Untitled | DataStax Enterprise

Importing the Signed Certificate into the Node Keystore

For each node in the cluster, create a keystore and import the signed certificate. The variables that you enter in the following commands must match the information that you entered in Creating a key and certificate for each node.

Procedure

Import the root certificate (rootca.crt) into each node’s keystore:

You created the root certificate when Creating a truststore for all nodes.
```
keytool -keystore <node-keystore.jks> \
-alias <rootca_name> \
-importcert -file '<path/to/rootca.crt>' \
-keypass <keystore_password> \
-storepass <truststore_password> \
-noprompt
```
rootca_name
Name (alias) used to identify the root certificate when importing into the node’s keystore. For example, in a rootca.conf file, the CN = CA_CN entry shown in Creating a root CA certificate.
If the signed certificate for the node is imported before the root certificate, an error occurs:

keytool error: java.lang.Exception: Failed to establish chain from reply
Import the node’s signed certificate (signing_request.crt_signed) into the corresponding keystore on the node:
```
keytool -keystore <node-keystore.jks> \
-alias <node_name> \
-importcert -file <signing_request.crt_signed> \
-keypass <node-key_password> \
-storepass <keystore_password> \
-noprompt
```
The alias <node_name> must match the alias name used to generate the signing request. See Creating a key and certificate for each node.

Confirmation of the installation appears:
```
Certificate was added to keystore
```

Verify your keystore again, which should now contain two entries. One entry is for the node keystore, and the other for the imported root certificate:

keytool -list \
-keystore <node-keystore.jks> \
-storepass <truststore_password>

Each keystore entry is identified by the name you entered for the -alias:

Keystore type: jks
Keystore provider: SUN

Your keystore contains 2 entries

<node_name>, Aug 8, 2019, trustedCertEntry,
Certificate fingerprint (SHA1): <SHA1-hash>
<rootca_name>, Aug 8, 2019, trustedCertEntry,
Certificate fingerprint (SHA1): <SHA1-hash>

Repeat the previous steps on each node to import the root certificate, and then import the signed certificate into the keystore.

Importing the Signed Certificate into the Node Keystore

Procedure

Was this helpful?

Give Feedback