NO-JIRA: Re-generate expired ssl certificates

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1667918 13f79535-47bb-0310-9956-ffa450edef68

20 files changed, 177 insertions, 63 deletions

diff --git a/qpid/java/test-profiles/test_resources/ssl/CA_db/cert8.db b/qpid/java/test-profiles/test_resources/ssl/CA_db/cert8.db
index 846e59e82d..a3f6c20bea 100644
--- a/qpid/java/test-profiles/test_resources/ssl/CA_db/cert8.db
+++ b/qpid/java/test-profiles/test_resources/ssl/CA_db/cert8.db
diff --git a/qpid/java/test-profiles/test_resources/ssl/CA_db/key3.db b/qpid/java/test-profiles/test_resources/ssl/CA_db/key3.db
index dd60e1e05e..ccde375837 100644
--- a/qpid/java/test-profiles/test_resources/ssl/CA_db/key3.db
+++ b/qpid/java/test-profiles/test_resources/ssl/CA_db/key3.db
diff --git a/qpid/java/test-profiles/test_resources/ssl/CA_db/rootca.crt b/qpid/java/test-profiles/test_resources/ssl/CA_db/rootca.crt
index d9cdd9891c..eeced5aed5 100644
--- a/qpid/java/test-profiles/test_resources/ssl/CA_db/rootca.crt
+++ b/qpid/java/test-profiles/test_resources/ssl/CA_db/rootca.crt
@@ -1,13 +1,13 @@
 -----BEGIN CERTIFICATE-----
-MIICDDCCAXWgAwIBAgIFAJBNP3QwDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

+MIICDDCCAXWgAwIBAgIFAKI1edswDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

 Q0ExEDAOBgNVBAgTB09udGFyaW8xDTALBgNVBAoTBEFDTUUxETAPBgNVBAMTCE15

-Um9vdENBMB4XDTEwMDMyMjIxMDAyMloXDTE1MDMyMjIxMDAyMlowQTELMAkGA1UE

+Um9vdENBMB4XDTE1MDMxOTIyMzUyOVoXDTIwMDMxOTIyMzUyOVowQTELMAkGA1UE

 BhMCQ0ExEDAOBgNVBAgTB09udGFyaW8xDTALBgNVBAoTBEFDTUUxETAPBgNVBAMT

-CE15Um9vdENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDICe+SkXU9NRCk

-s+Tmai/j+3uDfJ4mVEt4PRkRWTVVHvuMvbPfKhdBRYRM5wmQmSCOi25Xd9jnh3PF

-BwE+pfaSgVqQiilUYqYak56ZR1Ll0nGwyXZQnW3lTf9VboEl0p67qckcd8SmaJf2

-0lAlTu2W7kJ8whYYyYRqaw+3yA6dGQIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0G

-CSqGSIb3DQEBBQUAA4GBADUbCNoxvFbPv+vqfQJ59p8P0cArEPajHR51omE1BbLc

-TfouOIidiBORf1n8DzE7k2Pf//nUHWhJLBP7J7CMs18UYsDD+0aa9A3BZi4wcsYX

-AW9EiXAIhnCk2+yyZyI1gdOnRS/9aOBRFSa1ngCb9GLm4kFzakiDQ1iX7k9dk17p
+CE15Um9vdENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjbsB++rgz0Kl9

+4VLr/03Tgab+xxf1krNdxriCMf7dd2cOQbHt3ytDeLroR/TH2Jqkv6MuXRlYHByw

+Oa3tqqX9pfCJDMnLiUZ97coeaZdtlLaHsVdp0KUiRPT+aUxbGW4n7r9o/5ahCoDV

+gxWsU0JXlHMI8eRh/smNVWf2AgQKBwIDAQABoxAwDjAMBgNVHRMEBTADAQH/MA0G

+CSqGSIb3DQEBBQUAA4GBAKfUcPQHf8Qs5UdLWyOSlnAB3fVjFjZHgBXdGAsZNFMY

+/Grjl1lGc7KJSvm6ICMD1Dq4rHrw1i4KwaeyuCfMgZ5RpsNXNoVVtCms4vD/FbSw

+Vde4OfEDiHcOy5Pd/ovnwPd6znHlYIXWZ3SEBs4MKzWW8BnwOEO+FAog0rAOE9N+
 -----END CERTIFICATE-----
diff --git a/qpid/java/test-profiles/test_resources/ssl/CA_db/secmod.db b/qpid/java/test-profiles/test_resources/ssl/CA_db/secmod.db
index a13e3e602c..0c0a006eeb 100644
--- a/qpid/java/test-profiles/test_resources/ssl/CA_db/secmod.db
+++ b/qpid/java/test-profiles/test_resources/ssl/CA_db/secmod.db
diff --git a/qpid/java/test-profiles/test_resources/ssl/app1.crt b/qpid/java/test-profiles/test_resources/ssl/app1.crt
index c04b07fce8..5b32b12dc2 100644
--- a/qpid/java/test-profiles/test_resources/ssl/app1.crt
+++ b/qpid/java/test-profiles/test_resources/ssl/app1.crt
@@ -1,15 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIICPjCCAaegAwIBAgIFAJJRUVUwDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

+MIIC4TCCAkqgAwIBAgIFAKI1xIUwDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

 Q0ExEDAOBgNVBAgTB09udGFyaW8xDTALBgNVBAoTBEFDTUUxETAPBgNVBAMTCE15

-Um9vdENBMB4XDTEwMTAxNDAyMzM1NloXDTE1MTAxNDAyMzM1NlowYTELMAkGA1UE

+Um9vdENBMB4XDTE1MDMyMDAxMjE1MloXDTIwMDMyMDAxMjE1MlowYTELMAkGA1UE

 BhMCQ0ExCzAJBgNVBAgTAk9OMRAwDgYDVQQHEwdUb3JvbnRvMQ0wCwYDVQQKEwRh

-Y21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDFAYWNtZS5vcmcwgZ8wDQYJ

-KoZIhvcNAQEBBQADgY0AMIGJAoGBAIlYzFnmAsv/Ci4rgp3sWwkFGFYEBwiXx0Xz

-auZ10nrOUz6Ce2FGVQBYFA09zi79iUyn86oLuTY0Kc/1emCZEPkmOW+hw1uk/TxG

-5MqpEOZdsDv4xIqBHgtWv/d3kGubwSS5lia1l6EPvnzHvsQSM//xhkrJaF0fAHx5

-FMkilnvfAgMBAAGjIjAgMAkGA1UdEwQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwIw

-DQYJKoZIhvcNAQEFBQADgYEAJ47Q/4/hJMwTTpfcojv9KbZUTrve/wkabUrytNf3

-ogqhaIzgUr+vA9EMBc91Jg1WJC/0VMmTrTEggqrgd/prg4xcyATQOwNR1TiaWC4E

-r3pWEpZZnEJSd4vtcciNFNsbuAt2m4Nc90gPNXKgNoe0+3nuxPLs/TIauwOSDF+I

-oiw=
+Y21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDFAYWNtZS5vcmcwggEiMA0G

+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCL3+MH/VknnAI+ldWywF4khA8oGjGd

+w6z5zPWZ83ucPdjIFUNRN4N38Fd62gs0BCwrZcRZiHbynWFZBsweUj7ODyYFPFtq

+xaYO/Ovt4xGsNspcpcSNVPhcH/34hfqpUmsUrM1tFf/1vgOV4BfU05mkNCeZxvmg

+TuyAXPbunwu4poPaWOy0JBTSsS8LPGgofE8k0yzg9+91Ixw6ulQLV/TEuhgbJ7sL

+iA70GTHLs3vwnlsvU0xLUb+U3OAxbHpCrbnmwmGg9BrjJvJGfL9UydpjiIl25uMA

+PTkI+gapLAf2lkiyk+dpIz99LXvAUqKnli6KGNVLhmJb1KNelBlqlJcDAgMBAAGj

+QTA/MB0GA1UdDgQWBBRm2ix2JDQ9VG0wsZctPa/PnJdxhDAJBgNVHRMEAjAAMBMG

+A1UdJQQMMAoGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBQUAA4GBABr7BxsqDpHy2tOo

+F39pthuSpHBh37fxtSCJKMigMFjRUCpLYosMefixVYGT8IAhJ+KSzAg48SKmD0b5

+9R4NZXP16Mbs6U9Air8CSANsfpcG4nJu+QiTIu6RAQOwt+dlYfRe/OkNpunzJBzb

+eAEMdf1CrEFtQi/hniiLffjyk7ln
 -----END CERTIFICATE-----
diff --git a/qpid/java/test-profiles/test_resources/ssl/app1.req b/qpid/java/test-profiles/test_resources/ssl/app1.req
index b4f1ff9a2c..318715daf5 100644
--- a/qpid/java/test-profiles/test_resources/ssl/app1.req
+++ b/qpid/java/test-profiles/test_resources/ssl/app1.req
@@ -1,10 +1,15 @@
 -----BEGIN NEW CERTIFICATE REQUEST-----
-MIIBoTCCAQoCAQAwYTELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAk9OMRAwDgYDVQQHEwdUb3JvbnRv
-MQ0wCwYDVQQKEwRhY21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDFAYWNtZS5vcmcwgZ8w
-DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAIlYzFnmAsv/Ci4rgp3sWwkFGFYEBwiXx0XzauZ10nrO
-Uz6Ce2FGVQBYFA09zi79iUyn86oLuTY0Kc/1emCZEPkmOW+hw1uk/TxG5MqpEOZdsDv4xIqBHgtW
-v/d3kGubwSS5lia1l6EPvnzHvsQSM//xhkrJaF0fAHx5FMkilnvfAgMBAAGgADANBgkqhkiG9w0B
-AQQFAAOBgQADKx89mTCGIbrCE6lICLYDexGxexeaZaUDq7YgtyXVIs2wcVGcZJGolUARopMWgE+y
-ryHTC4nvNCaBULyXGrzwPfzTJaVBiY4V5BoTrmz6Ofd73ZO6ZYNhy9bVLrb5VtDyldCj0EWz2lBe
-+OzVUeII5KPopRtzXpMH3sB2OredUg==
+MIIC1jCCAb4CAQAwYTELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAk9OMRAwDgYDVQQHEwdUb3JvbnRv
+MQ0wCwYDVQQKEwRhY21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDFAYWNtZS5vcmcwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCL3+MH/VknnAI+ldWywF4khA8oGjGdw6z5zPWZ
+83ucPdjIFUNRN4N38Fd62gs0BCwrZcRZiHbynWFZBsweUj7ODyYFPFtqxaYO/Ovt4xGsNspcpcSN
+VPhcH/34hfqpUmsUrM1tFf/1vgOV4BfU05mkNCeZxvmgTuyAXPbunwu4poPaWOy0JBTSsS8LPGgo
+fE8k0yzg9+91Ixw6ulQLV/TEuhgbJ7sLiA70GTHLs3vwnlsvU0xLUb+U3OAxbHpCrbnmwmGg9Brj
+JvJGfL9UydpjiIl25uMAPTkI+gapLAf2lkiyk+dpIz99LXvAUqKnli6KGNVLhmJb1KNelBlqlJcD
+AgMBAAGgMDAuBgkqhkiG9w0BCQ4xITAfMB0GA1UdDgQWBBRm2ix2JDQ9VG0wsZctPa/PnJdxhDAN
+BgkqhkiG9w0BAQUFAAOCAQEAMlm/PeNAirN/c6KWkVNYBYk1RosQ0TVoRLnrKON/HHcHSlA6YCAD
+LLc2S8fTEjxKoOU3G1pL3s6nD1GKETF/k9Wm9VAK2lg9daG35p5RaEFwLc3r9PVMLNYcnOSXV4tj
+9S7L2FH2mxinj9vs7VYe6ZmI2vp2ts0P5/k4dX/vAQAkS8y6A+gxVzUeeDFT2+WQtmRG/mPfU9Ic
+9w965Po0Dd7cQPgwS7WQoVHovSjIvNXhm6aNki9uyWoDIE4cR2QcHRC6YBlxRiEq6uW87FBgrCH+
+ooLiZS/+p8TWCRro3HvsFRrrCTE+gFK8c3ouueIzmvu4+SKB0lPJOdnhoUsOaw==
 -----END NEW CERTIFICATE REQUEST-----
diff --git a/qpid/java/test-profiles/test_resources/ssl/app2.crt b/qpid/java/test-profiles/test_resources/ssl/app2.crt
index 5c889a4c31..a8fe4104bc 100644
--- a/qpid/java/test-profiles/test_resources/ssl/app2.crt
+++ b/qpid/java/test-profiles/test_resources/ssl/app2.crt
@@ -1,15 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIICPjCCAaegAwIBAgIFAJJRUXgwDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

+MIIC4TCCAkqgAwIBAgIFAKI1xCswDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

 Q0ExEDAOBgNVBAgTB09udGFyaW8xDTALBgNVBAoTBEFDTUUxETAPBgNVBAMTCE15

-Um9vdENBMB4XDTEwMTAxNDAyMzQxNVoXDTE1MTAxNDAyMzQxNVowYTELMAkGA1UE

+Um9vdENBMB4XDTE1MDMyMDAxMjEwNVoXDTIwMDMyMDAxMjEwNVowYTELMAkGA1UE

 BhMCQ0ExCzAJBgNVBAgTAk9OMRAwDgYDVQQHEwdUb3JvbnRvMQ0wCwYDVQQKEwRh

-Y21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDJAYWNtZS5vcmcwgZ8wDQYJ

-KoZIhvcNAQEBBQADgY0AMIGJAoGBAJcIo3TSYxDa1OfmnDEP4qzLxmgyXC3n0Evu

-2nJz0s5zljjItnwJ9UpOkYh/PQcpUWoM+qKeZYadXbGhp8M8nMrJtUPOAKgDmF6A

-DKS9WL7u8kVCcEvBzLRD7bftEm2IPaRu72wOQai76hj11rYWHHkdAPem+C4ODqVn

-y2NN3zDnAgMBAAGjIjAgMAkGA1UdEwQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwIw

-DQYJKoZIhvcNAQEFBQADgYEAc5FG8sDbK+i1703rJEwjJ9dCVXljN2jYL1sGXO2o

-9O5Da0zKcQ+OMhLJUoJf38pJw+maYhtT0fKFLItXP/rlyWlaGRBjkcZjOZ2D/Hg5

-/8pEVwiyTYRoEnGKRawnedIbEyBAcgtnlbkTFWXtQmnmgVApSzTpALRn5/jUC1PU

-Y3g=
+Y21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDJAYWNtZS5vcmcwggEiMA0G

+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCviLTH6Vl6gP3M6gmmm0sVlCcBFfo2

+czDTsr93D1cIQpnyY1r3znBdFT3cbXE2LtHeLpnlXc+dTo9/aoUuBCzRIpi4CeaG

+gD3ggIl9Ws5hUgfxJCWBg7nhzMUlBC2C+VgIUHWHqGPuaQ7VzXOEC7xF0mihMZ4b

+wvU6wxGK2uUoruXE/iti/+jtzxjq0PO7ZgJ7GUI2ZDqGMad5OnLur8jz+yKsVdet

+XlXsOyHmHi/47pRuA115pYiIaZKu1+vs6IBl4HnEUgw5JwIww6oyTDVvXc1kCw0Q

+CtUZMcNSH2XGhh/zGM/M2Bt2lgEEW0xWTwQcT1J7wnngfbIYbzoupEkRAgMBAAGj

+QTA/MB0GA1UdDgQWBBRI+VUMRkfNYp/xngM9y720hvxmXTAJBgNVHRMEAjAAMBMG

+A1UdJQQMMAoGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBQUAA4GBAJnedohhbqoY7O6o

+Am+hPScBCng/fl0erVjexL9W8l8g5NvIGgioUfjUDvGOnwB5LOoTnZUCRaLFhQFc

+GFMIjdHpg0qt/QkEFX/0m+849RK6muHT1CNlcXtCFXwPTJ+9h+1auTP+Yp/6ii9S

+U3W1dzYawy2p9IhkMZEpJaHCLnaC
 -----END CERTIFICATE-----
diff --git a/qpid/java/test-profiles/test_resources/ssl/app2.req b/qpid/java/test-profiles/test_resources/ssl/app2.req
index 53f3494168..cfd67b5843 100644
--- a/qpid/java/test-profiles/test_resources/ssl/app2.req
+++ b/qpid/java/test-profiles/test_resources/ssl/app2.req
@@ -1,10 +1,15 @@
 -----BEGIN NEW CERTIFICATE REQUEST-----
-MIIBoTCCAQoCAQAwYTELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAk9OMRAwDgYDVQQHEwdUb3JvbnRv
-MQ0wCwYDVQQKEwRhY21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDJAYWNtZS5vcmcwgZ8w
-DQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJcIo3TSYxDa1OfmnDEP4qzLxmgyXC3n0Evu2nJz0s5z
-ljjItnwJ9UpOkYh/PQcpUWoM+qKeZYadXbGhp8M8nMrJtUPOAKgDmF6ADKS9WL7u8kVCcEvBzLRD
-7bftEm2IPaRu72wOQai76hj11rYWHHkdAPem+C4ODqVny2NN3zDnAgMBAAGgADANBgkqhkiG9w0B
-AQQFAAOBgQAGNtSvXwdyujmMTaVQj2M2jZkgnVFtMBjDDmdz+wgzu8fKaej7e+fJi5owf31wJUUP
-0Zi/6mBNj+blmqHjNQ9U3w9Rns0z3+1DbO3Yj48d75IuxQJJd+lXXjCFi2qSBhaNUwyOpzaI1AQo
-JJTC1/WMaPENU9bgYYsOrmIhnbt5rQ==
+MIIC1jCCAb4CAQAwYTELMAkGA1UEBhMCQ0ExCzAJBgNVBAgTAk9OMRAwDgYDVQQHEwdUb3JvbnRv
+MQ0wCwYDVQQKEwRhY21lMQwwCgYDVQQLEwNhcnQxFjAUBgNVBAMMDWFwcDJAYWNtZS5vcmcwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCviLTH6Vl6gP3M6gmmm0sVlCcBFfo2czDTsr93
+D1cIQpnyY1r3znBdFT3cbXE2LtHeLpnlXc+dTo9/aoUuBCzRIpi4CeaGgD3ggIl9Ws5hUgfxJCWB
+g7nhzMUlBC2C+VgIUHWHqGPuaQ7VzXOEC7xF0mihMZ4bwvU6wxGK2uUoruXE/iti/+jtzxjq0PO7
+ZgJ7GUI2ZDqGMad5OnLur8jz+yKsVdetXlXsOyHmHi/47pRuA115pYiIaZKu1+vs6IBl4HnEUgw5
+JwIww6oyTDVvXc1kCw0QCtUZMcNSH2XGhh/zGM/M2Bt2lgEEW0xWTwQcT1J7wnngfbIYbzoupEkR
+AgMBAAGgMDAuBgkqhkiG9w0BCQ4xITAfMB0GA1UdDgQWBBRI+VUMRkfNYp/xngM9y720hvxmXTAN
+BgkqhkiG9w0BAQUFAAOCAQEAIk5xvkcSXoDDsqarHHbeBsYd1WIQbbNyDB4+9GlooI/0igSy6pIm
+wulHIvmXDuMZbYx+mNmVhapEyOWC0Yq4nnAbIkFDQOZ8ac3IdwiP8rf+FziaU49CPH7PvVRmI1dO
+X/cgJobj3EytaCh1+xvDxJuRvQ3UL+MoL3KJxS+JAhH0QYT7ZoXBLfz4UHjVJn/fG4tsrAzdtjsG
+1DHiyaarUxjFqfE8IsaqaT2r1MhFVI0EXDbskCtVDf8x4RbCbBfooerkca4JbdhNfzHXVeq3NjkQ
+NhYdRwwlAWr3bWEhc3F1rHYPnN5C0tonxnz71Emt3zfzO4XYaXePQTm+3JCSEw==
 -----END NEW CERTIFICATE REQUEST-----
diff --git a/qpid/java/test-profiles/test_resources/ssl/generate-java-keystores.sh b/qpid/java/test-profiles/test_resources/ssl/generate-java-keystores.sh
new file mode 100755
index 0000000000..d6260daae3
--- /dev/null
+++ b/qpid/java/test-profiles/test_resources/ssl/generate-java-keystores.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+echo "Remove existing java broker keystore"
+rm java_broker_keystore.jks
+echo "Re-create java broker keystore by importing RootCA certificate"
+keytool -import -v -keystore java_broker_keystore.jks -storepass password -alias RootCA -file CA_db/rootca.crt 
+echo "Generate certificate key 'java-broker'"
+keytool -genkey -alias java-broker -keyalg RSA -sigalg SHA1withRSA -validity 720 -keystore java_broker_keystore.jks -storepass password -dname "CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown"
+echo "Export certificate signing request"
+keytool -certreq -alias java-broker -sigalg SHA1withRSA -keystore java_broker_keystore.jks -storepass password -v -file java-broker.req
+echo "Sign certificate by entering:"
+echo "  n for 'Is this a CA certificate [y/N]?'"
+echo "  0 for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'"
+echo "  n for 'Is this a critical extension [y/N]?'"
+echo "  password which was specified on creation root CA database."
+certutil -C -d CA_db -c "MyRootCA" -a -i java-broker.req -o java-broker.crt -2 -6 --extKeyUsage serverAuth -v 60 -Z SHA1
+echo "Import signed certificate"
+keytool -import -v -alias java-broker -keystore java_broker_keystore.jks -storepass password -file java-broker.crt
+echo "List keystore entries"
+keytool --list --keystore java_broker_keystore.jks -storepass password 
+
+read -p "Press [Enter] key to continue..."
+echo "Remove existing client keystore"
+rm java_client_keystore.jks
+echo "Re-create java client keystore by importing RootCA certificate"
+keytool -import -v -keystore java_client_keystore.jks -storepass password -alias RootCA -file CA_db/rootca.crt
+
+echo "Generate key for certificate 'app2'"
+keytool -genkey -alias app2 -keyalg RSA -sigalg SHA1withRSA -validity 720 -keystore java_client_keystore.jks -storepass password  -dname "CN=app2@acme.org, OU=art, O=acme, L=Toronto, ST=ON, C=CA"
+echo "Export certificate signing request for 'app2'"
+keytool -certreq -alias app2 -sigalg SHA1withRSA -keystore java_client_keystore.jks -storepass password -v -file app2.req
+echo "Sign certificate 'app2' by entering:"
+echo "  n for 'Is this a CA certificate [y/N]?'"
+echo "  '-1' for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'"
+echo "  n for 'Is this a critical extension [y/N]?'"
+echo "  password which was specified on creation root CA database."
+certutil -C -d CA_db -c "MyRootCA" -a -i app2.req -o app2.crt -2 -6  --extKeyUsage clientAuth -v 60 -Z SHA1
+echo "Import signed certificate 'app2'"
+keytool -import -v -alias app2 -keystore java_client_keystore.jks -storepass password -file app2.crt
+
+echo "Generate key for certificate 'app1'"
+keytool -genkey -alias app1 -keyalg RSA -sigalg SHA1withRSA -validity 720 -keystore java_client_keystore.jks -storepass password  -dname "CN=app1@acme.org, OU=art, O=acme, L=Toronto, ST=ON, C=CA"
+echo "Export certificate signing request for 'app1'"
+keytool -certreq -alias app1 -sigalg SHA1withRSA -keystore java_client_keystore.jks -storepass password -v -file app1.req
+echo "Sign certificate 'app1' by entering:"
+echo "  n for 'Is this a CA certificate [y/N]?'"
+echo "  '-1' for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'"
+echo "  n for 'Is this a critical extension [y/N]?'"
+echo "  password which was specified on creation of root CA database."
+certutil -C -d CA_db -c "MyRootCA" -a -i app1.req -o app1.crt -2 -6  --extKeyUsage clientAuth -v 60 -Z SHA1
+echo "Import signed certificate 'app1'"
+keytool -import -v -alias app1 -keystore java_client_keystore.jks -storepass password -file app1.crt
+echo "List entries in client keystore"
+keytool --list --keystore java_client_keystore.jks  -storepass password
+
+read -p "Press [Enter] key to continue..."
+echo "Remove existing client truststore"
+rm java_client_truststore.jks 
+echo "Re-create existing client truststore by importing RootCA certificate"
+keytool -import -v -keystore java_client_truststore.jks -storepass password -alias RootCA -file CA_db/rootca.crt
+echo "List entries in client trusttore"
+keytool --list --keystore java_client_truststore.jks  -storepass password
+
+read -p "Press [Enter] key to continue..."
+echo "Remove existing broker truststore"
+rm java_broker_truststore.jks
+echo "Re-create existing broker truststore by importing RootCA certificate"
+keytool -import -v -keystore java_broker_truststore.jks -storepass password -alias RootCA -file CA_db/rootca.crt
+echo "List entries in broker truststore"
+keytool --list --keystore java_broker_truststore.jks  -storepass password
diff --git a/qpid/java/test-profiles/test_resources/ssl/generate-root-ca.sh b/qpid/java/test-profiles/test_resources/ssl/generate-root-ca.sh
new file mode 100755
index 0000000000..c765cef6b8
--- /dev/null
+++ b/qpid/java/test-profiles/test_resources/ssl/generate-root-ca.sh
@@ -0,0 +1,29 @@
+echo "Create a new certificate database for root CA"
+rm CA_db/*
+certutil -N -d CA_db
+                 
+echo "Create the self-signed Root CA certificate"
+echo "Enter the password you specified when creating the root CA database."
+echo "y for 'Is this a CA certificate [y/N]?'”
+echo "Press enter for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'"
+echo "n for 'Is this a critical extension [y/N]?'”
+certutil -S -d CA_db -n "MyRootCA" -s "CN=MyRootCA,O=ACME,ST=Ontario,C=CA" -t "CT,," -x -2 -Z SHA1 -v 60
+echo "Extract the CA certificate from the CA’s certificate database to a file."
+certutil -L -d CA_db -n "MyRootCA" -a -o CA_db/rootca.crt
+              
+
+echo "Create a certificate database for the Qpid Broker."
+rm server_db/*
+certutil -N -d server_db
+echo "Import the CA certificate into the broker’s certificate database"
+certutil -A -d server_db -n "MyRootCA" -t "TC,," -a -i CA_db/rootca.crt
+echo "Create the server certificate request"
+certutil -R -d server_db -s "CN=localhost.localdomain,O=ACME,ST=Ontario,C=CA" -a -o server_db/server.req -Z SHA1
+echo "Sign and issue a new server certificate"
+echo "n for 'Is this a CA certificate [y/N]?'"
+echo "-1 for 'Enter the path length constraint, enter to skip [<0 for unlimited path]: >'"
+echo "n' for 'Is this a critical extension [y/N]?'"
+echo "enter the password you specified when creating the root CA database."
+certutil -C -d CA_db -c "MyRootCA" -a -i server_db/server.req -o server_db/server.crt -2 -6  --extKeyUsage serverAuth -v 60 -Z SHA1
+echo "Import signed certificate to the broker’s certificate database"
+certutil -A -d server_db -n localhost.localdomain -a -i server_db/server.crt -t ",,"
diff --git a/qpid/java/test-profiles/test_resources/ssl/java_broker_keystore.jks b/qpid/java/test-profiles/test_resources/ssl/java_broker_keystore.jks
index 29ae3a8e67..50bb8d01b3 100644
--- a/qpid/java/test-profiles/test_resources/ssl/java_broker_keystore.jks
+++ b/qpid/java/test-profiles/test_resources/ssl/java_broker_keystore.jks
diff --git a/qpid/java/test-profiles/test_resources/ssl/java_broker_peerstore.jks b/qpid/java/test-profiles/test_resources/ssl/java_broker_peerstore.jks
index a716581a7e..b6850f30fd 100644
--- a/qpid/java/test-profiles/test_resources/ssl/java_broker_peerstore.jks
+++ b/qpid/java/test-profiles/test_resources/ssl/java_broker_peerstore.jks
diff --git a/qpid/java/test-profiles/test_resources/ssl/java_broker_truststore.jks b/qpid/java/test-profiles/test_resources/ssl/java_broker_truststore.jks
index 2af95f21f8..e6d556aea3 100644
--- a/qpid/java/test-profiles/test_resources/ssl/java_broker_truststore.jks
+++ b/qpid/java/test-profiles/test_resources/ssl/java_broker_truststore.jks
diff --git a/qpid/java/test-profiles/test_resources/ssl/java_client_keystore.jks b/qpid/java/test-profiles/test_resources/ssl/java_client_keystore.jks
index e3a850a248..941fc7e88a 100644
--- a/qpid/java/test-profiles/test_resources/ssl/java_client_keystore.jks
+++ b/qpid/java/test-profiles/test_resources/ssl/java_client_keystore.jks
diff --git a/qpid/java/test-profiles/test_resources/ssl/java_client_truststore.jks b/qpid/java/test-profiles/test_resources/ssl/java_client_truststore.jks
index 2af95f21f8..ab79b54226 100644
--- a/qpid/java/test-profiles/test_resources/ssl/java_client_truststore.jks
+++ b/qpid/java/test-profiles/test_resources/ssl/java_client_truststore.jks
diff --git a/qpid/java/test-profiles/test_resources/ssl/server_db/cert8.db b/qpid/java/test-profiles/test_resources/ssl/server_db/cert8.db
index d55f529c52..f482e78687 100644
--- a/qpid/java/test-profiles/test_resources/ssl/server_db/cert8.db
+++ b/qpid/java/test-profiles/test_resources/ssl/server_db/cert8.db
diff --git a/qpid/java/test-profiles/test_resources/ssl/server_db/key3.db b/qpid/java/test-profiles/test_resources/ssl/server_db/key3.db
index 12f3c394c5..f1edbaf4f9 100644
--- a/qpid/java/test-profiles/test_resources/ssl/server_db/key3.db
+++ b/qpid/java/test-profiles/test_resources/ssl/server_db/key3.db
diff --git a/qpid/java/test-profiles/test_resources/ssl/server_db/secmod.db b/qpid/java/test-profiles/test_resources/ssl/server_db/secmod.db
index 97a5b9b2fe..87867f4856 100644
--- a/qpid/java/test-profiles/test_resources/ssl/server_db/secmod.db
+++ b/qpid/java/test-profiles/test_resources/ssl/server_db/secmod.db
diff --git a/qpid/java/test-profiles/test_resources/ssl/server_db/server.crt b/qpid/java/test-profiles/test_resources/ssl/server_db/server.crt
index 4f1c007d16..1a87265e89 100644
--- a/qpid/java/test-profiles/test_resources/ssl/server_db/server.crt
+++ b/qpid/java/test-profiles/test_resources/ssl/server_db/server.crt
@@ -1,14 +1,14 @@
 -----BEGIN CERTIFICATE-----
-MIICKzCCAZSgAwIBAgIFAJBNUhEwDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

+MIICKzCCAZSgAwIBAgIFAKI1eqswDQYJKoZIhvcNAQEFBQAwQTELMAkGA1UEBhMC

 Q0ExEDAOBgNVBAgTB09udGFyaW8xDTALBgNVBAoTBEFDTUUxETAPBgNVBAMTCE15

-Um9vdENBMB4XDTEwMDMyMjIxNDE0OVoXDTE1MDMyMjIxNDE0OVowTjELMAkGA1UE

+Um9vdENBMB4XDTE1MDMxOTIyMzYzOVoXDTIwMDMxOTIyMzYzOVowTjELMAkGA1UE

 BhMCQ0ExEDAOBgNVBAgTB09udGFyaW8xDTALBgNVBAoTBEFDTUUxHjAcBgNVBAMT

 FWxvY2FsaG9zdC5sb2NhbGRvbWFpbjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC

-gYEAtmFy+0IIn6otWu2TCJ3fN2UDA//EVDWpiozzvd/My31XpPQ8jhuvsZ2//xvG

-OKqDfgQ80OE6BiGmR2zxPKFfsgxhU+0g8132focOzd0MhmGpyhdQdogXQ2cCcvjB

-CvgaugIjTmk3MX9njD7np8TQQ7wW1Wuk/c99tuvlexjEoWkCAwEAAaMiMCAwCQYD

-VR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOBgQDH

-iOxUWKllSUgCcAij0Gb4qDo/YDoatWyzE8pNZR7OgSOJ8zEVJcB/7YW//frd2dMS

-lz6c38vqbGwyblw+b64SvBKI3WK0jyO4Ft9FGpNIEfc9Q5G0MFiGilv+GDIZ/asE

-KnsZNy4z4gs3KFSf96k1AV1YQ1tVpFcUrI+3QqdWfQ==
+gYEAu4kNLGCxZ3cvQRqd0L6iM1zx4boj7eGlLpgysPn0sd77N8CfBMqnmWOoYafI

+H4+FPMQ3En3D0nV5qFjveNTJQtzRZZUCbF6UESeO6ghu8Rr5AnI51PIrSQPVEG1w

+0AN1TYrn5AxW3G06aVMsggk7TItFb7qkXTO1LuGUcZy1z+MCAwEAAaMiMCAwCQYD

+VR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATANBgkqhkiG9w0BAQUFAAOBgQAc

+w82l72VLrPNtVBp+90rNHLM6ARnghYWLceC07cwgjNItejDlLOHzExThYH5vOwFs

+b6c2KyUt198uccl5wx44HvzR5LCVnJ0JQqw4n0tS9jeztD42urYWP2ouPgqgxAvo

+zNARo6aODfF9I7sxtPhSvhECyKvkZQH4F4xVXwwvSA==
 -----END CERTIFICATE-----
diff --git a/qpid/java/test-profiles/test_resources/ssl/server_db/server.req b/qpid/java/test-profiles/test_resources/ssl/server_db/server.req
index 5551516586..9eaa228820 100644
--- a/qpid/java/test-profiles/test_resources/ssl/server_db/server.req
+++ b/qpid/java/test-profiles/test_resources/ssl/server_db/server.req
@@ -11,11 +11,11 @@ Country: CA
 -----BEGIN NEW CERTIFICATE REQUEST-----
 MIIBjTCB9wIBADBOMQswCQYDVQQGEwJDQTEQMA4GA1UECBMHT250YXJpbzENMAsG

 A1UEChMEQUNNRTEeMBwGA1UEAxMVbG9jYWxob3N0LmxvY2FsZG9tYWluMIGfMA0G

-CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2YXL7Qgifqi1a7ZMInd83ZQMD/8RUNamK

-jPO938zLfVek9DyOG6+xnb//G8Y4qoN+BDzQ4ToGIaZHbPE8oV+yDGFT7SDzXfZ+

-hw7N3QyGYanKF1B2iBdDZwJy+MEK+Bq6AiNOaTcxf2eMPuenxNBDvBbVa6T9z322

-6+V7GMShaQIDAQABoAAwDQYJKoZIhvcNAQEFBQADgYEAJGqdJVTScR4rzusrf6dE

-Snz/PtKcl8ZqXfHMPhj5uqUACcj3AxvlerIrpIGG9YT5cX4cOa92plpearMAC1TW

-fksbpsJR174WnAbBETrNbOX55igS/KDkW+RJCn7GGOvcSza+nJ880/lZ0iC63bgY

-SmvSnp3ub1CBX0grWl4bzTw=
+CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7iQ0sYLFndy9BGp3QvqIzXPHhuiPt4aUu

+mDKw+fSx3vs3wJ8EyqeZY6hhp8gfj4U8xDcSfcPSdXmoWO941MlC3NFllQJsXpQR

+J47qCG7xGvkCcjnU8itJA9UQbXDQA3VNiufkDFbcbTppUyyCCTtMi0VvuqRdM7Uu

+4ZRxnLXP4wIDAQABoAAwDQYJKoZIhvcNAQEFBQADgYEAtuJ9b0OgbijExb/AQlbS

+kw4s28SwMqyMdgt+kUJHaDV+sEtlzzdv7jS0uKtoElBI7+MiYbtGzcqvdPGc147Q

+T6Lk7AMcBrjRFLxuBnAi+Bdh7O6PUUKL9CREAae1QiVOFfXkD07Az9YDLYhe+ZsJ

+qLYrWDGTMRXXsKU3JWIy5M4=
 -----END NEW CERTIFICATE REQUEST-----