Keystore file not generated properly

Question

I have created a self signed certificate chain using openssl. The certificate is of .crt extension. I tried to create a .keystore file from that .crt file.

The command used to create the keystore file is :

    keytool -import -trustcacerts -alias root -file certificate.crt -keystore certificate.keystore

When using the keystore file in my tomcat application to enable ssl, my application did not start and got "This site can't be reached" error in my browser and no error in logs.

I converted the .crt file into .p12 file and used in my tomcat application. Now my application runs.

How can I generate the keystore file successfully and why does converting the file to .p12 works?

Answer 1

You can't create a keystore from a .crt file. A keystore must contain both a private key and the corresponding certificate. Not just the certificate.

There is no reason to use openssl in this situation at all. You don't need anything more than keytool -genkey ....