How to install SSL certificate in AssetExplorer

How to install SSL certificate in AssetExplorer

SSL Installation


Do you have a Wildcard or a Multi-domain certificate already running in your other servers and want to reinstall in on AssetExplorer server ?, then click here to find how to export SSL certificate using MMC. 


Do you already have a .PFX certificate handy?, then click 
here for install instructions.  




This article is for installing SSL certificate in AssetExplorer by creating a Keystore using bundled Java Keytool.



AssetExplorer can run as a HTTPS service. But it requires a SSL (Secure Socket Layer) Certificate signed by a valid Certificate Authority (CA).
By default, on first time startup, it creates a self-signed certificate. This self-signed certificate will not be trusted by the user browsers. Thus, while connecting to AssetExplorer, you need to manually verify the certificate information and the hostname of AssetExplorer server carefully and should force the browser to accept the certificate. 
To make AssetExplorer  server identify itself correctly to the web browser and the user, you need to obtain a new signed certificate from a CA for the AssetExplorer  host.







You can use keytool (bundled with Java) to create your certificates, get them signed by a CA and use them with AssetExplorer. 

The steps involved in configuring AssetExplorer  to use the SSL are as given below.








Step 1: Create a Keystore file
Step 2: Create .CSR (Certificate Signing Request) file
Step 3: Install your SSL Certificate
Step 4: Configuring the server 







NOTE: In all the images, replace the highlighted text with the alias name you want to use for the AssetExplorer





Step 1: Create a Keystore file



Before requesting for a certificate from a CA, you need to create tomcat specific ".keystore" file and ".csr" file. 
The .keystore file and .csr file will include information provided by the individual who creates the .keystore and .csr files. 
To create the .keystore file follow the below steps,
Open the Command Prompt From the location [AE-Home] \ jre \ bin execute the command





If your vendor requires a CSR of size 2048 please use the command given below.


  1. keytool -genkey -alias <your_alias_name> or [Domain Name] -keyalg RSA -keysize 2048 -keystore sdp.keystore 




  1. You will then be prompted to choose a password for your keystore.
    NOTE: Please note that the Password should not contain $ symbol.
  2. When it asks for first and last name, this is NOT your first and last name, but rather it is your Fully Qualified Domain Name for the site you are securing.  

  1. If you are ordering a Wildcard Certificate this must begin with the * character.


  1. On entering the required information, confirm that the information is correct by entering 'y' or 'yes' when prompted. (img5.jpg)
  2. At the end of executing the above command, you will be prompted to enter keystore password. Try giving the password same as your key password. Make sure to remember the password you choose.

  3. Your keystore file named sdp.keystore is now created in your current working directory.

NOTE: We request you to make a backup copy of the sdp.keystore file before installing the Certs. This backed up keystore can be used if the certificate installation goes wrong or when you renew your certificates the next year.


Step 2: Creating .CSR (Certificate Signing Request) file



The .CSR (Certificate Signing Request) file is temporary and should be submitted to a CA to receive CA-Signed Certificate files. 
Please follow the steps given below to create the CSR file.
  1. Open the Command Prompt
  2. From the location <installation directory> \ jre \ bin execute the below command.


  3. keytool -certreq -alias <your_alias_name> -file key.csr -keystore sdp.keystore 



  4. In the above command <your_alias_name> is the alias name provided when creating the keystore, key.csr is the name of the CSR file that will be created after the command is executed.



Step 3: Install your SSL Certificate




Download the Certificate files received from the CA via e-mail to the directory where your keystore (sdp.keystore) was saved during the CSR creation process. The certificates must be installed to this exact keystore. If you try to install it to a different keystore it will not work. 
The certificates you had downloaded must be installed to your keystore in the correct order for your certificate to be trusted. If the certificates are not installed in the correct order, then the certificate will not authenticate properly. To find the correct order, double click on the domain certificate and then go to 'Certification Path'.  







These certificates are usually in the format .cer or .crt. If your certificate is with the extension .p7b please follow the instructions given in Installing a .P7b Certificate to export the certs to a .cer or .crt format.
Looking at the above certification path we can infer that we need to import two other certificates before the domain certificate. First is the Root, next the Intermediate and finally the Domain Certificate. Some CAs may also use another certificate called Cross Intermediate. These certificates can be downloaded from the Vendor's website.

Installing the Root Certificate file 
Each time you install a certificate to your keystore you will be prompted for the keystore password, which you chose while generating your CSR. Type the following command to install the Root certificate file: 



Command 1 : keytool -import -trustcacerts -alias root -file <File_Name>.crt -keystore sdp.keystore 





NOTE: Choose 'Yes' if you get prompted with a message that says "Certificate already exists in system-wide CA keystore under alias <Alias Name> Do you still want to add it to your own keystore? [no]:" 


You will get a confirmation stating that the "Certificate was added to keystore". 


Install the Intermediate Certificates and Cross Intermediate Certificates (if any). 


Follow the instructions provided by the CA. 


Command 2 : keytool -import -trustcacerts –alias intermediate -file <File_Name>.crt -keystore sdp.keystore 



Command 3 : keytool -import -trustcacerts –alias cross -file <File_Name>.crt -keystore sdp.keystore 




You will get a confirmation stating that the "Certificate was added to keystore".

Install the Primary or the Domain Certificate file 



Type the following command to install the Primary certificate file: 


Command 4: keytool -import -trustcacerts -alias <your_alias_name or [Domain Name]> -file your_domain_name.crt -keystore sdp.keystore 



Please note that <your_alias_name or [Domain Name]> should be replaced with the alias name provided when creating the keystore (as discussed in Step 1). This time you will get a different confirmation stating that the "Certificate reply was installed in keystore"



C:\ManageEngine\AssetExplorer\jre\bin>keytool -import -trustcacerts -alias asset.manageengine.com -file asset.manageengine.com.cer -keystore sdp.keystore 
Enter keystore password : sdp123
Certificate reply was installed in keystore



If you want to trust the certificate, then choose y or yes. Your Certificates are now installed to your keystore file (sdp.keystore). 



Step 4: Configuring the Server


  1. Copy the sdp.keystore file from



For environments running latest version of AssetExplorer can copy this sdp.keystore file from directory  [AE-Home]\jre\bin to [AE-Home]\conf





  1. From the command prompt, execute changeWebServerPort.bat script to change the connection mode to HTTPS. 



  1. Cmd> [AE-Home]\bin> changeWebServerPort.bat <WEBSERVER_PORT> https

C:\ManageEngine\AssetExplorer\bin>changeWebServerPort.bat 443 https








  1. Finally, update the name of the keystore and the password, you gave in Step 1, while generating sdp.keystore in the file server.xml present under




For environments running latest version of AssetExplorer can find this file under the directory

[AE-Home]\conf









Restart the service ManageEngine AssetExplorer for the changes to take effect.


                New to ADManager Plus?

                  New to ADSelfService Plus?

                    • Related Articles

                    • How to Export SSL certificate using MMC?

                      When an SSL certificate is already installed on a Windows server, you may want to reinstall it on ServiceDesk Plus server. This may be required when you have a Wildcard or a Multi-domain certificate, and the subdomains or different domains are hosted ...
                    • Step-by-step: SSL Installation

                      In ServiceDesk Plus, we use a keystore file to store the private key and this keystore file will be used by the web server to secure the connections. Below are the steps that needs to be followed to generate a keystore file and install the ...
                    • SSL Installation

                      Do you have a Wildcard or a Multi-domain certificate already running in your other servers and want to reinstall in on ServiceDesk Plus server ?, then click here to find how to export SSL certificate using MMC.  Do you already have a .PFX certificate ...
                    • SSL server authentication and SSL Handshake

                      The Standard SSL Handshake The following is a standard SSL handshake when RSA key exchange algorithm is used: 1.  Client Hello Information that the server needs to communicate with the client using SSL. This includes the SSL version number, cipher ...
                    • SSL Installation using .PFX (PKCS12 Type Certificates)

                      Please follow the steps given below to use the .pfx file with ServiceDesk Plus to set up SSL. 1. Stop ManageEngine ServiceDesk Plus service. 2. Copy the .pfx file to the conf folder For environments running version 9.3 and below will find the conf ...