Skip to main content

Gluu Server CE Cert import

🎯 Purpose

This guide outlines the process to securely log into the Gluu Server virtual machine (VM), retrieve the Gluu server's TLS certificate, import it into the Java truststore, and restart services to enable trusted internal HTTPS communication.

🔐 Logging into the Gluu VM

  1. 🖥️ Open a terminal or SSH client on your admin machine.
  2. 🔌 Connect to your Gluu Server via SSH: 
    ssh root@your-gluu-server-ip
  3. 💡 If Gluu is running locally (e.g., in Proxmox/XCP-ng), log in via the hypervisor console directly as root.

🧰 Prerequisites

  • Root or sudo access to the Gluu VM
  • Domain name of Gluu: gluu.mslspartners.com
  • Java truststore password (default: changeit or custom)
  • Tools: openssl, keytool, awk

🚀 Step-by-Step Instructions

1️⃣ Create the Script

nano /root/import-gluu-cert.sh

2️⃣ Paste the Script Below

#!/bin/bash

DOMAIN="gluu.mslspartners.com"
CERT_PATH="/etc/certs/gluu-full-chain.crt"
KEYSTORE_PATH="/opt/jre/lib/security/cacerts"
KEYSTORE_PASS="changeit"
ALIAS="gluu-remote"

echo "🔐 Fetching certificate from $DOMAIN..."
openssl s_client -showcerts -connect ${DOMAIN}:443 </dev/null \
  | awk '/BEGIN CERT/,/END CERT/ { print }' > "$CERT_PATH"

if [[ $? -ne 0 ]]; then
  echo "❌ Failed to retrieve certificate."
  exit 1
fi

echo "🗑️ Removing old certificate (if any)..."
keytool -delete -alias "$ALIAS" -keystore "$KEYSTORE_PATH" -storepass "$KEYSTORE_PASS" 2>/dev/null

echo "➕ Importing new certificate..."
keytool -import -alias "$ALIAS" \
  -keystore "$KEYSTORE_PATH" \
  -trustcacerts -file "$CERT_PATH" \
  -storepass "$KEYSTORE_PASS" -noprompt

echo "🔁 Restarting Gluu services..."
/root/restart-gluu.sh

echo "✅ Import and restart complete!"

3️⃣ Make the Script Executable

chmod +x /root/import-gluu-cert.sh

4️⃣ Run the Script

/root/import-gluu-cert.sh

🔍 Verifying Certificate Import

🧾 Check Truststore Entry:

keytool -list -keystore /opt/jre/lib/security/cacerts -storepass changeit | grep gluu-remote

🔒 Check Active Truststore in Java:

/opt/jre/bin/java -XshowSettings:properties -version 2>&1 | grep trustStore

📛 Confirm Issuer/Subject:

openssl x509 -in /etc/certs/gluu-full-chain.crt -noout -issuer -subject

🛠 Troubleshooting

  • ❗ SSL Errors: Usually mean the cert isn't trusted. Double-check import step.
  • 🔒 Permission Denied: Ensure you're running as root.
  • 🧱 Service Not Restarting: Review logs in /opt/gluu/jetty/<app>/logs/.

📘 Notes

  • This guide is for internal/self-signed Gluu certificates.
  • Public CA certs usually don’t require this step unless using a non-standard CA.
  • The script assumes a restart script exists at /root/restart-gluu.sh.

🔑 Step 1: SSH intoInto the Host ServerMachine

UseFrom SSHyour tolocal terminal, connect to your Gluu server:server host:

ssh root@your-gluu-server-ip

Replace your-gluu-server-ip with theyour actual IP address or hostname.

🧭📦 Step 2: EnterLog In to the Gluu Chroot Environment

ToGluu manageruns Gluu,inside youa mustchroot entercontainer. theEnter isolatedit environment:with:

/sbin/gluu-serverd login

OnceYou’ll inside,know youyou're willinside seewhen theyour prompt change,changes (e.g.:

, 
[gluu@gluu ~]#
).

📂📁 Step 3: Navigate tothe Gluu DirectoriesFile Structure

ComponentsCore like oxAuth, Identity, IDP, etc.,services are found under:

cd /opt/gluu/jetty/
  • oxauth: OAuth2/OpenID Connect Provider
  • identity: Admin UI (oxTrust)
  • idp: SAML IDP
  • scim: SCIM User Management
  • fido2: FIDO2 Service
  • casa: User Self-Service Portal

📊📜 Step 4: CheckView Logs for Troubleshooting

To viewCheck the lastmost 50recent log lines offor a service'sservice. logExample file, run:(oxAuth):

tail -n 50 /opt/gluu/jetty/oxauth/logs/oxauth.log

Replace oxauth with the appropriate service name as needed.

♻️🔁 Step 5: Restart Gluu Services

If

Option youA: haveUsing a restart script:

Script

/root/restart-gluu.sh

Or

Option restartB: specificManual servicesService manually:

Restart


cd /opt/gluu/jetty/oxauth &&
nohup java -jar ../../jetty/start.jar > oxauth.log 2>&1 &

Repeat for other services like identity, idp, etc.

🔒🔍 Step 6: VerifyCheck Running Java Trust StoreServices

keytool
Use -listthis -keystoreto /etc/ssl/certs/java/cacertsverify -storepassif 'changeit'services |are grep gluu

🚦 Step 7: Check Java Processes

active:

ps aux | grep java | grep -v grep

💡🔐 Tip:Step 7: Verify Java Truststore for Certificates

Ensure custom certs are loaded:

keytool -list -keystore /etc/ssl/certs/java/cacerts -storepass 'your-password' | grep gluu

🚪 Step 8: Exit the Gluu Chroot Environment

To return to the regular Linux shell:

exit

This returns you to the main server shell.

✅📝 Summary

  • Login:🛠️ Use /sbin/gluu-serverd login to manage Gluu internals
  • Services:🧭 LocatedServices inlocated at /opt/gluu/jettyjetty/
  • Logs:📈 Logs help debug services under /logs
  • 🔐 Use tailkeytool to inspect
    • verify
  • Restart:Java Usetruststore script or start.jar per service
  • Truststore: Managed with keytoolcertificates

🔧💡 ForTip: persistentAlways issues,ensure validate SSLyour certificates andare inspecttrusted oxauth.logby andthe oxtrust.log.JVM for SSL-based connections to succeed!

Back to top