title: Tomcat intermediate certificate `sec_error_unknown_issuer'
body: <p>I have a test scenario, where a root certificate authority called <em>Root</em> signs a certificate signing request created by an intermediate certificate authority called <em>Intermediate</em>, which in turn signs a certificate signing request created by a subject called <em>Subject</em>.</p>
  
  <p>I use Tomcat as my web server and I've configured it to use the <em>Subject</em> key store (which contains the <em>Root</em> certificate, the <em>Intermediate</em> certificate, the <em>Subject</em> certificate chain and the <em>Subject</em> private key) and I start it to listen on the ports 80 (HTTP) and 443 (HTTPS).</p>
  
  <p>I install the <em>Root</em> certificate (as a trusted certificate) in Firefox and I hit up my domain and this is what I get:</p>
  
  <pre><code>subject.usip.me uses an invalid security certificate.
  The certificate is not trusted because no issuer chain was provided.
  (Error code: sec_error_unknown_issuer)
  </code></pre>
  
  <p>Obviously, Firefox couldn't verify the trust of chain, or something similar. Now, before I go into details about my configuration and the steps that I took: I've changed my Tomcat configuration so that it use the <em>Intermediate</em> key store instead of using the <em>Subject</em> key store (the <em>Intermediate</em> key store contains the <em>Root</em> certificate, the <em>Intermediate</em> certificate chain and the <em>Intermediate</em> private key). Using this configuration everything works fine.</p>
  
  <p>I use the following tools:</p>
  
  <ul>
  <li>Java: 1.7.0_05</li>
  <li>Tomcat: 7.0.29</li>
  <li>Firefox: 14.0.1</li>
  </ul>
  
  <p><a href="http://pastebin.com/raw.php?i=BpVJ4JfU" rel="nofollow">I create the key stores in question with the following script pasted over here</a> (it's quite lengthy). Anyone with a Java <em>keytool</em> can run it (it probably won't be too speedy operation because of the 4096 RSA key size).</p>
  
  <p>After the script runs I can verify that my <em>Subject</em> key store contains the complete chain of trust (as I see it):</p>
  
  <pre><code>c:\&gt;keytool -list -keystore c:\subject.jks -storepass changeit -rfc
  </code></pre>
  
  <p><a href="http://pastebin.com/raw.php?i=AkJshyWZ" rel="nofollow">It prints out the following (again, quite lengthy) output which is pasted over here</a>. It seems OK to me (at least, after hours of struggling I can't seem to <em>start</em> seeing anything wrong with it).</p>
  
  <p>I set up Tomcat (<a href="http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Configuration" rel="nofollow">following this how-to</a>) via its <em>server.xml</em> like this (I change nothing aside from this single tag, which is by default commented-out).</p>
  
  <pre><code>&lt;Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
             maxThreads="150" scheme="https" secure="true"
             clientAuth="false" sslProtocol="TLS"
             keystoreFile="c:/subject.jks"
             keystorePass="changeit"
             keystoreType="jks"
             keyAlias="subject"
             keyPass="changeit" /&gt;
  </code></pre>
  
  <p>(After I start up Tomcat, connect to it - while it's using the <em>Subject</em> or the <em>Intermediate</em> key store - there are no errors logged.)</p>
  
  <p>While looking for solutions I found that with <em>openssl</em> I can verify my service, as a novice user of the tool I ran the following command against my domain (using Cygwin):</p>
  
  <pre><code>$ openssl s_client -connect subject.usip.me:443 -CAfile /cygdrive/c/root.pem -showcerts &amp;&gt; /cygdrive/c/openssl.log
  </code></pre>
  
  <p>Yet again, <a href="http://pastebin.com/raw.php?i=xAHBjrfa" rel="nofollow">I've pasted the lengthy output over here</a>.</p>
  
  <p>It says that <code>Verify return code: 24 (invalid CA certificate)</code>, which is strange as it refers (as I see) to the <em>Root</em> certificate. Now, when I've said I reconfigured Tomcat to use the <em>Intermediate</em> key store previously I've also run this same command and then it checked out with <code>Verify return code: 0 (ok)</code>. So I guest the <em>Root</em> certificate is OK.</p>
  
  <p>The domain and sub-domain names I've mentioned through the post and pastes are free domains registered at <a href="http://freedns.afraid.org/" rel="nofollow">http://freedns.afraid.org/</a> and each of them points to my current address (I thought I'd mention it, maybe it matters).</p>
  
  <p>Any ideas what I'm doing wrong?</p>