Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to create a keystore file with a certificate and a chain.cer file.

# openssl pkcs12 -export -chain -CAfile chain.cer -in example.cer -inkey example.key -out keystore.jks -name tomcat -passout pass:changeit
Error unable to get issuer certificate getting chain.

Question

Does anyone know what I am doing wrong?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

keytool is the command you are looking for to work with Java keystore files. It is provided by the Java JDK. (You might be able to do it with openssl, but I am not aware of it.)

And to import a root or intermediate CA certificate into a keystore:

keytool -import -trustcacerts -alias root -file cachain.crt -keystore keystore.jks

For more information and examples:
The Most Common Java Keytool Keystore Commands

share|improve this answer
    
keytool looks very interesting. When I do this, Internet Explorer can still not see the chain cert. Works in FF and Chrome though. –  Sandra Jan 15 '13 at 16:07
    
Interesting. Try adding the individual certificates instead of a chain? Sounds like an IE problem at that point. –  Aaron Copley Jan 15 '13 at 16:16
    
Correction. Just tried with FF on Windows. It also thinks the certificate is untrusted. –  Sandra Jan 15 '13 at 16:19
    
How do I "add the individual certificates? –  Sandra Jan 15 '13 at 16:21
    
Instead of importing one chain cert, source the certificates (from the issuer) which make up the chain. Refer to the examples in the link above. –  Aaron Copley Jan 15 '13 at 16:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.