Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tried to find this but no luck. I created a JKS keystore and generated a CSR, then imported the signed cert and intermediate and root CA certs. Used this keystore on Tomcat without problems.

Now I want to use the same cert for Apache2 http server on the same machine. I actually want to set up mod_jk to redirect /*.jsp and servlets paths to Tomcat and serve the static content and PHP from Apache2.

I tried to convert JKS to PKCS12 with keytool to afterwards handle it with openssl with a command like this:

keytool -importkeystore -srckeystore foo.jks \
   -destkeystore foo.p12 \
   -srcstoretype jks \
   -deststoretype pkcs12

The problem is only the cert is exported but not the rest of the chain. I actually used this keystore on Apache and it complained about key and cert don't matching (not sure if it's related to the chain or not).

Can anyone point me on the right direction? I am not a server guy and I am kinda lost with all this things :-(

share|improve this question
Have you seen this?… – kernelpanic Nov 5 '12 at 22:35
@kernelpanic Yes, I saw it. The problem is the certificate chain is not exported (ie CA certs and private key) with that method – momo Nov 7 '12 at 3:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.