title: How to install X509 certificate chain without the private key
body: <p>I have been given three certificates by my client:</p>
  
  <p><code>DigiCert Global Root CA.cer - (Root certificate)
  GeoTrust RSA CA 2018.cer - (Intermediate certificate)
  krapiuat_sharekhan_com.cer - (SSL certificate for my domain)</code></p>
  
  <p>I am expected to install all the three certificates on my Spring Boot server to enable SSL on the same.</p>
  
  <p>I am using this with the embedded Tomcat server in my Spring Application and am unable to start the SSL enabled service due to errors.</p>
  
  <p>My attempts are as stated below:</p>
  
  <p>Attempt 1</p>
  
  <p>I tried to combine all three .cer files into a single file and add it to the keystore</p>
  
  <pre><code>`cat krapiuat_sharekhan_com.cer  GeoTrust\ RSA\ CA\ 2018.cer  DigiCert\ Global\ Root\ CA.cer&gt; combined_cert.cer
  
  keytool -importcert -keystore krKeyStore.jks -file combined_cert.cer -alias krRiskRatingUAT -trustcacerts`
  </code></pre>
  
  <p>Note: The final jks file showed just one entry as trustedCertEntry</p>
  
  <p>Then I added the file krKeyStore.jks in the /resource folder of my Spring app and added the following lines in my application.properties file:</p>
  
  <pre><code>`server.port=8443
  server.ssl.key-store-type=JKS
  server.ssl.key-store=classpath:krKeyStore.jks
  server.ssl.key-store-password=mypassword
  server.ssl.key-alias=krRiskRatingUAT`
  </code></pre>
  
  <p>The service failed to start with the exception java.io.IOException: jsse.alias_no_key_entry</p>
  
  <hr>
  
  <p>Attempt 2</p>
  
  <p>I tried to individually add the three certificates to my keystore</p>
  
  <pre><code>`keytool -import -trustcacerts -alias root -file DigiCert\ Global\ Root\ CA.cer -keystore krKeyStore20.jks
  keytool -import -trustcacerts -alias intermediate -file GeoTrust\ RSA\ CA\ 2018.cer -keystore krKeyStore20.jks
  keytool -import -trustcacerts -alias krRiskRatingUAT20 -file krapiuat_sharekhan_com.cer -keystore krKeyStore20.jks`
  </code></pre>
  
  <p>Note: The final jks file now showed three entries all as trustedCertEntry</p>
  
  <p>Then I added the file krKeyStore20.jks in the /resource folder of my Spring app and added the following lines in my application.properties file:</p>
  
  <pre><code>`server.port=8443
  server.ssl.key-store-type=JKS
  server.ssl.key-store=classpath:krKeyStore20.jks
  server.ssl.key-store-password=mypassword
  server.ssl.key-alias=krRiskRatingUAT20`
  </code></pre>
  
  <p>But the error still persists - java.io.IOException: jsse.alias_no_key_entry</p>
  
  <p>Is it always mandatory to have the key? My client is not ready to give me the private key and wants me to install the certificates without a key. Any help will be duly appreciated.</p>