title: Getting NSS error -8156 (SEC_ERROR_CA_CERT_INVALID) Issuer certificate is invalid for tomcat while hitting curl
body: <p>I am trying to enable SSL on my tomcat for https requests on a centos box. (box ip is 10.10.10.10)</p>
  
  <p>I created the keystore file using:</p>
  
  <pre><code>./keytool -genkey -alias 10.10.10.10 -keyalg RSA -keystore /home/as5714/ipnew_keystore 
  </code></pre>
  
  <p>And a keystore file is created.</p>
  
  <p>Then i made following changes in my server.xml file:</p>
  
  <pre><code>           &lt;Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
             maxThreads="200"
             SSLEnabled="true" scheme="https" secure="true"
             clientAuth="false" sslProtocol="TLS"
             keystoreFile="/etc/ssl/ipnew_keystore"
             keystorePass="password"/&gt;
  </code></pre>
  
  <p>After doing this change, i restarted my tomcat.</p>
  
  <p>However I get error while making the https call to my tomcat:</p>
  
  <p>Here is the curl:</p>
  
  <pre><code>curl -v -X POST -H"Content-Type:application/json" -d '{"browserDetails":"","appVersion":"""email":""}' https://10.41.66.69:443/service/getData
  </code></pre>
  
  <p>Here is the log which i am getting:</p>
  
  <pre><code>* About to connect() to 10.10.10.10 port 443 (#0)
  *   Trying 10.10.10.10...
  * Connected to 10.10.10.10 (10.10.10.10) port 443 (#0)
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
  * Server certificate:
  *       subject: CN=10.10.10.10,OU=Web,O=Snapdeal,L=Delhi,ST=Delhi,C=IN
  *       start date: Feb 24 13:03:34 2016 GMT
  *       expire date: May 24 13:03:34 2016 GMT
  *       common name: 10.10.10.10
  *       issuer: CN=10.10.10.10,OU=Web,O=Snapdeal,L=Delhi,ST=Delhi,C=IN
  * NSS error -8156 (SEC_ERROR_CA_CERT_INVALID)
  * Issuer certificate is invalid.
  * Closing connection 0
  curl: (60) Issuer certificate is invalid.
  More details here: http://curl.haxx.se/docs/sslcerts.html
  
  curl performs SSL certificate verification by default, using a "bundle"
   of Certificate Authority (CA) public keys (CA certs). If the default
   bundle file isn't adequate, you can specify an alternate file
   using the --cacert option.
  If this HTTPS server uses a certificate signed by a CA represented in
   the bundle, the certificate verification probably failed due to a
   problem with the certificate (it might be expired, or the name might
   not match the domain name in the URL).
  If you'd like to turn off curl's verification of the certificate, use
   the -k (or --insecure) option.
  </code></pre>
  
  <p>Please help.</p>