1

I have SSL up and running and in use with a Tomcat 6.0 webapp. Recently, the SSL cert (A VeriSign cert) expired , I exported a Certificate Sign Request (CSR) went through the process, and received a certificate file with the correct information. The key algorithm is RSA.

The problem occurs when I attempt to import the new cert over the old cert. The following is the output from what happens running keytool

D:\keystore>keytool -import -alias tomcat -keyalg RSA -keystore .keystore -trustcacerts -file D:\keystore\Certificates\tomcat_dev.cer

Enter keystore password:

keytool error: java.lang.Exception: Failed to establish chain from reply

FYI, password is being left as the default "changeit" (it's just a test dev server).

I'm sure the error is on my part, but I'm not sure how to remedy. Do I need to replace the intermediate CA as well?

A little out of leads here and would appreciate any and all advice. Thanks in advance!

Improve this question

2 Answers 2

Reset to default
1

Yes, you'll have to include/replace the Intermediate as well, and do so before importing the new certificate. Most SSL vendors are chaining through intermediates these days, which adds steps.

Improve this answer
1
  • When you say to replace the intermediate, does that mean I should just delete it and then import the new one? I can't seem to find a command to specifically replace, and importing to the same one informs me that it already exists (of course). So far, I have my old CA ("intermediateca") and then two verisign CAs that it looks like are now necessary (a primary and secondary?) I imported those as "intermediatecaprimary" and "intermediatecasecondary". However, I still receive the same error. Commented Feb 11, 2011 at 19:17
1

I found out the problem -- I had been using "-keyalg RSA" but not specifying "-keysize 2048". Therefore, the certificate was defaulting to 1024 instead of 2048 and failing.

Adjusting this caused everything to work completely correctly.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.