====== Creating Cert ======
===== CA Private Public Keys =====
In the real word we do not have to create those. There are CAs in this world that will sign our Certificate Signing Request (csr) with charge. But for privately use, we might need so. We will use openssl for doing so.
Private Key:
<code>openssl genrsa -aes256 -out ca.key 4096</code>
Public Key:
<code>openssl req -new -x509 -days 365 -key ca.key -out ca.crt</code>

===== Server Private Key and CSR =====
We need to generate private key, and the corresponding CSR. 
<code>openssl req -newkey rsa:2048 -nodes -keyout server.key -out server.csr</code>
===== Server Public Key =====
At this point in the real world, we need to send the csr to the CA to sign for the server public key, and the CA will do the rest, and then send us back the signed public key.

But for a self signed one, we need to DIY:
<code>openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt</code>


===== Convert Key from PEM format to PKCS12 =====
Now that we have the server.crt, server.key, and the CA's public cert, we can convert it to pkcs12 format for, JBOSS, web browser for instance.

<code>openssl pkcs12 -export -out server.p12 -inkey server.key -in server.crt -certfile ca.crt</code>

===== Adding CA Public Certificate to Java Keystore =====
Java provides keytool binary for cert related functions, and once of those is to import cert to java default keystore. Assume the location of the default keystore is ''C:\Java\jdk1.8.0_191\jre\lib\security\cacerts'', and assume we are in the directory where the CA public cert file ca.crt. Open the command prompt with ''Administrator'' rights.
<code>keytool -import -file ca.crt -keystore C:\Java\jdk1.8.0_191\jre\lib\security\cacerts</code>
It will ask for the keystore password, and the default one is ''changeit''. It will also ask you to confirm to import the cert file. Make sure you answer ''Yes''.

===== Create a Java Truststore from CA.crt =====
<code>keytool -import -file ca.crt -alias myCA -keystore ca.trustStore</code>

===== Cer to Crt (DER encode to PEM)=====
One the cer file, if it start with ''-----BEGIN CERTIFICATE-----'', just rename it, else do:
<code>openssl x509 -inform DER -in ssl_certificate.cer -out ssl_certificate.crt</code>

===== Crt to Cer (PEM to DER)=====
<code>openssl x509 -in cert.crt -outform der -out cert.cer</code>
===== Trouble Shooting =====
  - Can't open config file: /usr/local/ssl/openssl.cnf<code>set OPENSSL_CONF=C:\.........\apache\Apache2.4.4\conf\openssl.cnf</code>
  - unable to write 'random state' for windows <code>set RANDFILE=.rnd</code>
  - unable to write 'random state' for linux <code>sudo rm ~/.rnd</code>
  - Check the CRT file <code>openssl x509 -in certificate.crt -text -noout</code>, and you will see the details of the crt display on screen
  - Check the CRS file <code>openssl req -text -noout -verify -in CSR.csr</code>, and you will see the details of the csr display on screen