Getting "No certificate corresponds to the private key"

Question

This is the sequence of commands I tried:

a. Retrieve the existing certificate key from the repository:

keytool -v -importkeystore -srckeystore keystore -srcalias one -destkeystore temppp -deststoretype PKCS12 -srcstorepass passwordd -deststorepass passwordd 

b. Extract private key from exported certificate:

 openssl pkcs12 -in temppp -out csr_private.key -nocerts -nodes -password pass:passwordd 

with. Create csr using the extracted key:

 openssl req -nodes -sha256 -new -key csr_private.key -out request.csr -subj '/C=IL/ST=Unknown/L=Unknown/O=Bla/OU=Bla/CN=BLAAAA' 

e. Create your own certificate and key:

 openssl req -x509 -newkey rsa:2048 -keyout ca_key.pem -nodes -sha512 -days 4096 -subj '/C=IL/ST=Unknown/L=Unknown/O=Bla Bla/OU=BLA/CN=FOOO' -out ca.pem 

e. Sign csr with a self-signed certificate:

 openssl x509 -in request.csr -out signed_cert.pem -req -signkey ca_key.pem -days 1001 

f. Export the signed certificate and csr key to a single p12 file:

 openssl pkcs12 -export -in signed_cert.pem -inkey csr_private.key -out file.p12 -name "one" 

Result:

Certificate does not match private key

• What am I missing? why is my last command not legal?
• What I planned to do was "keytool -importkeystore" file.p12 (which should have been generated in the last step) to replace "one" privateKeyEntry with "keystore". As suggested in importing the existing x509 certificate and private key into the Java keystore for use in ssl . Basically I am trying to edit this entry with the same key, but with a different certificate.

Thanks!

Answer 1

The fix is ​​to add "-nodes" to the last command (f).
In the second command, this key was exported using "-nodes" (without DES encryption), and it should be the same in the last command.