1

I have SSL up and running and in use with a Tomcat 6.0 webapp. Recently, the SSL cert (A VeriSign cert) expired , I exported a Certificate Sign Request (CSR) went through the process, and received a certificate file with the correct information. The key algorithm is RSA.

The problem occurs when I attempt to import the new cert over the old cert. The following is the output from what happens running keytool

D:\keystore>keytool -import -alias tomcat -keyalg RSA -keystore .keystore -trustcacerts -file D:\keystore\Certificates\tomcat_dev.cer

Enter keystore password:

keytool error: java.lang.Exception: Failed to establish chain from reply

FYI, password is being left as the default "changeit" (it's just a test dev server).

I'm sure the error is on my part, but I'm not sure how to remedy. Do I need to replace the intermediate CA as well?

A little out of leads here and would appreciate any and all advice. Thanks in advance!

Community
  • 1
SeanKilleen
  • 1,073
  • 8
  • 25
  • 38

2 Answers2

1

Yes, you'll have to include/replace the Intermediate as well, and do so before importing the new certificate. Most SSL vendors are chaining through intermediates these days, which adds steps.

sysadmin1138
  • 131,083
  • 18
  • 173
  • 296
  • When you say to replace the intermediate, does that mean I should just delete it and then import the new one? I can't seem to find a command to specifically replace, and importing to the same one informs me that it already exists (of course). So far, I have my old CA ("intermediateca") and then two verisign CAs that it looks like are now necessary (a primary and secondary?) I imported those as "intermediatecaprimary" and "intermediatecasecondary". However, I still receive the same error. – SeanKilleen Feb 11 '11 at 19:17
1

I found out the problem -- I had been using "-keyalg RSA" but not specifying "-keysize 2048". Therefore, the certificate was defaulting to 1024 instead of 2048 and failing.

Adjusting this caused everything to work completely correctly.

SeanKilleen
  • 1,073
  • 8
  • 25
  • 38