Title: How do I create a usable certificate-store from several files
Tags: ssl;openssl;keytool;certificate-store
Question: We have a process to request a signed cert from a CA and we get back 3 files:
cert.cer,  cert.key, and cert.p12
I now need to build a valid/usable cert store from those files. I have copies of the CA &amp; intermediate certs locally on my server. So I'm trying to import everything by using keytool. But I end up with a store full of about 100 certs plus the cert for my server. But when I try to use them I'm getting an error that the server cert is not valid unless the signing certs are also in the store. Basically there's no chain even though I the server cert says it was issued by the intermediate cert in the store. I use the following commands to import my certs and ca trusts.
```keytool -v -importkeystore -srckeystore &quot;cacerts.p12&quot; -srcstorepass &quot;$CA_PASS&quot; -srcstoretype &quot;pkcs12&quot; -destkeystore &quot;$KEYSTORE_NAME&quot; -deststorepass &quot;$STORE_PW&quot; -deststoretype &quot;jks&quot;;
keytool -importkeystore -v -srckeystore &quot;$CERT_NAME.p12&quot; -srcstorepass &quot;$STORE_PW&quot; -srcstoretype &quot;pkcs12&quot; -destkeystore &quot;$KEYSTORE_NAME&quot; -deststorepass &quot;$STORE_PW&quot; -deststoretype &quot;jks&quot;;
```
I'm not sure what step I'm missing. This is an Ubuntu 20.04 server.



Here is another answer: ```
How do I create a usable certificate-store ..
```
Usable is the keyword here - what are you trying to use the keystore for? (usually - SSL, client authentication or WS-Security)
```
getting an error that the server cert is not valid unless the signing certs are also in the store
```
There are different files for different purpose:

cert.cer - a public key with a CA-signed certificate
cert.key - a private key
cert.p12 - a keystore, may contain the private key, may contain the public key with its certificate, usually contains both (private key, public key, certificate). So - better validate what does the p12 keystore really contain.

The PKCS#12 keystore usually can be used as it is, often no need to import into a separate JKS. However - depends on the software.
BTW - maybe you could get a keystore-explorer, an opensource gem software giving you a great overview when not understanding the details or cli options.
```
Basically there's no chain even though I the server cert says it was issued by the intermediate cert in the store
```
Depends on the usage, but the best practice is having the CA root or its intermediate certificates imported in the truststore.
To import a CA reply in the keytool, you simply import a CA reply (issued certificate) with the same alias name as its private key. I'm not sure if you can create a whole certificate chain this way, you may have a look at the mentioned keystore-explorer to be sure.

Comment for this answer: It's ultimately to be a jks keystore to secure a WebSphere Application Server instance. I do have keystore-explorer and have looked at the various files the .cer file seems to be fine as it has a 3-level chain (ca, inter & server certs) but the .p12 (which is what I convert into the jks store) says "Path does not chain with any of the trust anchors"

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2022:00:01/14/22', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<ssl><openssl><keytool><certificate-store>', 'Title': 'How do I create a usable certificate-store from several files', 'ViewCount': 85, 'id': 70715978, 'user_AboutMe': None, 'user_AccountId': 23943199.0, 'user_DisplayName': 'Jocko2022', 'user_Reputation': 11.0, 'user_Views': 1.0, 'user_id': 17935932.0}}