I have created a self-signed certificate in nginx server in ubuntu as below:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt

Coverted crt to pem using open ssl:

openssl x509 -in nginx-selfsigned.crt -out nginx-selfsigned.pem -outform PEM

When I import this certificate using keytool in debian, the import process is successful:

sudo keytool -importcert -keystore /certs -storepass changeit -file nginx-selfsigned.pem -alias some alias

But after that, the certificate isn't trusted. Why the importing certificate isn't trusted?

Any suggestion about this issue would be appreciated.


If you want the self signed certificate to be trusted, it must be in the "Trusted CAs" certificate store on each client that is connecting. Depending on your browser, you should be able to view the cert and see why it doesn't trust it also (e.g. not yet valid, expired, name mismatch, not from trusted CA, etc.)

  • I have added certificate: sudo cp /etc/nginx/ssl/nginx.crt /usr/local/share/ca-certificates. But still I have this error from responding server: java.security.cert.CertificateException: None of the TrustManagers trust this certificate chain – Jasmine May 9 '17 at 19:32
  • Is this error when you access the web page, or what are you using this certificate for? – Cory Knutson May 9 '17 at 20:54
  • I'm using this certificate for a web service – Jasmine May 9 '17 at 20:56
  • Where is the error coming from? The web page or trying to install the cert? – Cory Knutson May 9 '17 at 20:57
  • I have imported my webservice certification into responding server with keytools. – Jasmine May 9 '17 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.