Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been having some issues at a client site renewing an SSL cert that previously worked fine.

I am familiar with the keytool JDK command line app, and it was how I installed the intermediate CA and SSL cert in the keystore the first time.

Current setup: 1 VeriSign intermediate CA, 1 tomcat SSL cert

End result desired: 2 new VeriSign intermediate CAs (primary/secondary) and Tomcat SSL renewal cert.

As I see it, the following are my options, but I have not been able to get these to work:

  1. Add New CAs additionally, remove original cert, add replacement cert
  2. Add New CAs additionally, add replacement cert additionally
  3. Remove old CA, add new CAs, remove original cert, add replacement cert
  4. Remove old CA, add new CAs, add replacement cert additionally

Am I missing a fifth option? I can't seem to find any more guidance on VeriSign's site, nor can I find a solution to my problem.

To make sure I've got my method right before getting into the technical details, can someone tell me what the best practice is in this case with VeriSign certs on a Tomcat (6.0.x) server?

Thanks in advance for any help you can give!

-- Sean

share|improve this question
up vote 0 down vote accepted

Below is the recommended steps upon installing VeriSign Intermediate CA certificates and SSL certificate to a keystore.

Step 1: Install Primary Intermediate CA Certificate

keytool -import -trustcacerts -alias primaryca -keystore (your_keystore_filename) -file primaryca.cer

Step 2: Install Secondary Intermediate CA Certificate

keytool -import -trustcacerts -alias secondaryca -keystore (your_keystore_filename) -file secondaryca.cer

Step 3: Install SSL Certificate

keytool -import -trustcacerts -alias (your_alias_name) -keystore (your_keystore_filename) -file (your_certificate_filename)

This information was obtain from VeriSign's knowledge base solution for Intermediate CAs/SSL certificate installation using Tomcat.

share|improve this answer
This is indeed the correct answer. Turns out, I'd been following the correct procedure, but had not been declaring my keysize correctly. Our certificates are RSA 2048, but I'd just been declaring "-keyalg RSA", which defaults to 1024. Though it didn't solve my specific problem that led to this question, it does indeed correctly answer the question. Thanks! – SeanKilleen Mar 10 '11 at 14:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.