I got the above error when I tried to combine a server certificate, a private key and a certificate chain into a PCKS#12 keystore (step 3) prior to convert it to a JKS keystore. Below are the steps I followed:

1. $ cat New_Internal_Root_CA.txt New_Internal_Intermediate_CA.txt|dos2unix>bnsca.crt

2. $ keytool -importkeystore -srckeystore algoMQ_DEV.jks -destkeystore private_key.p12 -deststoretype PKCS12

3. $ openssl pkcs12 -export -chain -in ALGOMQ.DEV.crt -inkey private_key.pem -out algoMQ_DEV.p12 -name algomq -CAfile bnsca.crt

4. $ keytool -importkeystore -srckeystore algoMQ_DEV.p12 -srcstoretype pkcs12 -destkeystore algoMQ_DEV_1.jks

if I run "openssl pkcs12 -export" command without the "-chain" option in step 3, no error will occur. but then the algoMQ_DEV.p12 generated is not valid since no CA cert will be imported into the new algoMQ_DEV_1.jks in the next command.

Any ideas?


You must log in to answer this question.

Browse other questions tagged .