Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've generated an SSL certificate with keytool:

keytool -keystore keystore -alias mySite -genkey -keyalg RSA -keysize 2048

I got this configured and working fine, but obviously it wasn't signed by a trusted CA, so I generated a CSR:

keytool -certreq -alias mySite -keystore keystore -file mySite.csr

GoDaddy gave me two certificates back, which I imported into my keystore:

keytool -keystore keystore -import -alias -file
keytool -keystore keystore -import -alias gd_bundle -file gd_bundle.crt

I thought this would be sufficient, but I am still getting an untrusted certificate warning when I hit my app through the browser. Am I missing a step? My app is running on Jetty, and the only configuration I've provided is the keystore and the key-password.

I am getting the following exception: Received fatal alert: bad_certificate
share|improve this question
up vote 1 down vote accepted

After messing around with this for a couple hours, I was able to find a solution. I ended up using openssl instead of keytool:

openssl genrsa -des3 -out mysite.key 2048
openssl req -new -key mysite.key -out mysite.csr

Submit the CSR, and once you get issued a cert:

openssl pkcs12 -export -chain -CAfile gd_bundle.crt -in -inkey mysite.key -out mysite.pkcs12
java -classpath jetty-util-6.1.26.jar:jetty-6.1.26.jar mysite.pkcs12 keystore

Hope others find this useful!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.