How to add certificate chain to keystore?
I solved the problem by cat'ing all the pems together:
cat cert.pem chain.pem fullchain.pem >all.pemopenssl pkcs12 -export -in all.pem -inkey privkey.pem -out cert_and_key.p12 -name tomcat -CAfile chain.pem -caname root -password MYPASSWORDkeytool -importkeystore -deststorepass MYPASSWORD -destkeypass MYPASSWORD -destkeystore MyDSKeyStore.jks -srckeystore cert_and_key.p12 -srcstoretype PKCS12 -srcstorepass MYPASSWORD -alias tomcatkeytool -import -trustcacerts -alias root -file chain.pem -keystore MyDSKeyStore.jks -storepass MYPASSWORD(keytool didn't know what to do with a PKCS7 formatted key)
I got all the pems from letsencrypt
From the keytool man - it imports certificate chain, if input is given in PKCS#7 format, otherwise only the single certificate is imported.You should be able to convert certificates to PKCS#7 format with openssl, via openssl crl2pkcs7 command.