Using your own certificate when setting up OpenDJ

Last modified by Aurelie Bertrand on 2026/09/14 15:42

As an alternative to the initial configuration described here, you can use your own certificate when configuring OpenDJ.

To do this, you must create a p12 file from the PEM-format certificate and its private key.
For example, with prod.digdash.com:

  • Certificate: prod.crt
  • Certificate private key: prod-key.pem
  • Certification authority: ipa.crt

The command to run, which will need to be adapted according to the variables mentioned above, is as follows:

pkcs12 -export -in prod.crt -inkey prod-key.pem -out prod.p12 -name "opendj-cert" -certfile ipa.crt

You will need to enter a password and save it to a file, for example:
/etc/ssl/password/prod-password-p12.txt

Consequently, the “setupOpenDJ.props” file will take the following form:

#
# Sample properties file to set up OpenDJ directory server
# See OpenDJ Setup command man for more options
#
rootUserDN                      =cn=Directory Manager
# warning do not user / or \ in the password
rootUserPassword                =secretpassword
hostname                        =prod.digdash.com
ldapPort                        =389
adminConnectorPort              =4444
backendType                     =je
baseDN                          =dc=digdash,dc=com
addBaseEntry                    =true
ldapsPort                       =636
enableStartTLS                  =true
usePkcs12keyStore                =/etc/ssl/private/prod.p12
keyStorePasswordFile            =/etc/ssl/password/prod-password-p12.txt
start                           =true