I got the above error when I tried to combine a server certificate, a private key and a certificate chain into a PCKS#12 keystore (step 3) prior to convert it to a JKS keystore. Below are the steps I followed:

1. $ cat New_Internal_Root_CA.txt New_Internal_Intermediate_CA.txt|dos2unix>bnsca.crt

2. $ keytool -importkeystore -srckeystore algoMQ_DEV.jks -destkeystore private_key.p12 -deststoretype PKCS12

3. $ openssl pkcs12 -export -chain -in ALGOMQ.DEV.crt -inkey private_key.pem -out algoMQ_DEV.p12 -name algomq -CAfile bnsca.crt

4. $ keytool -importkeystore -srckeystore algoMQ_DEV.p12 -srcstoretype pkcs12 -destkeystore algoMQ_DEV_1.jks

if I run "openssl pkcs12 -export" command without the "-chain" option in step 3, no error will occur. but then the algoMQ_DEV.p12 generated is not valid since no CA cert will be imported into the new algoMQ_DEV_1.jks in the next command.

Any ideas about the error or any suggestion for alternative approaches?

closed as off-topic by Michael Mrozek Mar 12 '17 at 5:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Michael Mrozek

  • Add the root cert of that to the root certs of the keystore – Rui F Ribeiro Mar 10 '17 at 5:14
  • @Rui: thanks. I was able to successfully added them to the jks keystore. I will send it the developers to deploy and let you know the result later. – techie11 Mar 13 '17 at 3:08
  • With crossposting in the stack exchange family, we wont be able to reopen the question to give it a proper answer. I would advise you sticking to that user as you seem to be able to write proper questions. – Rui F Ribeiro Mar 13 '17 at 9:07