Java JDK 1.4.2 Keystore

Question

Hi,
We have an issue with our Java JDK 1.4.2 Keystore.
It will not display a newly certified Certfor Tomcat.
OS/Tomcat/Java
On Windows 2003 Std R2 SP2.
Using Tomcat 4.1.31 - JDK 1.4.2.
Tomcat/Java References:
http://tomcat.apache.org/tomcat-4.1-doc/ssl-howto.html
http://java.sun.com/j2se/1.4.2/docs/tooldocs/windows/keytool.html#Examples
http://help.godaddy.com/article/5239
Details:
Create a local Certificate (as described in the previous section):
1.
C:\xxxxx\_jvm\bin>keytool -genkey -alias Local_Cert -keyalg RSA -keysize 2048 -keystore xxxxx_weirminerals_com
Enter keystore password: changeit
What is your first and last name?
[Unknown]: xxxxx.weirminerals.com
What is the name of your organizational unit?
[Unknown]: IT Dept
What is the name of your organization?
[Unknown]: Weir Minerals North America
What is the name of your City or Locality?
[Unknown]: Madison
What is the name of your State or Province?
[Unknown]: Wisconsin
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=xxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America, L=M
adison, ST=Wisconsin, C=US correct?
[no]: yes
Enter key password for <Local_Cert>
(RETURN if same as keystore password): changeit
2. keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore <xxxxx_weirminerals_com>
C:\xxxxx\_jvm\bin>keytool -certreq -keyalg RSA -alias Local_Cert -file xxxxx.weirminerals.com_certreq.csr -keystore xxxxx_weirminerals_com
Enter keystore password: changeit
The file should be encoded in PEM format? Correct?
I submitted to Godaddy.com and have read over their ionstructions to install Cert.
Download a Chain Certificate from the Certificate Authority you obtained the Certificate from.
For GoDaddy.com go to https://idp.godaddy.com/login.aspx?SPKey=PKI-GD-S-01
Import the Chain Certificate into keystore
NOTE: Copy CA ROOT Certtificate to C:\xxxxx\_jvm\bin
3. C:\xxxxx\_jvm\bin>keytool -import -alias root -keystore xxxxx_weirminerals_com -trustcacerts -file gd_bundle.crt
Enter keystore password: changeit
Owner: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST
=Arizona, C=US Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.
", C=US
Serial number: 301
Valid from: Wed Nov 15 19:54:37 CST 2006 until: Sun Nov 15 19:54:37 CST 2026
Certificate fingerprints:
MD5: D5:DF:85:B7:9A:52:87:D1:8C:D5:0F:90:23:2D:B5:34
SHA1: 7C:46:56:C3:06:1F:7F:4C:0D:67:B3:19:A8:55:F6:0E:BC:11:FC:44
Trust this certificate? [no]: yes
Certificate was added to keystore
Import your new CA Certificate (Is it in X509 format?):
NOTE: Copy CA Certified Certtificate to C:\xxxxx\_jvm\bin
4. keytool -import -alias xxxxx_ca -keystore CA_xxxxx_weirminerals_com -trustcacerts -file xxxxx.weirminerals.com.crt
Could "not" use same alias as Generated key/CSR --> "local_cert" - get Java error - when I change alias - the import of CA cert into keystore works.
Here is my keystore:
C:\xxxxx\_jvm\bin>keytool -list -v -keystore "C:\xxxxx\tomcat4.1\bin\sup
plyweb_weirminerals_com"
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 3 entries
Alias name: root
Creation date: Feb 10, 2010
Entry type: trustedCertEntry
Owner: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=htt
p://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST
=Arizona, C=US
Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.
", C=US
Serial number: 301
Valid from: Wed Nov 15 19:54:37 CST 2006 until: Sun Nov 15 19:54:37 CST 2026
Certificate fingerprints:
MD5: D5:DF:85:B7:9A:52:87:D1:8C:D5:0F:90:23:2D:B5:34
SHA1: 7C:46:56:C3:06:1F:7F:4C:0D:67:B3:19:A8:55:F6:0E:BC:11:FC:44
Alias name: local_cert
Creation date: Feb 10, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=xxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America,
L=Madison, ST=Wisconsin, C=US
Issuer: CN=xxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America
, L=Madison, ST=Wisconsin, C=US
Serial number: 4b72d013
Valid from: Wed Feb 10 09:26:11 CST 2010 until: Tue May 11 10:26:11 CDT 2010
Certificate fingerprints:
MD5: 7D:BC:20:5E:8F:82:84:D5:85:8D:4B:28:5B:87:05:4E
SHA1: AA:A3:CB:71:E4:6F:3A:77:97:4F:FC:D1:5C:B3:5B:E8:A8:3D:BC:2A
Alias name: xxxxx_ca
Creation date: Feb 12, 2010
Entry type: trustedCertEntry
Owner: CN=xxxxx.weirminerals.com, OU=Domain Control Validated, O=xxxxx.w
eirminerals.com
Issuer: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=ht
tp://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S
T=Arizona, C=US
Serial number: 4518048dc46c1
Valid from: Wed Feb 10 09:43:40 CST 2010 until: Tue Feb 08 15:50:26 CST 2011
Certificate fingerprints:
MD5: 31:4A:A4:E7:C4:36:CF:FA:A0:F6:FB:89:6D:A3:BE:20
SHA1: 21:BF:CA:4A:88:2A:79:01:1D:0E:9E:19:4A:F4:03:EC:F3:AF:75:6F
Tomcat - Server.xml is fine - uses the correct Keystore - we have proven that.
But - the Java Keystore does "not" use the correct "key" in the keystore?
How can that be? What could we be doing wrong?
Any help is appreciated.
-SP

Answer 1

Hi,
Same results again - tried to import with same alias as self-signed.
I followed the instructions for Option #two from GoDaddy for Tomcat installation:
http://help.godaddy.com/article/5239
Details:
C:\xxxxxxxxxxxxxx\_jvm\bin>keytool -list -v -keystore xxxxxxx_keystore
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: xxxxxxx
Creation date: Feb 18, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=xxxxxxxxxxxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America,
L=Madison, ST=Wisconsin, C=US
Issuer: CN=xxxxxxxxxxxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America
, L=Madison, ST=Wisconsin, C=US
Serial number: 4b7d54b0
Valid from: Thu Feb 18 08:54:40 CST 2010 until: Wed May 19 09:54:40 CDT 2010
Certificate fingerprints:
MD5: C7:DF:DB:F0:1D:F4:55:C0:FE:24:A6:00:51:6B:F8:EF
SHA1: DE:64:58:38:8C:37:07:AC:8D:C8:70:CF:F0:83:FA:6E:E1:DA:63:A8
C:\xxxxxxxxxxxxxx\_jvm\bin>keytool -import -alias root -keystore xxxxxxx_keystore -trustcacerts -file gd_bundle.crt
Enter keystore password: changeit
Owner: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=htt
p://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST
=Arizona, C=US
Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.
", C=US
Serial number: 301
Valid from: Wed Nov 15 19:54:37 CST 2006 until: Sun Nov 15 19:54:37 CST 2026
Certificate fingerprints:
MD5: D5:DF:85:B7:9A:52:87:D1:8C:D5:0F:90:23:2D:B5:34
SHA1: 7C:46:56:C3:06:1F:7F:4C:0D:67:B3:19:A8:55:F6:0E:BC:11:FC:44
Trust this certificate? [no]: yes
Certificate was added to keystore
C:\xxxxxxxxxxxxxx\_jvm\bin>keytool -import -alias cross -keystore xxxxxxx_keystore -tr
ustcacerts -file gd_cross_intermediate.crt
Enter keystore password: changeit
Owner: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc."
, C=US
Issuer: [email protected], CN=http://www.valicert.com/, OU=ValiCert
Class 2 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation
Network
Serial number: 10d
Valid from: Tue Jun 29 12:06:20 CDT 2004 until: Sat Jun 29 12:06:20 CDT 2024
Certificate fingerprints:
MD5: 82:BD:9A:0B:82:6A:0E:3E:91:AD:3E:27:04:2B:3F:45
SHA1: DE:70:F4:E2:11:6F:7F:DC:E7:5F:9D:13:01:2B:7E:68:7A:3B:2C:62
Trust this certificate? [no]: yes
Certificate was added to keystore
C:\xxxxxxxxxxxxxx\_jvm\bin>keytool -import -alias intermed -keystore xxxxxxx_keystore
-trustcacerts -file gd_intermediate.crt
Enter keystore password: changeit
Certificate already exists in keystore under alias <root>
Do you still want to add it? [no]: yes
Certificate was added to keystore
C:\xxxxxxxxxxxxxx\_jvm\bin>keytool -list -v -keystore xxxxxxx_keystore
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 4 entries
Alias name: root
Creation date: Feb 18, 2010
Entry type: trustedCertEntry
Owner: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=htt
p://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST
=Arizona, C=US
Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.
", C=US
Serial number: 301
Valid from: Wed Nov 15 19:54:37 CST 2006 until: Sun Nov 15 19:54:37 CST 2026
Certificate fingerprints:
MD5: D5:DF:85:B7:9A:52:87:D1:8C:D5:0F:90:23:2D:B5:34
SHA1: 7C:46:56:C3:06:1F:7F:4C:0D:67:B3:19:A8:55:F6:0E:BC:11:FC:44
Alias name: xxxxxxx
Creation date: Feb 18, 2010
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=xxxxxxxxxxxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America,
L=Madison, ST=Wisconsin, C=US
Issuer: CN=xxxxxxxxxxxxxx.weirminerals.com, OU=IT Dept, O=Weir Minerals North America
, L=Madison, ST=Wisconsin, C=US
Serial number: 4b7d54b0
Valid from: Thu Feb 18 08:54:40 CST 2010 until: Wed May 19 09:54:40 CDT 2010
Certificate fingerprints:
MD5: C7:DF:DB:F0:1D:F4:55:C0:FE:24:A6:00:51:6B:F8:EF
SHA1: DE:64:58:38:8C:37:07:AC:8D:C8:70:CF:F0:83:FA:6E:E1:DA:63:A8
Alias name: cross
Creation date: Feb 18, 2010
Entry type: trustedCertEntry
Owner: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc."
, C=US
Issuer: [email protected], CN=http://www.valicert.com/, OU=ValiCert
Class 2 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation
Network
Serial number: 10d
Valid from: Tue Jun 29 12:06:20 CDT 2004 until: Sat Jun 29 12:06:20 CDT 2024
Certificate fingerprints:
MD5: 82:BD:9A:0B:82:6A:0E:3E:91:AD:3E:27:04:2B:3F:45
SHA1: DE:70:F4:E2:11:6F:7F:DC:E7:5F:9D:13:01:2B:7E:68:7A:3B:2C:62
Alias name: intermed
Creation date: Feb 18, 2010
Entry type: trustedCertEntry
Owner: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=htt
p://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST
=Arizona, C=US
Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.
", C=US
Serial number: 301
Valid from: Wed Nov 15 19:54:37 CST 2006 until: Sun Nov 15 19:54:37 CST 2026
Certificate fingerprints:
MD5: D5:DF:85:B7:9A:52:87:D1:8C:D5:0F:90:23:2D:B5:34
SHA1: 7C:46:56:C3:06:1F:7F:4C:0D:67:B3:19:A8:55:F6:0E:BC:11:FC:44
C:\xxxxxxxxxxxxxx\_jvm\bin>keytool -import -alias xxxxxxx -keystore xxxxxxx_keystore -trustcacerts -file xxxxxxxxxxxxxx.weirminerals.com.crt
Enter keystore password: changeit
keytool error: java.lang.Exception: Failed to establish chain from reply
C:\xxxxxxxxxxxxxx\_jvm\bin>