keytool : Generate cacert ( server cert ) from URL and port (SSL from AWS ACM)

If we need to manage keys and certificates in Java, we need a keystore, which is simply a secure collection of aliased entries of keys and certificates. OpenJDK on CentOS stores it’s root CA’s in the file ‘*/usr/lib/jvm/java--openjdk-1.x86_64/jre/lib/security/cacerts*‘. The ‘cacerts’ in keystore will be used by Java application to validate ssl.

Default Command: keytool -keystore cacert -import -alias mydomain..crt -file mydomain.crt -storepass changeit

How to generate cacert for AWS ACM SSL

First configure a URL which you can access from your local machine. Ensure that you have keytools installed in your local machine and have bash script access. Run following bash script to generate cacerts

cagenerator.sh
----------------------

#/bin/bash
HOST=thisismydomain.com
PORT=443
KEYSTOREFILE=cacert
KEYSTOREPASS=changeme

# Retrieve SSL certificate from remote server
openssl s_client -connect ${HOST}:${PORT} </dev/null \
    | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${HOST}.cert

# Generate a keystore and import certificate
keytool -import -noprompt -trustcacerts \
    -alias ${HOST} -file ${HOST}.cert \
    -keystore ${KEYSTOREFILE} -storepass ${KEYSTOREPASS}

# Verify Vertificate generated
keytool -list -v -keystore ${KEYSTOREFILE} -storepass ${KEYSTOREPASS} -alias ${HOST}

https://cloudops-guru.in/2020/08/11/keytool-generate-cacert-server-cert-from-url-and-port-ssl-from-aws-acm/