Generating OpenSSL-based self-signed certificate

Checking OpenSSL Version

You can check the version by selecting one of the two commands.

$ rpm -qa openssl 
$ openssl version

Private Key Generation

A private key is generated by setting the password after entering the command.

$ openssl genrsa -des3 -out xpush.key 2048

When entering the command, it will ask for the password as shown below.

$ keytool -importkeystore -destkeystore APNs-Certificates.jks
                           -srckeystore APNs-Certificates.p12 -srcstoretype PKCS12

Certificate Request Generation

A certificate request is required to apply for a certificate.

$ openssl req -new -key xpush.key -out xpush.csr

Specify the name of the certificate request, enter the command, then you will be asked for a password. After specifying the password, enter additional information.

Do not enter additional attribute information and press Enter twice to generate a certificate request.

Private Key Password Removal and Certificate Generation

If the key contains a password, it is recommended to remove the private key password and generate a certificate as it may ask for the password continuously when setting it on the web server.

$ cp xpush.key xpush.key.origin 
$ openssl rsa -in xpush.key.origin -out xpush.key

crt certificate can be generated through the private key xpush.key file and certificate request xpush.csr.

$ openssl x509 -req -days 365 -in xpush.csr -signkey xpush.key -out xpush.crt

X-PUSH server supports encrypted communication with clients and SSL protocol can be used by setting Certificate Service through jks file.

JKS Certificate File Generation

You can generate a .jks certificate file with the command below.

$ keytool -genkey -v -keystore xpush.jks -alias server_private -keyalg RSA -sigalg MD5withRSA -keysize 1024 -validity 365

Converting PKCS12 file to JKS format

When sending Notification to APNs from JDK 1.7 or higher, an SSL related error may occur or InvalidToken error code may be received from APNs. This can be solved by converting the APNs certificate file from PKCS12 format to JKS format.

APNs certificate file can be converted using the keytool included in the JDK and the keytool is located in the bin directory of the path where JDK is installed.

The example below shows an example command to convert the APNs-Certificates.p12 file to the APNs-Certificates.jks file using the keytool.

$ keytool -importkeystore -destkeystore APNs-Certificates.jks
                           -srckeystore APNs-Certificates.p12 -srcstoretype PKCS12

When entering the command, it will ask for the password as shown below.

Enter destination keystore password:
Re-enter new password:
Enter source keystore password:

Generate the certificate by entering the password of the JKS format certificate to be created, reentering the password, and entering the original certificate password of PKCS12 format in order.

The figure below shows an example of converting APNs-Certificates.p12 file to APNs-Certificates.jks file using the keytool.

Set the converted JKS format certificate as follows.
Change the KeystoreType item to JKS to match the certificate format.

<service name="ApnsNotifierService" ... >
	...
	<attribute name="KeystorePath">conf/APNs-Certificates.jks</attribute>
	<attribute name="KeystorePassword">xpush</attribute>
	<attribute name="KeystoreType">JKS</attribute>
	<attribute name="production">false</attribute>
	<attribute name="badge">true</attribute>
	<attribute name="retries">3</attribute>
	...
</service>

Generating APNS Certificate

Accessing Apple Developer Center

Select the Account menu to log in

Generating Certificate

Generating CSR (Certificate Request)

Certificate generation completed

Exporting APNS Certificate in .p12 Format

Renewing APNS Certificate