How do I create a usable certificate-store from several files

Question

We have a process to request a signed cert from a CA and we get back 3 files: cert.cer, cert.key, and cert.p12

I now need to build a valid/usable cert store from those files. I have copies of the CA & intermediate certs locally on my server. So I'm trying to import everything by using keytool. But I end up with a store full of about 100 certs plus the cert for my server. But when I try to use them I'm getting an error that the server cert is not valid unless the signing certs are also in the store. Basically there's no chain even though I the server cert says it was issued by the intermediate cert in the store. I use the following commands to import my certs and ca trusts.

keytool -v -importkeystore -srckeystore "cacerts.p12" -srcstorepass "$CA_PASS" -srcstoretype "pkcs12" -destkeystore "$KEYSTORE_NAME" -deststorepass "$STORE_PW" -deststoretype "jks";
keytool -importkeystore -v -srckeystore "$CERT_NAME.p12" -srcstorepass "$STORE_PW" -srcstoretype "pkcs12" -destkeystore "$KEYSTORE_NAME" -deststorepass "$STORE_PW" -deststoretype "jks";

I'm not sure what step I'm missing. This is an Ubuntu 20.04 server.

Answer 1

How do I create a usable certificate-store ..

Usable is the keyword here - what are you trying to use the keystore for? (usually - SSL, client authentication or WS-Security)

getting an error that the server cert is not valid unless the signing certs are also in the store

There are different files for different purpose:

• cert.cer - a public key with a CA-signed certificate
• cert.key - a private key
• cert.p12 - a keystore, may contain the private key, may contain the public key with its certificate, usually contains both (private key, public key, certificate). So - better validate what does the p12 keystore really contain.

The PKCS#12 keystore usually can be used as it is, often no need to import into a separate JKS. However - depends on the software.

BTW - maybe you could get a keystore-explorer, an opensource gem software giving you a great overview when not understanding the details or cli options.

Basically there's no chain even though I the server cert says it was issued by the intermediate cert in the store

Depends on the usage, but the best practice is having the CA root or its intermediate certificates imported in the truststore.

To import a CA reply in the keytool, you simply import a CA reply (issued certificate) with the same alias name as its private key. I'm not sure if you can create a whole certificate chain this way, you may have a look at the mentioned keystore-explorer to be sure.