Java Keytool error after importing certificate , "keytool error: java.io.FileNotFoundException & Access Denied"

Question

I'm trying to connect a Java Web API via HTTPS; however, an exception is thrown:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException

I followed these steps which I learned from online keytool & SSL cert tutorials:

I copied the HTTPS URL into the browser, downloaded the SSL certificates & Installed them in the browser using Internet Explorer.
Exported the certificates to a path on my computer, the certificates were saved as .cer

Used the keytool's import option. The command below executed without any errors.

keytool -import -alias downloadedCertAlias -keystore C:\path\to\my\keystore\cacerts.file -file C:\path\of\exportedCert.cer

I was prompted for a password at the command prompt, which I entered then I was authenticated.
The cmd window printed some certificate data & signatures and I was prompted with the question:

Trust this certificate?

I answered yes.
The cmd prompt displayed

Certificate was added to keystore

However after that message, another exception was displayed:
```
keytool error: java.io.FileNotFoundException: C:\Program files\...\cacerts <Access Denied>
```

Finally when I checked the keystore , the SSL certificate was not added and my application gives the same exception I was getting earlier when trying to connect:

(javax.net.ssl.SSLHandshakeException:sun.security.validator.ValidatorException)

could you post the exact `keytool` command that you've executed, and it's output? some of the obvious issues here are the typo of `-keystore` argument, and the fact that keytool was unable to find the keystore to import the key into — Alex, Apr 25 '12 at 18:39
I meant to write: keytool -import -alias downloadedCertAlias -keystore C:\path\to\my\keystore\cacerts.file -file C:\path\of\exportedCert.cer I also mentioned the command executed without errors, so obviously this is just spelling mistake in my question!!! Thanks anyways — cyber101, Apr 26 '12 at 01:02

score 328 · Answer 1 · edited May 02 '18 at 05:47

328

This could happen if you are not running the command prompt in administrator mode. If you are using windows 7, you can go to run, type cmd and hit Ctrl+Shift+enter. This will open the command prompt in administrator mode. If not, you can also go to start -> all programs -> accessories -> right click command prompt and click 'run as administrator'.

edited May 02 '18 at 05:47

Afshar

262
3
10

answered Jul 05 '12 at 17:58

Sharan Rajendran

3,549
2
19
6

19

For Mac users, a simple sudo will fix this issue. – truthful_ness May 26 '14 at 17:14
21

running as admin is not the right solution. Most companies are locking down admin access. Better to fix the reason as to why access is denied rather than elevating the previlages. – skword Jan 21 '15 at 12:34
1

type cmd and hit Ctrl+Shift+enter and added certificate successfully- Its worked for me – deadend Feb 10 '17 at 05:53
Thanks. control-shift CMD was the only way I could alter cacerts store. – Malcolm Boekhoff Nov 26 '19 at 04:47
@Afshar thanks a lot i have been struggling with this for quite a long time. – Rajan Chauhan Mar 31 '20 at 11:40
4

Seriously, I keep on getting this error and it's a company laptop, no chance in hell of me being able to run anything as admin. The fact that most of the answers here rely on being able to run as administrator is frustrating. – quantumferret Feb 10 '21 at 11:13

score 46 · Accepted Answer · answered Dec 06 '17 at 08:07

46

I was having the same problem while importing the certificate in local keystore. Whenever i issue the keytool command i got the following error.

Certificate was added to keystore keytool error: java.io.FileNotFoundException: C:\Program Files\Java\jdk1.8.0_151\jre\lib\security (Access is denied)

Following solution work for me.

1) make sure you are running command prompt in Rus as Administrator mode

2) Change your current directory to %JAVA_HOME%\jre\lib\security

3) then Issue the below command

keytool -import -alias "mycertificatedemo" -file "C:\Users\name\Downloads\abc.crt" -keystore cacerts

3) give the password changeit

4) enter y

5) you will see the following message on successful "Certificate was added to keystore"

Make sure you are giving the "cacerts" only in -keystore param value , as i was giving the full path like "C**:\Program Files\Java\jdk1.8.0_151\jre\lib\security**".

Hope this will work

answered Dec 06 '17 at 08:07

Waqas Ahmed

4,801
3
36
45

2

As mentioned here, being actually _in_ the security directory and _only_ giving the "cacerts" name of the cert instead of the full path was what worked for me. – risingTide Dec 20 '18 at 15:55
I used sudo -i to make myself the superuser in the first step on Mac and followed the steps and it worked. I opened up carets file as a text file and found my certificate by doing command f to search for its name (or anything else relating to the certificate). – Chigozie A. Jun 27 '19 at 16:22
2

doing a `cd $JAVA_HOME/jre/lib/security` and then making sure to only pass `-keystore cacerts` without the path fixed the problem for me.. – AO_ Sep 04 '20 at 10:03

score 27 · Answer 3 · answered May 03 '12 at 09:07

27

I had the same problem under Windows and could solve it by running cmd.exe as administrator (right-click in start menu, then "Run as administrator).

answered May 03 '12 at 09:07

Daniel N.

831
1
7
13

score 13 · Answer 4 · edited Jul 22 '12 at 16:30

13

Check the write permissions on the keystore.

edited Jul 22 '12 at 16:30

Makoto

104,088
27
192
230

answered Jun 27 '12 at 16:51

partha saradhi

147
1
2

2

If anyone can expand on this, just checking the permissions won't change anything. – user3071284 Apr 05 '17 at 14:36
setting the tomcat directory to read-only will cause this exception – svarog Nov 18 '17 at 20:25
how to chek the weite permission? – Ahmad Arslan Oct 11 '18 at 10:34

score 7 · Answer 5 · answered Jun 21 '17 at 19:17

7

For Mac users make sure to sudo and when prompted first give your administrator password and that will be followed by keystore password which typically should be "changeit" unless you actually changed it.

answered Jun 21 '17 at 19:17

V K

87
1
3

score 2 · Answer 6 · edited Mar 17 '16 at 06:33

2

If you are using windows8:

Click start button
In the search box, type command prompt
From the result, right-click command prompt and click Run as administrator. Then execute the keytool command.

edited Mar 17 '16 at 06:33

Ori Lentz

3,668
6
22
28

answered Mar 17 '16 at 06:16

arungopal

21
2

score 2 · Answer 7 · edited Jun 16 '20 at 01:24

2

I got this error too even I ran cmd as an Administrator.

The root cause is: The file is from VCS(subversion, perforce, etc.), and when I checked the properties of this file, its' Attributes is Read-only.

So the solution is:

(1) disable the 'Read-only' Attribute;
(2) check out from VCS, let the file under the status of read&write.

edited Jun 16 '20 at 01:24

Matt Ke

3,599
12
30
49

answered Jun 16 '20 at 01:01

Schroeder

61
6

Wow. This with the other solutions works for me. Thanks! – Jesse May 03 '23 at 22:33

score 1 · Answer 8 · answered May 31 '16 at 22:34

1

You can give yourself permissions to fix this problem.

Right click on cacerts > choose properties > select Securit tab > Allow all permissions to all the Group and user names.

This worked for me.

answered May 31 '16 at 22:34

goyalshub1509

39
3

score 1 · Answer 9 · answered Feb 11 '22 at 13:31

1

Make sure you running as Administrator. In Mac terminal:-

Run sudo -i
Then execute the commands

answered Feb 11 '22 at 13:31

Newbie10

11
1

score 1 · Answer 10 · answered Sep 15 '22 at 20:45

1

To solve this Problem you have to access as Admin or give full Control for user privileges. It solved that Problem with me.

answered Sep 15 '22 at 20:45

Ahmed Ahmed

57
2

score 0 · Answer 11 · answered Feb 14 '17 at 12:59

I even run the command prompt as Administrator but it didn't work for me with the below error.

'keytool' is not recognized as an internal or external command,
 operable program or batch file.

If the path to the keytool is not in your System paths then you will need to use the full path to use the keytool, which is

C:\Program Files\Java\jre<version>\bin

So, the command should be like

"C:\Program Files\Java\jre<version>\bin\keytool.exe" -importcert -alias certificateFileAlias -file CertificateFileName.cer -keystore cacerts

that worked for me.

score 0 · Answer 12 · answered Jun 12 '23 at 13:07

0

Our keystore was stored in SCM, and for some reason downloading the file directly from the SCM service again, enabled modifying the keystore. Probably the earlier download of the file didn't bring it in binary format.

answered Jun 12 '23 at 13:07

Tuula

176
2
10

score -2 · Answer 13 · edited Oct 14 '16 at 09:22

-2

You can store orther disk or path (not C) EX : D\

C:\Program Files\Java\jre1.8.0_101\bin>keytool -genkey -alias server -keyalg RSA -keysize 2048 -keystore D:\myserver.jks -dname "CN=myserver,OU=IT-WebDev, O=TIACHOP, L=HCM, ST=0753, C=VN" && keytool -certreq -alias server -file D:\myserver.csr -keystore D:\myserver.jks

edited Oct 14 '16 at 09:22

Prasad Khode

6,602
11
44
59

answered Oct 13 '16 at 13:48

maithanhduyan

1
1

score -2 · Answer 14 · answered Sep 13 '17 at 07:32

-2

SOLVED

Just run CMD as an administrator.
Make sure your using the correct truststore password

answered Sep 13 '17 at 07:32

Ismael ozil

573
5
6

Java Keytool error after importing certificate , "keytool error: java.io.FileNotFoundException & Access Denied"

14 Answers14

Linked

Related