Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

There are plenty of resources out there about this topic, but none I found which covers this slightly special case.

I have 4 files;

  • privatekey.pem
  • certificate.pem
  • intermediate_rapidssl.pem
  • ca_geotrust_global.pem

And I wish to import them into a fresh keystore.

Some site suggest to use DER-format, and import them one by one, but this failed because the key is not recognized.

Another site suggested a special "ImportKey"-class to run for import, and this worked until I saw that the chain is broken. I.e. the chain length on the certificate is 1, ignoring the intermediate and ca.

Some sites suggest PKCS7, but I can't even get a chain from that. Other suggest PKCS12 format, but as far as my tests go that failed as well for getting the whole chain.

Any advice or hints are much welcome.

share|improve this question

1 Answer 1

up vote 7 down vote accepted

This may not be perfect, but I had some notes on my use of keytool that I've modified for your scenario.

  1. Import a root or intermediate CA certificate to an existing Java keystore:

    keytool -import -trustcacerts -alias root -file ca_geotrust_global.pem -keystore yourkeystore.jks
    keytool -import -trustcacerts -alias root -file intermediate_rapidssl.pem -keystore yourkeystore.jks 
  2. Combine the certificate and private key into one file before importing.

    cat certificate.pem privatekey.pem > combined.pem

    This should result in a file resembling the below format.


  3. Import a signed primary certificate & key to an existing Java keystore:

    keytool -import -trustcacerts -alias yourdomain -file combined.pem -keystore yourkeystore.jks
share|improve this answer
What version of keytool allows you to chain like this? This syntax gives "keytool error: java.lang.Exception: Certificate not imported, alias <root> already exists" with both -import and -importcert –  ctpenrose Dec 3 '14 at 0:01
Hard to say, exactly. But given the year/month it was likely to be Java 6? (No idea the minor release.) What version are you using? The error reads like the problem could be with the keystore itself. (alias <root> already exists) Can you try with a new, empty keystore? –  Aaron Copley Dec 3 '14 at 14:42
Keytool will not let me import a certificate using an already existing alias 'root'. But i think it was a typo. Interesting to note that keytool creates a chain for your certificate itself when it finds the signers' certificates in the keystore (under any alias). Java tool "Portecle" is handy for managing the java keystore. –  Houtman Dec 10 '14 at 13:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.