Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a .crt file to update the server thats running Tomcat 5.5. If I run:

keytool - import -alias tomcat -keystore tomcat.ks - trustcacerts -file

I get the following error:

keytool error: gnu.javax.crypto.keyring.MalformedKeyringException: incorrect magic

BTW, the default password for the keystore file is changeit and I am not sure why its not accepting it

share|improve this question
Check out:… – Warner Jul 19 '10 at 18:37

We had the same issue with our certificate, but the support guys there were very helpful and told us basically there were multiple versions of java on our server and that we needed to explicitly invoke the keytool app from the version we are working with to avoid conflicts. For example, on our server:

instead of

keytool - import -alias tomcat -keystore tomcat.ks - trustcacerts -file

we would use

/usr/local/jdk/keytool - import -alias tomcat -keystore tomcat.ks - trustcacerts -file
share|improve this answer
This worked for me. Thanks – Sanjeev Kumar Dangi May 6 '13 at 7:37

I think it's saying that your keystore is messed up. Can you do anything with the keystore to see if it's bad?

share|improve this answer
I tried importing the root certificate and new certificate to a new local keystore by running: keytool -import -alias root -keystore tomcat.ks -trustcacerts -file gd_intermediate.crt and keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file I shutdown and startup the tomcat server and the site to https:// can't be displayed. so I have to restore to the old keystore file to get it up and running again but it needs to renewed for SSL. Please advise – Steve Jul 19 '10 at 18:31
The logs say SEVERE: Catalina.start: LifecycleException: service.getName(): "Catalina"; Protocol handler start failed: Invalid keystore format at org.apache.catalina.connector.Connector.start( – Steve Jul 19 '10 at 18:36

Your keystore needs to have more than just your own certificate info; it also needs to have the certs chaining back to your Certificate Authority (CA). For mine, I end up with four entries in my keystore, only one of which is specific to me. I just did this for my GoDaddy certificate; these are the commands I entered:

>keytool -import -alias root -keystore tomcat.sat.keystore -tr ustcacerts -file valicert_class2_root.crt 

Enter keystore password: PASSWORD 

Certificate already exists in system-wide CA keystore under alias <valicertclass2ca> Do you still want to add it to your own keystore? [no]: yes 

Certificate was added to keystore 

>keytool -import -alias cross -keystore tomcat.sat.keystore -trustcacerts -file gd_cross_intermediate.crt 

Enter keystore password: PASSWORD 

Certificate was added to keystore 

>keytool -import -alias intermed -keystore tomcat.sat.keystore -trustcacerts -file gd_intermediate.crt 

Enter keystore password: PASSWORD 

Certificate was added to keystore  

>keytool -import -alias tomcat -keystore tomcat.sat.keystore -trustcacerts -file 

Enter keystore password: PASSWORD

Certificate reply was installed in keystore  
share|improve this answer

You might want to get your keystore in order first. Keytool can be painful to use.

Check out and see if that helps.

share|improve this answer

I think you're running the wrong keytool. The on that comes with the JDK doesn't use that class. Do you have GNU CLASSPATH installed? if so, remove it. It isn't Java, just a poor and very partial imitation. And then repeat everything, using the original keystore. Anything that was created by the wrong keytool should be thrown away.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.