Expired certificate payara5

Technical Discussion
1

I’m running payara5 for the Dataverse repository software. The certificate has expired and I’ve tried importing a new one but getting error:
NCLS-ADMIN-00010
javax.net.ssl.SSLHandshakeException: NotAfter: Sun Aug 18 13:30:10 UTC 2024

Do I need to delete or remove expired certificates before the new ones are used. I’ve followed the directions from:
https://docs.payara.fish/community/docs/5.201/documentation/payara-server/server-configuration/ssl-certificates.html

Thank you in advnace,
Jamie

2

Hello,

I like to use the Keystore Explorer for this. This allows you to simply delete your certificates located in the /glassfish/domains/domain1/config folder and add the newly created certificates.
I hope that helps a bit.

Steven

3

Yes, that is very helpful. I have keystore explorer installed locally and will try that out.

4

I tried keystore. It looks really helpful but my payara server is headless so until I get around that problem I won’t be able to use keystore.

But thank you for the suggestion.

5

Hi Jamie,

You can proceed to remove the expired certificates by using the following keytool command -

keytool -delete -alias cert-alias -keystore /path/to/keystore -storepass password.

Or you can use the following asadmin command to remove all the expired certificates from the domain mydomainname -

asadmin remove-expired-certificates --domainname mydomainname

Then, you can import the new certificates using the following commands -

To add the certificate to the Keystore using the keytool command -

keytool -importkeystore -destkeystore keystore.p12 -srckeystore mycert.p12 -srcstoretype PKCS12 -alias cert-alias

To add the certificate to the Keystore using Asadmin command -

asadmin add-to-keystore --file mycert.p12 cert-alias

To add the certificate to the Truststore using keytool command -

keytool -importcert -trustcacerts -destkeystore cacerts.jks -file mycert.crt -alias cert-alias

To add the certificate to the Truststore using Asadmin command -

asadmin add-to-truststore --file mycert.crt cert-alias

For more information, please refer to the following blog post -

Thanks & regards
Ramya

1 Like