33

Generate keystore:

keytool -genkey -alias tomcat -keyalg RSA -keystore my.keystore -keysize 2048

Generate certificate signing request (CSR):

keytool -certreq -alias tomcat -keyalg RSA -file my.csr -keystore my.keystore

I then go off to my hosting provider and get some certificates. These i installed as follows:

keytool -import -alias root -keystore my.keystore -trustcacerts -file gd_bundle-g2-g1.crt
keytool -import -alias intermed -keystore my.keystore -trustcacerts -file gdig2.crt
keytool -import -alias tomcat -keystore my.keystore -trustcacerts -file my.crt

When I installed the final certificate (my.crt) I got the following error:

keytool error: java.lang.Exception: Failed to establish chain from reply

I believe i have imported the chain and in the correct order so I'm very confused by this message. Can anyone see what I'm doing wrong?

Mike Cluck
  • 31,869
  • 13
  • 80
  • 91
Edd
  • 8,402
  • 14
  • 47
  • 73
  • Possible duplicate of [Import certificate as PrivateKeyEntry](https://stackoverflow.com/questions/24974324/import-certificate-as-privatekeyentry) – user207421 Jul 31 '19 at 01:29
  • @user207421 this question predates the one you have linked. The newer question would be the duplicate, not the older one. I wouldn't say that the question you linked is a duplicate of this one though – Edd Aug 05 '19 at 18:08

7 Answers7

27

I've just discovered that the files godaddy supplied with my certificate are both intermediate certificates (in fact they seem to both be the same intermediate certificate).

I got the correct root and intermediate certificates by double clicking on my certificate and looking at the certificate path... from here I could also download each of these certificates and use the steps used in the question to import them

enter image description here

Edd
  • 8,402
  • 14
  • 47
  • 73
  • 4
    I went to the godaddy cert store at https://certs.godaddy.com/repository and grabbed "gdroot-g2.crt" , installed that, and then I was able to install my cert. – Jonesome Reinstate Monica Nov 10 '14 at 17:24
  • It seems that the cause is that the keytool doesn't import all of the certificates in the bundles. – Frank Henard Feb 03 '15 at 20:34
  • 1
    This thread has saved me multiple times. The zip that godaddy gives you when you get a cert includes TWO intermediate certs (you only need one of them), and your cert. It lacks a root cert. Their bad. – Jonesome Reinstate Monica Aug 18 '15 at 17:02
22

I struggled with the same problem for about two weeks until I found a way around it. The problems was that the root and intermediate certificates that came with my certificate from Godaddy were not the ones I needed. I looked many times in Godaddy's repository unable to find the suitable certificates.

I viewed my certificate on my laptop (using Windows 8.1). There I saw the certificate chain, and I was able to export the root and intermediate certificates. Then I imported them to my keystore and it worked as it should.

To do this follow this instructions:

  1. View your certificate on a computer running Windows. You will be able to see the certificate chain on the third tab that looks as the following image.enter image description here

  2. Select the root certificate from the chain and click on the button "View Certificate".

  3. A new window opens, go to the second tab and click on the "Save File" button. This opens an export wizard for your ceritficate.
  4. When exporting, select the X.509 base 64 option and follow the instructions. Save the file.
  5. Repeat for the intermediate certificate.
  6. Upload both certificates to your server and import into the keystore following the order - first root, second intermediate and finally your certificate. [It's not necessary to import the root certificate]

NOTE: Before I imported those certificates, I had to delete the ones that were on my keystore and were not working. To do so, I used the following instructions:

keytool -delete -alias [root] -keystore [keystore file]

If you are not sure what is inside your keytool, you can view by using:

keytool -list -keystore [keystore file]
caot
  • 3,066
  • 35
  • 37
Alejandro von Wuthenau
  • 221
  • 2
  • 2
  • 1
    This is the best answer I could find! Thanks. – caot Dec 12 '17 at 22:23
  • I was able to extract Intermediate certificate from the provided certificate as you explained, thanks a lot – srlgrg Jul 09 '19 at 14:51
  • For any given certificate (or signed response) one can get the CA Issuers URI using `openssl`: For example, for the certificate used by https://www.cnn.com, after saving the file as `cnn.com.pem`. By running `openssl x509 -in cnn.com.pem -noout -text|grep 'CA Issuers'` you will get "CA Issuers - URI: http://secure.globalsign.com/cacert/gsatlasr3dvtlsca2022q1.crt". Obviously, if you download the issuer-CA certificate and you follow the exact same approach using this intermediate/issuer certificate, you will get one level higher and so on. – idrositis Sep 26 '22 at 13:23
18

I got same error when trying to import CA certified certificates in to the keystore, in a Linux environment.

I followed set of steps and imported it successfully.

After receiving CA certified certificates, use the following steps to import the certificates into the keystore.

step 1:

Import root certificate to cacerts which will be available at JAVA_HOME/jre/lib/security folder using following command:

keytool -importcert -alias root -file [root certificate] -keystore cacerts

Once you enter above command it will prompt for password, enter password and click on yes.

step 2:

Import root certificate using following command:

keytool -importcert -alias root -file [root certificate] -keystore [keystore file name]

Once you enter above command it will prompt for password, enter password and click on yes.

step 3:

Import intermediate certificate using following command :

keytool -importcert -alias intermediate -file [intermediate certificate] -keystore [key store file name]

once you enter above command it will prompt for replacing the already certificate enter yes.

Note: intermediate certificate is optional can be ignored, it comes with the root certificate.

step 4:

Import site certificate using following command:

keytool -trustcacerts -importcert -alias [alias name which give during keystore creation] -file [site certificate] -keystore [key store file name]

Environment executed this commands are java version 7. certificate are issued by GODADDY.

for more information refer site : http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html#importCertCmd

Community
  • 1
  • 1
user2870979
  • 181
  • 1
  • 2
  • 1
    Unless you have a self-signed Root-CA, or you have an outdated system, you don't need to add anything under the (system-wide) `cacerts` file. Importing the intermediate CA certificate and using `-trustcacerts` should be enough. – idrositis Sep 26 '22 at 13:31
3

To resolve this issue, use an extra switch (-trustcacerts) in the keytool commands.

The command to import intermediate certificates from the intermediate.cer file to the certificates.ks keystore file should look like this:

keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -import -alias intermediate -trustcacerts -file intermediate.cer

The command to import the certificate from the http.cer file to the certificates.ks keystore file should look like this:

keytool -storetype JCEKS -storepass passwd -keystore certificates.ks -import -alias http -trustcacerts -file http.cer

Re-attempt to complete the creation and importing process of a signed SSL Certificate.

Viraj Nevase
  • 31
  • 1
1

Download certificate chain, open it on Windows - it stores CA certificate and your certificate answer from CA.

First import CA cert to your keystore and then import answer from CA.

SpriteCZ
  • 31
  • 5
0

Correct step for Tomact 7.0 is

Step 1. Generate the Key store

keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore

Step 2. Generate CSR File

keytool -certreq -keyalg RSA -alias tomcat -file your.csr -keystore tomcat.keystore

Step 3 Generate certificate using the CSR file from certificate provider like GoDaddy and download certificate.

Step 4 Download certificate and import the Bundle Crt first keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gd_bundle-g2-g1.crt

Step 5 Download certificate and import the main certificate. keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file f4edf60egajgfafgaf.crt

Command to check whether Keystore is proper included

keytool -list -keystore tomcat.keystore

Ari
  • 341
  • 2
  • 14
-1

The following step is very important before importing the certs into your local key store. After receiving the signed certs from CA).

import root certificate to cacerts which will be available at JAVA_HOME/jre/lib/security folder using following command:

keytool -importcert -alias root -file [root certificate] -keystore cacerts once you enter above command it will prompt for password, enter password and click on yes.

user3877963
  • 348
  • 3
  • 7