I have imported a PFX in the past, for SAS related project, and seen the guid appear as the certificate alias before with success. I manually changed the certificate alias in a separate step described below, but I believe the issue may be the certificate's private key password was not changed to the keystore's password, if the PFX file's password was different than the keystore password. The last command below can help you change it.
RSA Via, by default, looks for a certificate with an alias of "server" The new keystore created in the steps above may not have any certificate with that alias. [The alias and keystore password RSA Via uses can be changed to non-default values in the $AVEKSA_WILDFLY_HOME/standalone/configuration/aveksa-standalone-full.xml and similar files in lines containing "keystore_path"]
Use the following command to receive verbose output of the aveksa.keystore:
cd /home/oracle/keystore;
keytool -v -list -keystore aveksa.keystore;
You should see the certificate imported from the PFX, under the alias with the guid. Under the alias with the guid, you should see "Entry type: PrivateKeyEntry" underneath. You will also see the intermediate certificate(s) listed as Certificate[2]... Certificate[3]. The last certificate will be the root certificate.
Use the following command to rename the cert's alias to "server". Replace <originalalias> with the guid looking alias:
keytool -changealias -alias <originalalias> -destalias server -keystore ./aveksa.keystore;
In addition, the password protecting the private key may not have been changed, to the overall keystore password. Use this command to change the private key password to the same password used to protect the keystore. You will be prompted for the passwords:
cd /home/oracle/keystore;
keytool -keypasswd -alias server -keystore ./aveksa.keystore;
If you import the PFX into a keystore with a "server" alias, you will need to rename the existing server certificate to another alias before renaming the newly imported certificate/key to "server."
