P7b file and cer file do I need them both

Question

I'm trying to understand why I need the chain at all (p7b). I have imported certificates previously and I didn't need one. Can I bypass this somehow?

Well I am getting an error - keytool error: java.lang.Exception: Input not an X.509 certificate

java.lang.Exception: Input not an X.509 certificate
        at sun.security.tools.KeyTool.addTrustedCert(KeyTool.java:1913)
        at sun.security.tools.KeyTool.doCommands(KeyTool.java:818)
        at sun.security.tools.KeyTool.run(KeyTool.java:172)
        at sun.security.tools.KeyTool.main(KeyTool.java:166)

I have two files from godaddy - certificatechain.p7b and certificate.cer. I am running basic key tool commands to create the keystore, create csr and to import the certificate I have tried

download openssl, convert to two DER certs, concatenate and import
import just the p7b
import just the .cer
convert the p7b to cer and import just the old p7b/new cer
convert the p7b to cer and import both

"D:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin\keytool" -genkey -alias *.server.com -keyalg RSA -keysize 2048 -keystore serverkeystore.jks -dname "CN=snoke, O=My company Inc., L=Sometown, ST=Wisconsin, C=US" && "D:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin\keytool" -certreq -alias *.server.com -file serverkeystore.csr -keystore serverkeystore.jks

Then I realized I have not high understanding of certificates, or at least I'm not thinking of them in the right way now so maybe if someone could just tell something they have seen similar in past then that could be helpful. I think I am supposed to do something with both of the files other than just trying to import them both.

I am on Windows Server 2012.

score 1 · Accepted Answer · edited May 23 '17 at 12:41

The java keytool keystores generally require that you import the Certificate Authority root-cert, then the chain/intermediate-cert, then the SSL certificate itself.

The section "Installation Option Two: Installing SSL Certificate and Intermediate Certificates Separately" of the godaddy instructions for renewing certs for Tomcat use seem to apply. https://www.godaddy.com/help/ssl-certificate-renewal-tomcat-4x5x6x-5355

The StackOverflow answer that goes into more detail is here: https://stackoverflow.com/questions/24269293/how-to-import-godaddy-certificates-in-tomcat-given-gd-bundle-g2-g1-crt-gdig2-cr

P7b file and cer file do I need them both

1 Answers1