title: Create a self signed certificate for localhost and import it in Glassfish
body: <p>I am developing a REST server that runs with Jersey on Glassfish, and I want to make it run on HTTPS on localhost.</p>
  <p>I have found many tutorials for generating a CA cert, others for generating .cer / .crt / .key / .csr / ... files, others for generating a jks keystore.</p>
  <p>But they do not answer my (very basic) question: how to generate a self signed certificate and use it in my app that runs on Glassfish, on localhost? <strong>From scratch to the integration for a real usage</strong>, without any prerequiresite having a crt, a jks or any other file.</p>
  <p>(For information I use Linux)</p>
  <p>Thanks</p>
  <p><strong>EDIT</strong>: I have finally created a certificate with the following commands</p>
  <pre><code>openssl req -x509 -out localhost.crt -keyout localhost.key \
    -newkey rsa:2048 -nodes -sha256 \
    -subj '/CN=localhost' -extensions EXT -config &lt;( \
     printf &quot;[dn]\nCN=localhost\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:localhost\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth&quot;)
  </code></pre>
  <pre><code>openssl pkcs12 -export -name localhostServerCert -in localhost.crt -inkey localhost.key -out localhostP12Keystore.p12
  </code></pre>
  <pre><code>keytool -importkeystore -destkeystore localhostKeystore.jks -srckeystore localhostP12Keystore.p12 -srcstoretype pkcs12 -alias localhostServerCert
  </code></pre>
  <pre><code>copy localhostKeystore.jks into /glassfish/domains/domain1/config
  </code></pre>
  <pre><code>keytool -importkeystore -srckeystore localhostKeystore.jks -destkeystore keystore.jks
  </code></pre>
  <p>And I have modified http-listener-2 in the admin console with certificate nickname <code>localhostServerCert</code>, but I got an error page on https://localhost:8181 (ERR_CONNECTION_REFUSED)</p>
  <p><strong>EDIT 2</strong> : I think there should be a problem with the certificate, since <code>openssl s_client -showcerts -connect localhost:8181</code> returns <code>no peer certificate available</code>, <code>No client certificate CA names sent</code></p>