I'm trying to import a CA-signed certificate into a Java keystore. All the instructions I can find for this tell me to first create a keystore and a signing request (CSR) using the Java keytool, then have the CSR signed by the CA, and then import the signed certificate back into the keystore.
Well, stupid me didn't read the fine manual and had the CA create the certificate online for me instead of uploading my own CSR. Now I've got:
ca.pemroot certificate of the CA
sub.class1.server.ca.pemintermediate certificate of the CA
mydomain.crtsigned certificate for my domain, created by the CA
mydomain.keyprivate key file for my certificate, created by the CA
I tried to import the certificate to my keystore like this:
keytool -import -trustcacerts -alias root -file ca.pem -keystore mykeystore.jks keytool -import -trustcacerts -alias intermediate -file sub.class1.server.ca.pem -keystore mykeystore.jks keytool -import -alias mydomain mydomain.crt -keystore mykeystore.jks
So the content of the keystore now looks like this:
intermediate, Jul 16, 2015, trustedCertEntry, Certificate fingerprint (SHA1): 0A:D3:... root, Jul 16, 2015, trustedCertEntry, Certificate fingerprint (SHA1): 3E:2B:... mydomain, Jul 16, 2015, trustedCertEntry, Certificate fingerprint (SHA1): 18:F2:... selfsigned, Feb 4, 2015, PrivateKeyEntry, Certificate fingerprint (SHA1): 2B:74:...
Unfortunately, the service I'm trying to secure (a JIRA server) is not reachable when using the „mydomain“ alias. When I use the „selfsigned“ alias, which is a self-signed certificate I created from the keystore earlier, with all other settings being identical, the service can be reached just fine (except for the warning about the self-signed certificate, of course); so I figure that the problem is the CA-generated certificate.
I tried concatenating the mydomain.crt and mydomain.key files as suggested in this thread without success: Import of PEM certificate chain and key to Java Keystore
Is there something I might be doing wrong? Is it possible to import a certificate created by a third party into an existing Java keystore at all? Or do I need to revoke that certificate and go through the process again with a selfmade CSR extracted from my keystore?