Unable to import signed cert in keystore

Question

Hi everybody !
I've been using keytool for years to generate client certificates that I would send to an enrollment server to get it signed by the CA.
Here is the sequence :
(1) Generating the key pair :
keytool.exe -genkey -alias client-cert -keyalg RSA -keystore keystore   (2) Extracting the certificate request :
keytool.exe -certreq -alias client-cert -file client-cert.csr -keystore keystore  (3) Sending the request to the enrollment server, getting in return a signedcert.der
(4) Importing CA certificate in keystore :
keytool.exe -import -alias caroot -file ca.der -keystore keystore (5) Importing the signed client certificate in the keystore : keytool.exe -import -alias cert-client -file signedcert.der -keystore keystoreNow we'd like to use openssl to generate the CA certificate and sign the client-cert (which is still generated by keytool).
So instead of (3), we just have :
     openssl ca -config ca-sign.cnf -out signedcert.crt -infiles client-cert.csr
     openssl verify -CAfile ca.crt signedcert.crt
     openssl x509 -in signedcert.crt -out signedcert.der -outform DER     Everything runs fine for (4), but when we finally try to import the signedcert, we get this :
     keytool error: java.security.cert.CertificateException: IOException: X509.Object
     Identifier() -- data isn't an object ID (tag = 48)Some people here have already had the problem but got no answer.
What I'd like to know first is what does such an error MEAN exactly, then how can I manage to put my cert into the keystore.
FYI, we use keytool from JDK 1.3.0 and openssl 0.9.7
(I can post config file ca-sign.cnf if needed)
Thanks for your help
Valerien

Answer 1

I got no answer either, so here's the solution for other unlucky people : use keytool from the latest JDK (1.4.1_01 ran fine).
Thank me very much.