Starting from the beginning :#

Use Portecle's GUI to make a Keystore <---click here#

Renewing a certificate :#

Use Portecle's GUI to make a Keystore <---click here#

Alternate methods for bringing in a cert from another server:
  • Apache - If you already have a certificate for Apache, follow these instructions for converting it.

  • OS X Server - Export the private key using keychain. You will need to run keychain using root access to be able to export the certificate.
sudo "/Applications/Utilities/Keychain Access"
Then use Portecle to add in the missing certificate that go along with the chain to trust the private key's signature. For GoDaddy, that means downloading the valicert, cross and intermediate cert.

These below instructions are complicated and shouldn't be used unless you just can't stand using Portecle for some strange reason.

  • Java - When purchasing a certificate from a cert authority, be sure to choose 'Tomcat' for the format.

  • PART 1 (Command Line)
(I am going to use GoDaddy for my example, but the same would be similar for other certificate authorities as well.)

Here are the commands I issued from an OS X terminal: (These commands work on windows, linux, etc. They are Java commands, and not OS X commands. Download a Java JDK for windows, and use the applications in the BIN directory in the same way as I list out below.)

keytool -genkey -keysize 2048 -alias crushftp -keyalg RSA -keystore crushftp.jks
You will be prompted for a password here...REMEMBER it!

Re-enter the password.

What is your first and last name?

Be sure to enter the domain name as it will appear in the browser. Do not enter your name.

What is the name of your organizational unit?
  [Unknown]:  server
What is the name of your organization?
  [Unknown]:  Ben Spink
What is the name of your City or Locality?
  [Unknown]:  YourCityHere
What is the name of your State or Province?
  [Unknown]:  YourStateHere
What is the two-letter country code for this unit?
  [Unknown]:  US
Is, OU=server, O=Ben Spink, L=YourCityHere, ST=YourStateHere, C=US correct?
  [no]:  yes
Type "yes" if the above is accurate and correct.
Enter key password for -crushftp-
  (RETURN if same as keystore password):
Do yourself a favor and use the same password (just hit return, or re-key it.)
  • PART 2

You now have a self singed cert waiting to be signed by a certificate authority. Now we get make a certificate request that we give to GoDaddy to sign.

keytool -certreq -keyalg RSA -alias crushftp -file crushftp.csr -keystore crushftp.jks

Enter keystore password:
Enter your password you used from above.

Now you take this resulting "crushftp.csr" file and copy its contents and paste into GoDaddy's CSR request page.

  • PART 3

WARNING! Keep your "crushftp.jks" file! (Make a backup of it just in case you make a mistake in step 3.) You must have this original keystore file to apply the signed certificate GoDaddy gives back.

After completing the cert request through GoDaddy, you will be given a link to download your certificate package. This .zip file expands into a folder with the following files:


(Instead of, you will have one corresponding to your domain.)

You still need one more file. Go to GoDaddy to get their root certificate:

Download the "valicert_class2_root.crt" file. Place it in the same folder with all the other certificates.

Copy in your "crushftp.keystore" file created above in Part 1. Be sure to use a COPY in case anything goes wrong, you can go back to your backup you made!

Now a few more command lines to finish building your fully trusted certificate. The password is the one from part 1.

keytool -import -alias root -keystore crushftp.jks -trustcacerts -file valicert_class2_root.crt
Trust this certificate? [no]:  yes
Certificate was added to keystore
keytool -import -alias cross -keystore crushftp.jks -trustcacerts -file gd_cross_intermediate.crt
Trust this certificate? [no]:  yes
Certificate was added to keystore
keytool -import -alias intermed -keystore crushftp.jks -trustcacerts -file gd_intermediate.crt ]
Trust this certificate? [no]:  yes
Certificate was added to keystore
Finally import your signed certificate which updates your pre-existing unsigned certificate.
keytool -import -alias crushftp -keyalg RSA -keystore crushftp.jks -trustcacerts -file
(Substitute your certificate's name instead of "".)
Now the resulting crushftp.keystore is a complete signed certificate chain. Place this file in the CrushFTP folder. Then go to the preferences of CrushFTP. Choose encryption on the left, then SSL. Browse and locate your crushftp.keystore file.

For the passwords, enter in the password you used above everywhere. Set both the keystore password and the cert password. They should be the same as long as you followed directions above.

Lastly, either restart CrushFTP, or choose stop all servers, start all servers to make the server items load the new certificate.

Add new attachment

Only authorized users are allowed to upload new attachments.
« This page (revision-18) was last changed on 09-Oct-2016 18:14 by Ben Spink
G’day (anonymous guest)


New: CrushFTPv9#


CrushFTP8 | What's New

Referenced by