Java.lang.Exception: public keys in response and keystore do not match

Question

I must access the web service hosted on port 443. The service provider shared three certificates with us.

1. ABCD.cer
2. CA_Certificate.cer
3. CCA_Certificate.cer

I have to add them to the keystore by creating a form chain for SSL communications. I have completed the following steps.

1. keytool -keystore npci_keystore_test.jks -genkey -alias npci_client_testore

      Result :- keystore npci_keystore_test.jks created.
   

2. keytool -import -keystore npci_keystore_test.jks -file CA_Certificate.cer -alias theCARoot

      Result :- certificate CA_Certificate.cer is added to keystore.
   

3. keytool -import -keystore npci_keystore_test.jks -file CCA_Certificate.cer -alias theCCARoot

      Result :- certificate CCA_Certificate.cer is added to keystore.
   

4. keytool -import -keystore npci_keystore_test.jks -file ABCD.cer -alias npci_client_testore

   In step 4, I have exceptions below

   Enter the keystore password: (and when I enter the password, I have exceptions below)

   Error keytool: java.lang.Exception: public keys in response and key store do not match

I already did a search in SO, but so far no luck.

I follow the source below to create a store and import certificate in it. Jks keystore

EDIT:---

I tested it by changing the import order of the certificate, but so far no luck.

Answer 1

, SSL , . :

• SSL

4 , SSL .

, :

• SSL -
• CA, SSL
• , CA

( : ${JAVA_HOME}/jre/lib/security/cacerts), SSL- -.

SSL- SSL. , :

keytool -import -keystore ${JAVA_HOME}/jre/lib/security/cacerts -file CCA_Certificate.cer -alias theCCARoot

, - SSL, , , .

Answer 2

- , , , JKS. , . [1] .

[1] http://docs.oracle.com/cd/E19509-01/820-3503/ggfgo/index.html

Answer 3

4- ( : keytool: java.lang.Exception: ), , , . npci_client_testore, .

Answer 4

" , " . , ROOT CA, Intermediate . Root CA .

Answer 5

( ) Tomcat8. wrong domain name no domain name , CSR (), // . (Godaddy ).

:

keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore
keytool -importkeystore -srckeystore tomcat.keystore -destkeystore tomcat.keystore -deststoretype pkcs12

( , , (FDQN), , www.example.com). , - do not abbreviate

, CSR ( , tomcat.keystore):

keytool -certreq -keyalg RSA -alias tomcat -file myFQDN.csr -keystore tomcat.keystore

. - Godaddy Windows (MMC).

. 2 .crt, Windows ( " "). , tomcat.keystore, tomcat.keystore ( ) , :

keytool -import -alias root -keystore tomcat.keystore -trustcacerts -file gdig2.crt.pem
keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gd_bundle-g2-g1.crt
keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file namewithnumbersandletters.crt

, server.xml, Tomcat.

<Connector port="8080" protocol="HTTP/1.1"
            connectionTimeout="20000"
            redirectPort="443" />  
    <Connector 
    URIEncoding="UTF-8"
    SSLEnabled="true" 
    clientAuth="false"
    keystoreFile="C:\Program Files\Java\jdk1.8.0_181\bin\tomcat.keystore" 
    keystorePass="changeme" 
    maxThreads="200" 
    port="443" 
    scheme="https" 
    secure="true" 
    sslProtocol="TLS" />

! ( ) .

Answer 6

This worked for me:

keytool -keystore yourkeystorename -importcert -alias certificatealiasname -file certificatename.cer