Skip to main content

Gluu Server CE Cert import

🎯 Purpose

This guide explains how to securely fetch a self-signed or internal TLS certificate from your Gluu server (gluu.mslspartners.com), import it into the Java truststore, and restart Gluu services to establish trusted HTTPS communication internally.

🧰 Prerequisites

  • 🧑‍💻 Root or sudo access to the Gluu server
  • 🌐 Domain name of your Gluu server: gluu.mslspartners.com
  • 🔑 Java truststore password (default: changeit or custom)
  • 📦 Installed tools: openssl, keytool, awk

🚀 Step-by-Step Instructions

1️⃣ Create a Script File

nano /root/import-gluu-cert.sh

2️⃣ Paste the Script Below

#!/bin/bash

DOMAIN="gluu.mslspartners.com"
CERT_PATH="/etc/certs/gluu-full-chain.crt"
KEYSTORE_PATH="/opt/jre/lib/security/cacerts"
KEYSTORE_PASS="changeit"
ALIAS="gluu-remote"

echo "🔐 Fetching certificate from $DOMAIN..."
openssl s_client -showcerts -connect ${DOMAIN}:443 </dev/null \
  | awk '/BEGIN CERT/,/END CERT/ { print }' > "$CERT_PATH"

if [[ $? -ne 0 ]]; then
  echo "❌ Failed to retrieve certificate."
  exit 1
fi

echo "🗑️ Removing old certificate (if it exists)..."
keytool -delete -alias "$ALIAS" -keystore "$KEYSTORE_PATH" -storepass "$KEYSTORE_PASS" 2>/dev/null

echo "➕ Importing new certificate..."
keytool -import -alias "$ALIAS" \
  -keystore "$KEYSTORE_PATH" \
  -trustcacerts -file "$CERT_PATH" \
  -storepass "$KEYSTORE_PASS" -noprompt

echo "🔁 Restarting Gluu services..."
/root/restart-gluu.sh

echo "✅ Import complete!"

3️⃣ Make the Script Executable

chmod +x /root/import-gluu-cert.sh

4️⃣ Run the Script

/root/import-gluu-cert.sh

🔍 Verifying Certificate Import

📄 Check Certificate in Truststore:

keytool -list -keystore /opt/jre/lib/security/cacerts -storepass changeit | grep gluu-remote

🔐 Confirm Active Truststore:

/opt/jre/bin/java -XshowSettings:properties -version 2>&1 | grep trustStore

📆 Check Issuer and Subject:

openssl x509 -in /etc/certs/gluu-full-chain.crt -noout -issuer -subject

🛠 Troubleshooting

  • ❗ Trust path errors: Ensure the full certificate chain is present in gluu-full-chain.crt.
  • 📁 Missing file? Double-check /etc/certs/ exists and is writable.
  • 🔒 Permission denied? Make sure you’re running commands as root.
  • 📜 Service won't restart? Check logs under /opt/gluu/jetty/<component>/logs/.

📝 Notes

  • This method is tailored for internal/self-signed Gluu certificates.
  • For public CA certificates, ensure the full chain is valid and trusted by your system.
  • The script assumes a restart script exists at /root/restart-gluu.sh.
Back to top