3

I have a situation where there's a keystore file with the various root/intermediate certificates stored in it in a way that it seems to work for most browsers.

Problem is that when mobile browsers hit it, there's a break in the chain and they complain.

I used an SSL checker at http://www.sslshopper.com/ssl-checker.html and it states that "The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate." So...the desktop browsers must have the intermediate certs already and can make the chain connections, I'm assuming, while the mobile browsers can't.

The thing is that I had used Portecle to export certificates from the keystore and cobble them together to create a .PEM certificate to run the Monit utility. When I check that application with the SSL checker, it works fine!

The person that originally created the keystore said he couldn't follow the SSL provider's directions for creating the keystore because he created the CSR request using openssl, so the cert and private key had to be converted to DER format and use importkey to get it to work; following the directions he found online had importkey seem to use only a set keystore file as a result, and it would erase anything already in the file if it existed.

So is there a way to take the certificate I created for Monit and create a working keystore for the Tomcat website?

What would be causing the chain to be broken in the current keystore, but work for Monit?

I have the SSL cert provider's intermediate and cross certificates, and the website's certificate, but is what else would I need to create a working chain of certs for a keystore?

Improve this question
0

1 Answer 1

Reset to default
1

I'm not sure how it works with Monit, but I'll assume what you've done is creating a concatenation of PEM structures to build your certificate chain, like so:

-----BEGIN CERTIFICATE-----
MIICajCCAdOgAwIBAgIBAjANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJVSzEa
....
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIICkjCCAfugAwIBAgIJAKm5bDEMxZd7MA0GCSqGSIb3DQEBBQUAMDsxCzAJBgNV
....
-----END CERTIFICATE-----

You can use keytool to re-import the whole chain against your alias (rather than just the certificate), which should help the server send the correct chain:

keytool -importcert -keystore store.jks -alias myalias -file bundle.pem

(There are more details in this answer: the question was about client certificates from the client side, but the same commands will apply for your server cert from the server side.)

Improve this answer
8
  • In the other answer, you said, "If you only get one certificate per alias entry, they're not not together." When I run "keytool -list -keystore <mystorefile>" it says it has one entry, and there's one alias. The .pem I imported has four certificates concatenated together. Should it be showing 4 entries, or just the one entry?
    – Bart Silverstrim
    Commented Mar 21, 2012 at 15:16
  • You want all your certs in the same alias, if you use -v for the details when you list them, they should follow one another (issuer DN becomes subject DN). Your entire chain (4 certs) should be in your single alias entry (unless you also have other aliases, but they'd be unrelated).
    – Bruno
    Commented Mar 21, 2012 at 15:19
  • -v shows a chain length of 4, with 1 entry, one alias, entrytype PrivateKeyEntry. That's the same information that the keystore that wasn't working was giving with the -v, though.
    – Bart Silverstrim
    Commented Mar 21, 2012 at 15:37
  • Just ran the keytool -list -keystore <file> -v command against a copy of the old keystore and new one, redirected to text files, ran a diff and the only difference was the "Creation date." The old one still threw errors when he tested it. :-/
    – Bart Silverstrim
    Commented Mar 21, 2012 at 15:39
  • This should work. In doubt, make a copy and re-import the chain. It might also be worth checking which certs are presented using openssl s_client -connect your.host.name:443 (if you have OpenSSL somewhere).
    – Bruno
    Commented Mar 21, 2012 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.