Convert CA-signed JKS keystore to PEM
I have a JKS keystore with certicate signed by CA. I need to export it in PEM format in order to use it with nginx. I need to do it in such a way that it includes the whole chain, so that my client can verify the signature.

If I do something like:

    keytool -exportcert -keystore mykestore.jks -file mycert.crt -alias myalias
    openssl x509 -out mycert.crt.pem -outform pem -in mycert.crt -inform der


It only includes the lowest level certificate. The verification fails:

    $ openssl s_client -connect localhost:443
    CONNECTED(00000003)
    depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
    verify error:num=20:unable to get local issuer certificate
    verify return:1
    depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
    verify error:num=27:certificate not trusted
    verify return:1
    depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
    verify error:num=21:unable to verify the first certificate
    verify return:1
    ---
    Certificate chain
     0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
       i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=123123
    ... (only one certificate!)
    ...
    SSL-Session:
        ...
        Verify return code: 21 (unable to verify the first certificate)

From Java:

    sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Whereas Jetty with the same JKS keystore prints the following:

    $ openssl s_client -connect localhost:8084
    CONNECTED(00000003)
    depth=2 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
    verify error:num=19:self signed certificate in certificate chain
    verify return:0
    ---
    Certificate chain
     0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
       i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=1234
     1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=1234
       i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
     2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
       i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
    ...
    SSL-Session:
        Verify return code: 19 (self signed certificate in certificate chain)

Although openssl returns that 19 error, it no longer is an issue for Java `HttpsURLConnection` and that is all I care about.

So, how can I export ***the whole chain*** from JKS in a format (e.g. PEM) which works with both nginx server and Java client? What am I missing?
Convert CA-signed JKS keystore to PEM
===

I have a JKS keystore with certicate signed by CA. I need to export it in PEM format in order to use it with nginx. I need to do it in such a way that it includes the whole chain, so that my client can verify the signature.

If I do something like:

    keytool -exportcert -keystore mykestore.jks -file mycert.crt -alias myalias
    openssl x509 -out mycert.crt.pem -outform pem -in mycert.crt -inform der


It only includes the lowest level certificate. The verification fails:

    $ openssl s_client -connect localhost:443
    CONNECTED(00000003)
    depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
    verify error:num=20:unable to get local issuer certificate
    verify return:1
    depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
    verify error:num=27:certificate not trusted
    verify return:1
    depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
    verify error:num=21:unable to verify the first certificate
    verify return:1
    ---
    Certificate chain
     0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
       i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=123123
    ... (only one certificate!)
    ...
    SSL-Session:
        ...
        Verify return code: 21 (unable to verify the first certificate)

From Java:

    sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Whereas Jetty with the same JKS keystore prints the following:

    $ openssl s_client -connect localhost:8084
    CONNECTED(00000003)
    depth=2 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
    verify error:num=19:self signed certificate in certificate chain
    verify return:0
    ---
    Certificate chain
     0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
       i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=1234
     1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=1234
       i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
     2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
       i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
    ...
    SSL-Session:
        Verify return code: 19 (self signed certificate in certificate chain)

Although openssl returns that 19 error, it no longer is an issue for Java `HttpsURLConnection` and that is all I care about.

So, how can I export ***the whole chain*** from JKS in a format (e.g. PEM) which works with both nginx server and Java client? What am I missing?