how does client set the certificate chain in the keystore?

Question

Our client need connect server with Two-way SSL authentication.In my case,I use 'keytool -genkey' to generate a keystore and use 'keytool -certreq' to export a csr file.The server side get my csr file and sign it by a CA,and then return me a new cer file signed by CA and the Root CA cer. The question is how should I update my keystore to finish the server side authentication? Here is my step to generate keystore.

keytool -genkey -alias client -keyalg RSA -keystore D://key/client.keystore -validity 3650
keytool -certreq -alias client -keystore D://key/client.keystore -file client.csr

Using wireshark,I can find my client send a cert that was generated by my keystore which is self-signed,but the server side actually import the cer file which is signed by CA as the client cer into it's truststore,this made the handshake fail everytime.

PS:The server's cer file is already import to my truststore,so the question is only on the client cer file.Here is the wireshake capture

Answer 1

You need to import the signed certificate and chain into the same keystore that generated the keypair and CSR, using the same alias, and not using the -trustcacerts option.

However your capture shows that the problem is with the server certficate. The client certificate hasn't even been asked for, let alone sent.