title: keytool error: java.lang.Exception: Public keys in reply and keystore don't match errors when importing crt
body: <p>Before I start, I have looked at 2 other questions:</p>
  
  <p><a href="https://stackoverflow.com/questions/26256856/keytool-error-java-lang-exception-public-keys-in-reply-and-keystore-dont-matc">keytool error: java.lang.Exception: Public keys in reply and keystore don&#39;t match</a></p>
  
  <p>And</p>
  
  <p><a href="https://stackoverflow.com/questions/27742554/java-lang-exception-public-keys-in-reply-and-keystore-dont-match">java.lang.Exception: Public keys in reply and keystore don&#39;t match</a></p>
  
  <p>But I believe that the error comes in the way I am generating the csr that I submit to my provider(Digicert). I will detail my commands below, notice that this is the way our department has always done this and up till this point I can't understand why this is not working (I am also not capacitated at all to do system administration things, but this landed on me)</p>
  
  <p>First - Generating the keystore</p>
  
  <pre><code>keytool -genkey -alias aliasItem -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -keypass &lt;password&gt; -dname "CN=server.domain.whatever, OU=IT, O=SOME NAME, L=City ST=State C=COUNTRY" -keystore keycerts -storepass &lt;password&gt;
  </code></pre>
  
  <p>I changed the important items as you might well assume for security concerns. Afterwards:</p>
  
  <pre><code>keytool -keycerts -keyalg RSA -sigalg SHA256withRSA -v -alias aliasItem -file outputfile.csr -keystore keycerts 
  </code></pre>
  
  <p>After I get the csr, I submit it to my provider, there is no copy/paste error in this case since I import the file directly. They provide two .crt files, one from the service provider, and one for the server i am requesting it for. After I move these files to my server and attempt to import the service provider's .crt to the keystore I get an error, this is the command I use for importing the .crt to the keystore:</p>
  
  <pre><code>keytool -import -v -alias aliasItem -file &lt;Provider&gt;.crt -keystore keycerts
  </code></pre>
  
  <p>Which outputs the error:</p>
  
  <pre><code>keytool error: java.lang.Exception: Public keys in reply and keystore don't match
  java.lang.Exception: Public keys in reply and keystore don't match
          at sun.security.tools.KeyTool.establishCertChain(KeyTool.java:2688)
          at sun.security.tools.KeyTool.installReply(KeyTool.java:1940)
          at sun.security.tools.KeyTool.doCommands(KeyTool.java:855)
          at sun.security.tools.KeyTool.run(KeyTool.java:194)
          at sun.security.tools.KeyTool.main(KeyTool.java:188)
  </code></pre>
  
  <p>I have tried changing some parts of the scripts a total of 8 times now, all using the notes and documentation provided by me with no positive results. What strikes me as odd is that this server is identical in all aspects to another one of our test servers, for which I had done this before with no issues. I am still trying to do different things to solve my issue, but due to my limited knowledge in this I believe that there has got to be something I am doing from the beginning that might be wrong.</p>
  
  <p>Any input will be greatly appreciated.</p>