Apparently your problem could be a wrong intermediate certificate.
To ensure that you have the correct intermediate certificate.
Run the following command for the server certificate:
openssl x509 -noout -text -in server.pem | grep 'CA Issuers'
Then open URL found by grep:
wget http://url/ -O intermediate.der
Convert downloaded certificate into PEM format:
openssl x509 -in intermediate.der -inform DER -outform PEM -out intermediate.pem
Now you know for sure that
intermediate.pem is the correct intermediate certificate for your server certificate.
Assume, there is one only intermediate certificate in a chain. If there are more, you would need to repeat the commands above for
intermediate.pem to get
intermediate2.pem and so on.
Run the commands below to create JKS store.
Create certificate bundle:
cat server.pem intermediate.pem > bundle.pem
Create pfx/pkcs12 format bundle:
openssl pkcs12 -export -out bundle.pfx -inkey server.key -in bundle.pem
Create JKS keystore:
keytool -importkeystore -srckeystore bundle.pfx -srcstoretype pkcs12 -destkeystore store.jks -deststoretype JKS
keytool -v -list -keystore store.jks
You should see the following listed:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: 1
Creation date: May 19, 2019
Entry type: PrivateKeyEntry
Certificate chain length: 2
Issuer: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
Owner: CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US
Issuer: CN=DST Root CA X3, O=Digital Signature Trust Co.