Once the new certificate has been installed on all appropriate applications and client devices, the keystore can be installed on the SAKA. In order for the new certificate to be utilized, the Glassfish Application Server on the Appliance must be restarted which implies a short downtime on the Appliance.
Sites may continue processing on secondary SAKA nodes during this downtime if they are capable of changing their applications to those SAKA. Otherwise, a 15-30 minute downtime window will be necessary for each SAKA as it is restarted and Key Custodian PINs are set.
shell> cd /usr/local/strongauth/<payara-version>/glassfish/domains/domain1/config
For Payara6, use the following command: shell> mv keystore.p12 keystore.p12.org For Payara5, use the following command: shell> mv keystore.jks keystore.jks.org
For Payara6, use the following command: shell> mv /usr/local/strongauth/keystore.p12 . For Payara5, use the following command: shell> mv /usr/local/strongauth/keystore.jks .
For Payara6, use the following command: shell> keytool -import -keystore cacerts.p12 -storepass changeit -alias saka.domain.name -file /usr/local/strongauth/saka.domain.name.crt For Payara5, use the following command: shell> keytool -import -keystore cacerts.jks -storepass changeit -alias saka.domain.name -file /usr/local/strongauth/saka.domain.name.crtIf the alias 'saka.domain.name' already exists in the truststore, it is safe to choose any other alias that does not already exist in the truststore.
shell> keytool -import -keystore /usr/local/strongauth/certs/cacerts -storepass changeit -alias saka.domain.name -file /usr/local/strongauth/saka.domain.name.crt
If the alias 'saka.domain.name' already exists in the truststore, it is safe to choose any other alias that does not already exist in the truststore.For Payara6, use the following command: shell> sudo systemctl restart payara For Payara5, use the following command: shell> sudo service glassfishd restart
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target