title: Imported certificate to Java keystore, JVM ignores the new cert
body: <p>I'm trying to get an application running on top of Tomcat 6 to connect to an LDAP server over SSL.</p>
  
  <p>I imported certificate of the server to keystore using:</p>
  
  <pre><code>C:\Program Files\Java\jdk1.6.0_32\jre\lib\security&gt;keytool -importcert -trustcacerts -file mycert -alias ca_alias -keystore "c:\Program Files\Java\jdk1.6.0_32\jre\lib\security\cacerts"
  </code></pre>
  
  <p>When I start Tomcat with SSL debugging turned on, according to logs Tomcat is using the correct certificate file:</p>
  
  <pre><code>trustStore is: C:\Program Files\Java\jdk1.6.0_32\jre\lib\security\cacerts
  </code></pre>
  
  <p>However, Tomcat does not add the cert I just imported - all other certs in the cacerts file are printed to the log - and connection fails:</p>
  
  <pre><code>handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  </code></pre>
  
  <p>Restarting Tomcat does not help. I have verified with keytool -list command that the new cert indeed exists on the file.</p>
  
  <p>Why Tomcat keeps on ignoring my new cert?</p>
  
  <p>EDIT:</p>
  
  <p>Seems that the issue was caused by Windows 7 VirtualStore. Keytool created a new copy of the cacert file, and Tomcat used the original file.</p>