#KEYSTORE EXPLORER IMPORT X509 HOW TO#

Jssecacerts needs to start as a copy of cacerts, which it overrides rather than extends. JSSE will use the jssecacerts file, if present, instead of cacerts. This will leave the original cacerts file available as a backup. The general import procedure is described below, followed by examples for Linux and Windows.Ĭopy the default keystore $JDK_HOME/lib/security/cacerts as $JDK_HOME/lib/security/jssecacerts. If you do opt to use an untrusted certificate, then you must import it into the Java keystore. Use of a trusted certificate is preferred and recommended because using an untrusted certificate, such as a self-signed certificate, will cause web services communication to fail with the SSLHandshakeException error. The information is important only if you are not using a SSL certificate that is signed by an authority trusted by Java. Use of a trusted certificate is preferred and recommended because using an untrusted certificate, such as a self-signed certificate, will cause web services communication to fail with the SSLHandshakeException error.īefore making the switch from Oracle JDK8 to OpenJDK 11. You are not using a SSL certificate that is signed by an authority trusted by Java. You import a certificate for two reasons: To add it to the list of trusted certificates, and to import a certificate reply received from a certificate authority (CA) as the result of submitting a Certificate Signing Request to that CA (see the -certreq option in Commands).You will need to import a certificate to the Java Keystore if: If that certificate is not self-signed, then you need a certificate for its signer, and so on, up to a self-signed root CA certificate. If the certificate reply is a single certificate, then you need a certificate for the issuing CA (the one that signed it). The root CA certificate that authenticates the public key of the CA.

If the certificate reply is a certificate chain, then you need the top certificate of the chain. You now need to replace the self-signed certificate with a certificate chain, where each certificate in the chain authenticates the public key of the signer of the previous certificate in the chain, up to a root CA.īefore you import the certificate reply from a CA, you need one or more trusted certificates in your keystore or in the cacerts keystore file. Read the following documentation: Import a Certificate for the CA

If it can't do that, the import will fail. keytool will search the key store and trust store until it reaches a trusted root certificate. At this time, keytool will try to build a certificate chain for it. When you attempt to import the CSR reply, you're importing a new certificate. keytool always wants a complete certificate chain for every certificate. (That's why you had to provide its expiration date and other details during generation.) As a result, it forms a complete certificate chain by itself it's a root certificate. When you generated the mykeypair key pair, keytool wrapped mykeypair's public key in a self-signed certificate. You don't have the complete certificate chain for the new certificate.

Is CSR reply really meant to alter the thumbprint and issuer attributes of the key-pair in which the CSR was generated from?.

How do I import the CSR reply back into my key-pair via command line such that it's going to take the thumbprint and the issuer of the CSR reply as the new attributes of my original key-pair? (I'm just assuming this is the expected outcome because when I generate JWT using the private key that takes its thumbprint, authentication fails).

The command I used to import CSR back into my key-pair that generated that error: keytool -keystore myKeyStore.pfx -importcert -file m圜SRreply.cer -alias mykeypair keytool error: : Failed to establish chain from If I tried importing where I specify the CSR reply file and the alias to my original key-pair, I'm getting the following error.

#KEYSTORE EXPLORER IMPORT X509 HOW TO#

I'm able to do what I want to achieve via KeyStore explorer as shown in the following screenshot but I need to know how to do this in command line. I'm expecting it to change the issuer and thumbprint of my original key-pair. It simply added the CSR reply as another entry.

I've tried simply importing the CSR reply to my keystore using keytool -import command but that did not change my original key-pair. Now that I got the CSR reply m圜SRreply.cer, how do I incorporate the CSR reply with my original key-pair? I've created a keystore with an initial key-pair using keytool -genkeypair command, then generated the CSR using keytool -certreg command, then got it signed by our CA.

Keystore explorer import x509