Imported certificate to Java keystore, JVM ignores the new cert

java security tomcat ssl-certificate keytool
tputkonen picture tputkonen · May 7, 2012 · Viewed 53.1k times · Source

I'm trying to get an application running on top of Tomcat 6 to connect to an LDAP server over SSL.

I imported certificate of the server to keystore using:

C:\Program Files\Java\jdk1.6.0_32\jre\lib\security>keytool -importcert -trustcacerts -file mycert -alias ca_alias -keystore "c:\Program Files\Java\jdk1.6.0_32\jre\lib\security\cacerts"

When I start Tomcat with SSL debugging turned on, according to logs Tomcat is using the correct certificate file:

trustStore is: C:\Program Files\Java\jdk1.6.0_32\jre\lib\security\cacerts

However, Tomcat does not add the cert I just imported - all other certs in the cacerts file are printed to the log - and connection fails:

handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Restarting Tomcat does not help. I have verified with keytool -list command that the new cert indeed exists on the file.

Why Tomcat keeps on ignoring my new cert?

EDIT:

Seems that the issue was caused by Windows 7 VirtualStore. Keytool created a new copy of the cacert file, and Tomcat used the original file.

Answer

SSLKida picture SSLKida · Oct 28, 2015

JVM needs restart after importing certs to the keystore.

Related questions

Using Apache httpclient for https

I have enabled https in tomcat and have a self-signed certificate for server auth. I have created an http client using Apache httpClient. I have set a trust manager loading the server certificate. The http client can connect with server …

Read More
Forcing Tomcat to use secure JSESSIONID cookie over http

Is there a way to configure Tomcat 7 to create JSESSIONID cookie with a secure flag in all occasions? Usual configuration results in Tomcat flagging session cookie with secure flag only if connection is made through https. However in my production …

Read More
Add HSTS feature to Tomcat

Trust you all well. My web application run on tomcat 6.0.43 and do not use apache or nginx at front. I'm already enforce my web from http redirect to https using: URL Redirect at ../webapps/ROOT/index.jsp <% response.sendRedirect("…

Read More