048 -dname "CN=BEMShost.example.net, OU=BEMShost, O=example, L=Waterloo, S=Ontario, C=CA" -validity 730 -storepass mystorepasssword
      For more information about keystore commands, see Keystore commands.
    4. Press
      Enter
      .
    5. Type a password for the serverkey certificate's private key. To set the serverkey password to be the same as the keystore password, press
      Enter
      .
    6. Optionally, to view the contents of the certificate before you submit it to a CA, type
      keytool -list -v -keystore bemsnew.pfx -storetype PKCS12 -storepass <
      mystorepassword
      >
  4. Generate a CSR for the
    BEMS
    Java
     keystore. In the command prompt, type
    keytool -certreq -alias serverkey -file bemsnewcert.csr -keystore bemsnew.pfx -storetype PKCS12 -storepass <
    mystorepassword
    > -keypass <
    mykeypassword
    >
    If the serverkey password and the keystore password are the same, type
    keytool -certreq -alias serverkey -file bemsnewcert.csr -keystore bemsnew.pfx -storetype PKCS12 -storepass <
    mystorepassword
    > -keypass <
    mystorepassword
    >
  5. Submit the CSR to a CA.
  6. Receive the CA-signed certificate from the CA and save it to the folder that you created in step 1.
  7. Import the CA-signed certificate to the request. In the command prompt, type
    keytool -importcert -keystore bemsnew.pfx -storetype PKCS12 -storepass <
    mystorepassword
    > -file <"
    certificate filename received in step 5
    "> -alias serverkey
    For example,
    keytool -importcert -keystore bemsnew.pfx -storetype PKCS12 -storepass mystorepassword -file "bemsnew certnew.cer" -alias serverkey
  8. View the new contents of the keystore, type
    keytool -list -v -keystore bemsnew.pfx -storetype PKCS12 -storepass <
    mystorepassword
    >