Server-side certificate - Different KeyStore and Private Key passwords

[nhosko]

Hi,

I’ve followed the instructions on HowTos, on how to configure server-side TLS with HiveMQ and Keytool (selfsigned).

Step 1 is to create a hivemq.jks file using keytool, with password “changeme”:

keytool -genkey -keyalg RSA -alias hivemq -keystore hivemq.jks -storepass changeme -validity 360 -keysize 2048

After entering my infos and confirm the correct entries with yes, a new file is created on my computer.

How can I make the following step?

Determine the password for the newly generated key (It is highly recommended to use another password for the key than the key store itself)

For the moment, I skipped this step and my config.xml has to look like this in order for ssl to work:

<keystore>
    <path>hivemq.jks</path>
    <password>changeme</password>
    <private-key-password>changeme</private-key-password>
</keystore>

How can I have 2 different passwords for the keystore and for the private key?

[michael_w]

Hi @nhosko,

@nhosko

Determine the password for the newly generated key (It is highly recommended to use another password for the key than the key store itself)

Just replace the store password -storepass changeme with a password of your choice i.e. -storepass superSecurePassword.

Then the config would look like this:

<keystore>
    <path>hivemq.jks</path>
    <password>superSecurePassword</password>
    <private-key-password>superSecurePassword</private-key-password>
</keystore>

@nhosko

How can I have 2 different passwords for the keystore and for the private key?

This is currently not possible with the default store type (aka PKCS12) that keytool generates. If you would add -keypass customKeyPassword to your command for setting a key password:
keytool -genkey -keyalg RSA -alias hivemq -keystore hivemq.jks -storepass changeme -validity 360 -keysize 2048 -keypass customKeyPassword

The keytool would generate
Warning: Different store and key passwords not supported for PKCS12 KeyStores.
and ignore the key password.

The workaround is to replace the PKCS12 with the JKS type as keystore type: -deststoretype JKS

Example:
keytool -genkey -keyalg RSA -alias hivemq -keystore hivemq.jks -storepass changeme -validity 360 -keysize 2048 -keypass customKeyPassword -deststoretype JKS

Now you have separate passwords for key and keystore. Then the config would look like this:

<keystore>
    <path>hivemq.jks</path>
    <password>superSecurePassword</password>
    <private-key-password>customKeyPassword</private-key-password>
</keystore>

Greetings,
Michael