title: Importing Thawte trial certificates into a Java keystore
body: <p>I'm trying to configure a Tomcat server with SSL. I've generated a keypair thus:</p>
  
  <pre><code>$ keytool -genkeypair -alias tomcat -keyalg RSA -keystore keys
  </code></pre>
  
  <p>Next I generate a certificate signing request:</p>
  
  <pre><code>$ keytool -certreq -keyalg RSA -alias tomcat -keystore keys -file tomcat.csr
  </code></pre>
  
  <p>Then I copy-paste the contents of <code>tomcat.csr</code> into a form on Thawte's website, asking for a trial SSL certificate. In return I get two certificates delimited with <code>-----BEGIN ... -----END</code>, that I save under <code>tomcat.crt</code> and <code>thawte.crt</code>. (Thawte calls the second certificate a 'Thawte Test CA Root' certificate).</p>
  
  <p>When I try to import either of them it fails:</p>
  
  <pre><code>$ keytool -importcert -alias tomcat -file tomcat.crt -keystore keys
  Enter keystore password:
  keytool error: java.lang.Exception: Failed to establish chain from reply
  
  $ keytool -importcert -alias thawte -file thawtetest.crt -keystore keys
  Enter keystore password:
  keytool error: java.lang.Exception: Input not an X.509 certificate
  </code></pre>
  
  <p>Adding the <code>-trustcacerts</code> option to either of these commands doesn't change anything either.</p>
  
  <p>Any idea what I am doing wrong here?</p>