Convert your domain's Let's Encrypt certificate (along with their intermediate certs) into a keystore that can be used with Java apps - such as Atlassian's Confluence

convert-letsencrypt-java-keystore.sh

#!/usr/bin/env bash
# A codificiation of the steps outlined at
#    https://ordina-jworks.github.io/security/2019/08/14/Using-Lets-Encrypt-Certificates-In-Java.html
# that I found relevant in getting my LE certs to work with our Confluence install.

# That page, and other sources, suggest that you might also have to import ALL the LE intermediate
# certs into the default Confluence / Java keystore ($JRE_HOME/lib/security/cacerts)

[email protected]
DOMAIN=www.example.com
declare -x PASSWORD=changeit
KEYSTORE=$(pwd)/${DOMAIN}

# sudo certbot certonly --standalone -m ${NOTIFY} --agree-tos --no-eff-email -d "${DOMAIN}"
LE_DIR=/etc/letsencrypt/live/${DOMAIN}

# Convert Let's Encrypt certificates to PKCS 12 archive
openssl pkcs12 -export \
	-in "${LE_DIR}"/cert.pem \
	-inkey "${LE_DIR}"/privkey.pem \
	-out "${KEYSTORE}".p12 \
	-name "${DOMAIN}" \
	-CAfile "${LE_DIR}"/fullchain.pem \
	-caname "Let's Encrypt Authority X3" \
	-password env:PASSWORD
	# Or use, for example, pass:changeit if you want to specify pwd directly
	# See https://superuser.com/questions/724986/

# Import certificates into a keystore file.
keytool -importkeystore \
	-srckeystore "${KEYSTORE}".p12 \
	-srcstoretype PKCS12 \
	-srcstorepass "${PASSWORD}" \
	-destkeystore "${KEYSTORE}".jks \
	-deststoretype PKCS12 \
	-deststorepass "${PASSWORD}" \
	-destkeypass "${PASSWORD}" \
	-alias ${DOMAIN}

# Add the necessary Let's Encrypt intermediate certs
# (see https://gist.github.com/richmilne/5a5cb4be0ec8233a6c50ba40229d8278)
declare -A certs
certs[letsencryptisrgx3]=letsencryptauthorityx3
certs[letsencryptisrgx4]=letsencryptauthorityx4

KEYSTORE="${KEYSTORE}".jks
for ALIAS in ${!certs[@]}
do
    FNAME="${certs[$ALIAS]}".pem.txt
    wget https://letsencrypt.org/certs/${FNAME}
    keytool -delete -alias $ALIAS -keystore ${KEYSTORE} -storepass ${PASSWORD} > $(pwd)/errors.txt || true
    keytool -importcert -keystore ${KEYSTORE} -trustcacerts -storepass ${PASSWORD} -noprompt  -alias $ALIAS -file "${FNAME}"
done
rm -v *.pem.txt