Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have SSL up and running and in use with a Tomcat 6.0 webapp. Recently, the SSL cert (A VeriSign cert) expired , I exported a Certificate Sign Request (CSR) went through the process, and received a certificate file with the correct information. The key algorithm is RSA.

The problem occurs when I attempt to import the new cert over the old cert. The following is the output from what happens running keytool

D:\keystore>keytool -import -alias tomcat -keyalg RSA -keystore .keystore -trustcacerts -file D:\keystore\Certificates\tomcat_dev.cer

Enter keystore password:

keytool error: java.lang.Exception: Failed to establish chain from reply

FYI, password is being left as the default "changeit" (it's just a test dev server).

I'm sure the error is on my part, but I'm not sure how to remedy. Do I need to replace the intermediate CA as well?

A little out of leads here and would appreciate any and all advice. Thanks in advance!

share|improve this question

Yes, you'll have to include/replace the Intermediate as well, and do so before importing the new certificate. Most SSL vendors are chaining through intermediates these days, which adds steps.

share|improve this answer
When you say to replace the intermediate, does that mean I should just delete it and then import the new one? I can't seem to find a command to specifically replace, and importing to the same one informs me that it already exists (of course). So far, I have my old CA ("intermediateca") and then two verisign CAs that it looks like are now necessary (a primary and secondary?) I imported those as "intermediatecaprimary" and "intermediatecasecondary". However, I still receive the same error. – SeanKilleen Feb 11 '11 at 19:17
up vote 0 down vote accepted

I found out the problem -- I had been using "-keyalg RSA" but not specifying "-keysize 2048". Therefore, the certificate was defaulting to 1024 instead of 2048 and failing.

Adjusting this caused everything to work completely correctly.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.