Is Createcert Broken?

[#1]

12.0.1.4183

The CreateCert executable outputs malformed X.509 certificates that are unsupported by Java. The program previously output X.509v3 files with proper X.509v3 extensions, but an update has introduced a bug causing the application to output X.509v1 certificates with X.509v3 extensions in violation of the X.509 specification. This causes java’s strict parser to fail when interacting with these certificates with the error text “java.security.cert.CertificateParsingException: no more data allowed for version 1 certificate.” This is true for both Java’s use of the KeyTool, and when interacting with the server over TLS with Java as a client.

[philippefbertrand]

In the meantime you can create self-signed certificates using Java's keytool. For example:

] keytool -genkeypair -keyalg RSA -keysize 2048 -keypass sample -validity 1825 -keystore mystore.jks -storepass STORE_PASSWORD_HERE -v -alias localhost
What is your first and last name?
  [Unknown]:
What is the name of your organizational unit?
  [Unknown]:  SAPCanada
What is the name of your organization?
  [Unknown]:  SAP
What is the name of your City or Locality?
  [Unknown]:  Waterloo
What is the name of your State or Province?
  [Unknown]:  ON
What is the two-letter country code for this unit?
  [Unknown]:  CA
Is CN=Unknown, OU=SAPCanada, O=SAP, L=Waterloo, ST=ON, C=CA correct?
  [no]:  y

Generating 2,048 bit RSA key pair and self-signed certificate (SHA256withRSA) with a validity of 1,825 days
        for: CN=Unknown, OU=SAPCanada, O=SAP, L=Waterloo, ST=ON, C=CA
[Storing mystore.jks]


You can also generate chained certificates.