OK, through much trial and error, this is what I found. References at the end of articles and posts that helped me. This is for GoDaddy, but I suppose something similar would work for other providers.
GoDaddy gave me the following files:
-rw-rw-r--. 1 wmsodbc wmsV9 1728 Jul 14 09:20 gdig2.crt.pem
-rw-rw-r--. 1 wmsodbc wmsV9 4795 Jul 14 09:20 gd_bundle-g2-g1.crt
-rw-rw-r--. 1 wmsodbc wmsV9 2403 Jul 14 09:20 ddd1343aff339165.pem
-rw-rw-r--. 1 wmsodbc wmsV9 2403 Jul 14 09:20 ddd1343aff339165.crt
In looking online, I know that gdig2 file is the intermediate certificate and bundle has the root and the intermediate certificates. This post suggected breaking out the root and intermediate certificates, but it was easier to just go to godaddy repository and download the root certificate using curl https://ssl-ccp.godaddy.com/repository/gdroot-g2.crt > gdroot-g2.crt
.
Steps:
- Make copy of current keystore, called keystore.2020Renewal below
- Remove root alias with
sudo keytool -storepass <password> -delete -alias root -keystore keystore.2020Renewal
- Remove intermed alias with
sudo keytool -storepass changeit -delete -alias intermed -keystore keystore.2020Renewal
- Import root using
sudo keytool -storepass <password> -import -alias root -keystore keystore.2020Renewal -trustcacerts -file ~/tempCerts/gdroot-g2.crt
- Import intermediate using
sudo keytool -storepass <password> -import -alias intermed -keystore keystore.2020Renewal -trustcacerts -file ~/tempCerts/gdig2.crt.pem
- Import main certificate using
sudo keytool -import -alias tomcat -keystore keystore.2020Renewal -storepass <password> -file ~/tempCerts/ddd1343aff339165.crt
- Change server.xml to use this new keystore
- Restart tomcat to make sure changes take effect
The last time I did this, I think I did something similar. So this should work with at least a few tomcat related SSL renewal situations.
Tomcat reference (partially useless since they don't handle "renewal", only initial setup, but decent starting point)
Update 2022:
I was able to follow the above steps again, with success. Based on another posting, I did try to keytool -delete -alias tomcat -keystore <keystore copy>
(after step 3 above), but the resulting keystore when I imported the root, intermed, and new certificate was smaller, and did not work. Basically, I had two copies of the key store, one where I removed root, intermed, and tomcat, and then imported the new ones in the proper order. The other where I followed the directions above. This second one worked without any problem, the first one kept giving me HTTP 401 errors in the access logs. So, in conclusion, in theory following the above directions will still work, as of 2022.