title: What do I do when keytool.exe can't establish a certificate chain from my certs?
body: <p>I'm working in an environment with a working Microsoft Active Directory Certificate Services (MS ADCS) PKI.  In that environment, I'm deploying <a href="http://www.apc.com/products/resource/include/techspec_index.cfm?base_sku=SFPCNS31" rel="nofollow">this Java app</a> which uses a java key store to manage the keys and certificates for its https server.  The <em>de facto</em> tool for administration seems to be <code>keytool.exe</code>.  The documentation for <code>keytool</code> can be found <a href="http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html" rel="nofollow">here</a>.</p>
  
  <p>A generally-recommended method of generating a key pair, creating a certificate request, and importing the the certificate is as something like this:</p>
  
  <ol>
  <li><p><strong>Generate Key Pair</strong> <code>keytool -genkey -keyalg RSA -keysize 2048 -alias securekey -keystore keystore</code></p></li>
  <li><p><strong>Generate Certificate Request</strong> <code>keytool -certreq -alias securekey -keystore keystore -file NewCertRequest.csr</code></p></li>
  <li><p><strong>Import Root Certificate</strong> <code>keytool -importcert -alias root -keystore keystore -file rootcert.csr</code></p></li>
  <li><p><strong>Import Intermediate Certificate</strong> <code>keytool -importcert -alias intermediateX -keystore keystore -file intcert.csr</code> &lt;= <em>repeat this for each intermediate certificate, in order</em></p></li>
  <li><p><strong>Import Newly-Signed Certificate</strong> <code>keytool -importcert -alias securekey -keystore keystore -file NewlySignedCert.csr</code></p></li>
  </ol>
  
  <h3>keytool and Establishing a Certificate Chain</h3>
  
  <p>Step 3 establishes the <a href="https://en.wikipedia.org/wiki/Trust_anchor" rel="nofollow">trust anchor</a>.  <code>keytool</code> 'prints out' the certificate for your review and requires you to answer "yes" to explicitly trust that certificate.</p>
  
  <p>Step 4 imports the intermediate certificates in the trust chain that link from the root to the newly signed certificate.  When you import each successive subordinate intermediate certificate, <code>keytool</code> automatically trusts them (or at least it's supposed to).  The way that <code>keytool</code> signals that it has a complete certificate path to a trust anchor (i.e. the root certificate from step 3) is subtle and weakly documented:</p>
  
  <blockquote>
    <p>If the certificate is not found and -noprompt option is not specified, the information of the last certificate in the chain is printed out, and the user is prompted to verify it.</p>
  </blockquote>
  
  <p>The unwritten corollary to this is as follows: "If keytool <em>can</em> verify a complete certificate path to a trust anchor, it will <em>not</em> print out any certificate."</p>
  
  <p>You can confirm this by using, for example, the <code>GeoTrust Global CA</code> and <code>Google Internet Authority G2</code> certificates for steps 3 and 4, respectively. (Find these certs behind the green lock when you go to <a href="https://www.google.com" rel="nofollow">https://www.google.com</a>.) <code>keytool</code> will print out the root <code>GeoTrust Global CA</code> and ask you to explicitly trust it.  After trusting <code>GeoTrust Global CA</code> <code>keytool</code> will import <code>Google Internet Authority G2</code> without printing out any certificate thus indicating that <code>keytool</code> trusts <code>Google Internet Authority G2</code>.</p>
  
  <h3>keytool can't chain my Microsoft ADCS certs</h3>
  
  <p>When I attempt to build the trust chain using my MS ADCS certificates (<em>a la</em> the google chain described above) <code>keytool</code> fails to establish a chain of trust.  I'm not sure what, exactly, the difference is, but the failure is betrayed when <code>keytool</code> prints out the certificate in step 4 indicating that it didn't establish the trust chain up to the already-trusted root certificate from step 3.</p>
  
  <h3>What to do?</h3>
  
  <p>Given that <code>keytool</code> doesn't seem to be able to chain MS ADCS certs, what should I do for applications in our environment that use the java key store for managing keys and certificates?</p>