I am about to install/update/upgrade a SSL certificate in one of the servers which has the following configuration

Server information:
Sever version: Apache Tomcat/6.0.35
OS version: Linux 2.6.18-371.6.1.el5
Architecture: amd64
JVM version: 1.6.0_30-b30
JVM Vendor: Sun Microsystems Inc.
Tomcat location: /user/local/apache-tomcate-6.0.35

Generate new SSL certificate request:

  1. I created a folder name keystore (/user/local/apache-tomcate-6.0.35/keystore)

  2. To create a key : sudo keytool -storepass keypassword -keyalg RSA -keysize 2048 -keystore mydomain.keystore -genkey -alias mydomain

  3. To create SSL certificate request: sudo keytool -storepass keypassword -keystore mydomain.keystore -certreq -keyalg RSA -file mydomain.csr -alias mydomain.com

After successful executing both the commands I got two files keystore folder

  • mydomain.keystore
  • mydomain.csr

The following files are attached into email I received yesterday:

  1. Cabundle.cert (What is this? No mention of it in the Wiki)
  2. Zip file
    a. mydomain.crt
    b. root_certificate.crt
    c. Trend_Micro_CA.crt
    d. Affirmtrust_Networking.crt

Installing the certificate:

As per information from other source I downloaded two other files into keystore folder

  1. http://secure.globalsign.net/cacert/ct_root.der
  2. http://secure.globalsign.net/cacert/sureserverEDU.pem
  3. Import the root certificate ‘ct_root.der’ :

    [root@ mydomain keystore]# sudo keytool -keystore mydomain.keystore -storepass keypassword -importcert -file ct_root.der -trustcacerts -alias globalsignroot


    Certificate already exists in system-wide CA keystore under alias 
    <3getcybertrustsolutionsincgtecybertrustglobal root>
    Do you still want to add it to your own keystore? [no]: yes
    Certificate was added to keystore
  4. Import the sure server education certificate ‘sureserverDDU.pem’:

    [root@ mydomain keystore]# `sudo keytool -keystore mydomain.keystore –storepass keypassword -importcert -file sureserverEDU.pem -trustcacerts -alias sureserveredu`

    Outcome: Certificate was added to keystore

  5. Import the certificate from email: As per wiki I need to import certificate.pem file {{{sudo keytool -keystore mydomain.keystore -storepass keypassword -alias mydomain -import -file mydomain.pem}}}. I don’t have any .pem file in the email I have received and if I run [root@ mydomain keystore]# sudo keytool -keystore mydomain.keystore -storepass keypassword -alias mydomain -import -file mydomain.crt.

    I get an error,

    Keytool error: java.lang.Exceptoin: Failed to establish chain from reply


This is where I am stuck and don’t know what to do, I assume I have to create a chain.pem with all the received certificates inside it. If this is the case in which order I should copy and paste the certificates?

To be honest I don’t want to try anything which I am not sure about it because it is a live server.

I will really appreciate if someone could help me/providing instruction on how to proceed beyond step #5 to successfully install the certificate. I am also confused what is cabundle.crt that comes with the email.

  • 1
    Your Tomcat, Java, Linux kernel and operating system have all been out of support for a very long time and have a catalogue of vulnerabilities. I can only imagine that you are seeking to provide sime sort of security for a system plugged into the internet. Please don't. Terminate the SSL (and all internet traffic) on a proxy in front of this machine today to but some time until you can secure it properly.
    – symcbean
    Apr 30, 2021 at 22:21

1 Answer 1


Note I am omiting the "sudo" part of every command.

Note For security reasons, it is not recommended to use such commands with the -password mypassword part as they may get stored on your command history file.

Your import command could have failed because of input format of mydomain.crt. Check whether you have in PEM or DER format:

openssl x509 -in mydomain.crt -inform DER

If it fails, it is probably already on PEM format, but if not, the output from that command is what the keytool must be fed, but you should use the whole chain instead.

Cabundle.cert could have already the whole chain in order. Do a

grep CERTIFICATE Cabundle.cert

and check if there are 2-4 blocks of BEGIN CERTIFICATE - END CERTIFICATE. If so, make a copy of the file and edit it to strip out the "bag attributes" they sometimes include before each certificate that does not get along with import commands. Just leave the gibberish between the BEGIN and END lines (including them). If not, build your own chained file concatenating such blocks from your certificate, the issuer CA, etc up to the root CA.

Your file should look like:


Repeat your last import command with the new file:

keytool -keystore mydomain.keystore -alias mydomain -import -file CertificateChain.pem

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .