keytool error: java.lang.Exception: Failed to establish chain from reply

tomcat ssl-certificate keytool
Edd picture Edd · May 12, 2014 · Viewed 95.2k times · Source

Generate keystore:

keytool -genkey -alias tomcat -keyalg RSA -keystore my.keystore -keysize 2048

Generate certificate signing request (CSR):

keytool -certreq -alias tomcat -keyalg RSA -file my.csr -keystore my.keystore

I then go off to my hosting provider and get some certificates. These i installed as follows:

keytool -import -alias root -keystore my.keystore -trustcacerts -file gd_bundle-g2-g1.crt
keytool -import -alias intermed -keystore my.keystore -trustcacerts -file gdig2.crt
keytool -import -alias tomcat -keystore my.keystore -trustcacerts -file my.crt

When I installed the final certificate (my.crt) I got the following error:

keytool error: java.lang.Exception: Failed to establish chain from reply

I believe i have imported the chain and in the correct order so I'm very confused by this message. Can anyone see what I'm doing wrong?

Answer

Edd picture Edd · May 12, 2014

I've just discovered that the files godaddy supplied with my certificate are both intermediate certificates (in fact they seem to both be the same intermediate certificate).

I got the correct root and intermediate certificates by double clicking on my certificate and looking at the certificate path... from here I could also download each of these certificates and use the steps used in the question to import them

enter image description here

Related questions

Tomcat Server/Client Self-Signed SSL Certificate

I have an Apache Tomcat 6.x server running with a self-signed SSL certificate. I want the client to present their own certificate to the server so I can authenticate them based on a database of users. I have it all …

Read More
Imported certificate to Java keystore, JVM ignores the new cert

I'm trying to get an application running on top of Tomcat 6 to connect to an LDAP server over SSL. I imported certificate of the server to keystore using: C:\Program Files\Java\jdk1.6.0_32\jre\lib\security>keytool -importcert -trustcacerts …

Read More
TLS_RSA_WITH_AES_128_CBC_SHA and SSL_RSA_WITH_AES_128_CBC_SHA

Is there any difference between these cipher suites? They look the same however the first three letters are different. I am referring to TLS_RSA_WITH_AES_128_CBC_SHA and SSL_RSA_WITH_AES_128_CBC_SHA.

Read More