title: How to add multiple CA to truststore in tomcat
body: <p>I followed the following tutorial to implement two way SSL authentication: 
  <a href="http://virgo47.wordpress.com/2010/08/23/tomcat-web-application-with-ssl-client-certificates/" rel="nofollow">http://virgo47.wordpress.com/2010/08/23/tomcat-web-application-with-ssl-client-certificates/</a> </p>
  
  <p>Structure on server: 
  <strong>cacerts.jks</strong> has <strong>my_ca</strong> as trusted certificate entry 
  <strong>keystore.jks</strong> has <strong>sercer</strong> as Key Pair entry </p>
  
  <p>Browser: 
  Has <strong>Client.cer</strong> generated by <strong>my CA</strong> installed in it </p>
  
  <p>If I access the app url, browser now pops my 'Client' certificate to use &amp; I click on cert &amp; click OK, the webpage is displayed. </p>
  
  <p>Now I have an actual ProductionCertificate MyProdCer 
  Chain is: <strong>MyProdCer -> IssuerCA -> IntermediateCA-> RootCA</strong> </p>
  
  <p>I have updated cacerts.jks on server to contain IssuerCA, IntermediateCA &amp; RootCA certs along with the original my_ca 
  The browser now pops up two options 1. 'Client' cert &amp; 2. 'MyProdCer' 
  If I select 1. Client cer then it works as usual, no problem </p>
  
  <p>However if I select 2. 'MyProdCer' then browser displays</p>
  
  <pre><code>Certificate-based authentication failed - Error 117 (net::ERR_BAD_SSL_CLIENT_AUTH_CERT): Bad SSL client authentication certificate.
  </code></pre>
  
  <p>What am I missing, please advise. </p>
  
  <p>Thanks. </p>