title: Convert CA-signed JKS keystore to PEM
body: <p>I have a JKS keystore with certicate signed by CA. I need to export it in PEM format in order to use it with nginx. I need to do it in such a way that it includes the whole chain, so that my client can verify the signature.</p>
  
  <p>If I do something like:</p>
  
  <pre><code>keytool -exportcert -keystore mykestore.jks -file mycert.crt -alias myalias
  openssl x509 -out mycert.crt.pem -outform pem -in mycert.crt -inform der
  </code></pre>
  
  <p>It only includes the lowest level certificate. The verification fails:</p>
  
  <pre><code>$ openssl s_client -connect localhost:443
  CONNECTED(00000003)
  depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
  verify error:num=20:unable to get local issuer certificate
  verify return:1
  depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
  verify error:num=27:certificate not trusted
  verify return:1
  depth=0 /O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
  verify error:num=21:unable to verify the first certificate
  verify return:1
  ---
  Certificate chain
   0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
     i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=123123
  ... (only one certificate!)
  ...
  SSL-Session:
      ...
      Verify return code: 21 (unable to verify the first certificate)
  </code></pre>
  
  <p>From Java:</p>
  
  <pre><code>sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>Whereas Jetty with the same JKS keystore prints the following:</p>
  
  <pre><code>$ openssl s_client -connect localhost:8084
  CONNECTED(00000003)
  depth=2 /C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
  verify error:num=19:self signed certificate in certificate chain
  verify return:0
  ---
  Certificate chain
   0 s:/O=*.mydomain.com/OU=Domain Control Validated/CN=*.mydomain.com
     i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=1234
   1 s:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=1234
     i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
   2 s:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
     i:/C=US/O=The Go Daddy Group, Inc./OU=Go Daddy Class 2 Certification Authority
  ...
  SSL-Session:
      Verify return code: 19 (self signed certificate in certificate chain)
  </code></pre>
  
  <p>Although openssl returns that 19 error, it no longer is an issue for Java <code>HttpsURLConnection</code> and that is all I care about.</p>
  
  <p>So, how can I export <strong><em>the whole chain</em></strong> from JKS in a format (e.g. PEM) which works with both nginx server and Java client? What am I missing?</p>