37

There are plenty of resources out there about this topic, but none I found which covers this slightly special case.

I have 4 files;

  • privatekey.pem
  • certificate.pem
  • intermediate_rapidssl.pem
  • ca_geotrust_global.pem

And I wish to import them into a fresh keystore.

Some site suggest to use DER-format, and import them one by one, but this failed because the key is not recognized.

Another site suggested a special "ImportKey"-class to run for import, and this worked until I saw that the chain is broken. I.e. the chain length on the certificate is 1, ignoring the intermediate and ca.

Some sites suggest PKCS7, but I can't even get a chain from that. Other suggest PKCS12 format, but as far as my tests go that failed as well for getting the whole chain.

Any advice or hints are much welcome.

Improve this question

3 Answers 3

Reset to default
31

This may not be perfect, but I had some notes on my use of keytool that I've modified for your scenario.

  1. Import a root or intermediate CA certificate to an existing Java keystore:

    keytool -import -trustcacerts -alias root -file ca_geotrust_global.pem -keystore yourkeystore.jks
keytool -import -trustcacerts -alias root -file intermediate_rapidssl.pem -keystore yourkeystore.jks

  2. Combine the certificate and private key into one file before importing.

    cat certificate.pem privatekey.pem > combined.pem

    This should result in a file resembling the below format.

    BEGIN CERTIFICATE
    ...
    END CERTIFICATE
    BEGIN RSA PRIVATE KEY
    ...
    END RSA PRIVATE KEY

  3. Import a signed primary certificate & key to an existing Java keystore:

    keytool -import -trustcacerts -alias yourdomain -file combined.pem -keystore yourkeystore.jks
Improve this answer
9
  • 2
    What version of keytool allows you to chain like this? This syntax gives "keytool error: java.lang.Exception: Certificate not imported, alias <root> already exists" with both -import and -importcert
    – ctpenrose
    Dec 3, 2014 at 0:01
  • Hard to say, exactly. But given the year/month it was likely to be Java 6? (No idea the minor release.) What version are you using? The error reads like the problem could be with the keystore itself. (alias <root> already exists) Can you try with a new, empty keystore?
    – Aaron Copley
    Dec 3, 2014 at 14:42
  • 1
    Keytool will not let me import a certificate using an already existing alias 'root'. But i think it was a typo. Interesting to note that keytool creates a chain for your certificate itself when it finds the signers' certificates in the keystore (under any alias). Java tool "Portecle" is handy for managing the java keystore.
    – Houtman
    Dec 10, 2014 at 13:42
  • Keytool doesn't work like this, and doesn't allow you to import an alias more than once as described. (And yes, I've tried). See senajqerib's answer below for something that works properly.
    – Steve Sether
    Feb 22, 2016 at 17:06
  • 1
    It's a three year old answer. It is entirely possible that things have changed, but I assure you it worked (or was close to working as I indicated it may not be perfect) as of Feb. 2013. Please feel free to submit an edit or flag it for moderator attention.
    – Aaron Copley
    Feb 22, 2016 at 18:08
57

Concatenate all *.pem files into one pem file, like all.pem Then create keystore in p12 format with private key + all.pem

openssl pkcs12 -export -inkey private.key -in all.pem -name test -out test.p12

Then export p12 into jks 

keytool -importkeystore -srckeystore test.p12 -srcstoretype pkcs12 -destkeystore test.jks
Improve this answer
6
  • Thank you. This is the only complete and correct answer. As you suggested, it's far easier to just concatenate together the certs into one file.
    – Steve Sether
    Feb 22, 2016 at 17:03
  • This worked like a treat for me!! I used these instructions to convert a chain of keys used in nodejs-self-signed-certificate-example repository to talk to a Java based TLS server. Thanks a million!
    – Galder Zamarreño
    Nov 11, 2016 at 13:56
  • 1
    This is the correct answer.
    – sfThomas
    Jun 12, 2017 at 10:24
  • Does "all.pem" also contain the private key?
    – JustAGuy
    Sep 10, 2020 at 14:56
  • 1
    JustAGuy, all.pem does not contain private.key. Private key file (above: private.key) is stored in a separate file.
    – senanqerib
    Sep 15, 2020 at 11:13
11

keytool doesn't provide a way to import certificate + private key from a single (combined) file, as proposed above. It runs fine, but only certificate is imported, while private key is ignored. You can check it by keytool -list -v -keystore yourkeystore.jks - yourdomain entry type is TrustedCertEntry, not PrivateKeyEntry.

So to solve the initial problem, one should first create a PKCS#12 keystore using openssl (or similar tool), then import the keystore with keytool -importkeystore.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .