title: Tomcat SSL Certificate Intermediate
body: <p>i started with an keystore with <code>keytool -genkey -keyalg RSA -keystore eakte.keystore</code></p>
  
  <p>Then i generated the CSR <code>keytool -certreq -keyalg RSA -file eakte.csr -keystore eakte.keystore</code> and submitted to comodo. I got four files:</p>
  
  <ul>
  <li>AddTrustExternalCARoot.crt</li>
  <li>COMODORSAAddTrustCA.crt</li>
  <li>COMODORSAOrganizationValidationSecureServerCA.crt</li>
  <li>eakte_example_com.crt</li>
  </ul>
  
  <p>I added from top to bottom (Key Chain) to the Keystore. Example <code>keytool.exe -import -trustcacerts -alias intermediate_COMODORSAAddTrustCA -file COMODORSAAddTrustCA.crt -keystore eakte.keystore</code></p>
  
  <p>With keystore -list i see all certificates.</p>
  
  <p>If I add this file as key file at the Tomcat Server.xml, i get at the start of the Service, the message error:0906D06C:PEM routines:PEM_read_bio:no start line)</p>
  
  <p>Ok i converted the file to PKCS#12 with <code>keytool.exe -importkeystore -srckeystore eakte.keystore -destkeystore eakte.p12 -srcstoretype jks -deststoretype pkcs12</code> and the with open_ssl to pem <code>openssl pkcs12 -in eakte.p12 -out eakte.pem</code></p>
  
  <p>No error in log files....</p>
  
  <p>But a quick check with open_ssl i see the error Verify
  return code: 21 (unable to verify the first certificate) and ssllabs say the same.</p>
  
  <p>What is my mistake? Do i think wrong? I want to understand the issue.</p>
  
  <p>Best regards,</p>
  
  <p>Stefan</p>