Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to add certificate chain to keystore?

I have file with chain of certificates - certificate.cer:

subject=/C... issuer=/C=US/O=VeriSign, Inc... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----  subject=/C=US/O=VeriSign, Inc... issuer=/C=US/O=VeriSign, Inc... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----  subject=/C=US/O=VeriSign, Inc... issuer=/C=US/O=VeriSign, Inc... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- 

I need to add this chain of certificates to keystore.
What I do:

openssl x509 -outform der -in certificate.cer -out cert.der keytool -v -importcert -alias mykey -file cert.der -keypass <passwd> -keystore keystore -storepass <passwd> -alias <myalias> 

In result I have only 1 certificate in keystore.
But should have 3.
What could be wrong?

SOLUTION:
CA sent me certificates in PKCS#7 format.
I stored them in certificate.p7b file and then successfully added them to keystore by following command:

keytool -import -trustcacerts -file certificate.p7b -keystore keystore -storepass <mypasswd> -alias "myalias" 
like image 812
Volodymyr Bezuglyy Avatar asked Apr 17 '13 13:04

Volodymyr Bezuglyy


People also ask

How do I import a chain of certificates into keystore?

You should be able to convert certificates to PKCS#7 format with openssl, via openssl crl2pkcs7 command. I already have certificates in PKCS#7 format. CA have sent me them in email. Certificates were successfully added to keystore by following command: keytool -import -trustcacerts -file certificate.


1 Answers

I solved the problem by cat'ing all the pems together:

cat cert.pem chain.pem fullchain.pem >all.pem openssl pkcs12 -export -in all.pem -inkey privkey.pem -out cert_and_key.p12 -name tomcat -CAfile chain.pem -caname root -password MYPASSWORD keytool -importkeystore -deststorepass MYPASSWORD -destkeypass MYPASSWORD -destkeystore MyDSKeyStore.jks -srckeystore cert_and_key.p12 -srcstoretype PKCS12 -srcstorepass MYPASSWORD -alias tomcat keytool -import -trustcacerts -alias root -file chain.pem -keystore MyDSKeyStore.jks -storepass MYPASSWORD 

(keytool didn't know what to do with a PKCS7 formatted key)

I got all the pems from letsencrypt

like image 65
nont Avatar answered Oct 05 '22 23:10

nont