java - Apache tomcat: Importing already existing certificates into keystore -

i trying configure ssl our server. now, have made sure that crt files password same keystore(.jks password). however, whenever import crt file either alias tomcat or root(only 1 of them can use there 1 crt file), ssl_error_no_cypher_overlap.

i not able find guide import 1 certificate not complain it's self-signed certificate , no ssl_error_no_cypher_overlap error 1 certificate.

these files have domainname.ca-bundle, .crt, .csr, .key, .p12, domainname.jks,

this command gave :

keytool -import -trustcacerts -alias root -file domainname.crt -keyalg rsa -keystore domainaname.jks 

connector :

 <connector port="443" protocol="http/1.1" sslenabled="true" maxthreads="200" compression="force"               compressionminsize="1024" scheme="https" secure="true" clientauth="false" sslenabledprotocols="tlsv1.2,tlsv1.1,tlsv1" sslprotocol="tls" uriencoding="utf-8"  compressablemimetype="text/html,text/xml,text/plain,text/css,text/ javascript,application/x-javascript,application/javascript"                keystorefile="domain.jks" keystorepass="pass" /> 

any nice. lot.

meta: feels duplicate couldn't find match ...

ssl/tls server must have certificate matching private key and chain certs if applicable. single certificate itself, or several certificates, not sufficient. first

 keytool -list -v -keystore $d.jks 

and privatekey entry (not trustedcert entry). if present, @ cert(s) determine whether certs want. if aren't desired cert(s), have desired cert(s) in .crt , bundle files, describe contents of .crt , bundle files , can work out how use them fix .jks. in particular, there 2 formats commonly used single certs , several ca "bundles"; if open files in editor notepad or vi , first line -----begin something----- followed block of letters , digits ----end same---- , maybe more of same, post somethings; if appear random characters , have hex dump tool available post first 64 bytes @ least, or if have openssl or other asn.1 (binary) parser available post results of that. if there no privatekey @ all, .jks useless; discard , continue.

your .key file sounds contain private key, there dozens of different formats people label .key , it's unlikely file in usable format. if key not more conveniently in p12, can come this.

your .p12 file contains private key , cert(s), not desired cert(s). (technically pkcs#12 standard allows file no private key, common tools create pkcs#12 don't ever that.) see have now,

keytool -list -v -keystore $d.jks -storetype pkcs12 

if want, tomcat (and java/jsse) can use pkcs12 directly keystore in place of jks: set keystorefile , keystorepass , add keystoretype="pkcs12". alternatively can convert pkcs12 jks with

keytool -importkeystore -srckeystore $d.p12 -srcstoretype pkcs12 -destkeystore $d.jks  

if .p12 contains privatekey wrong cert(s), there 2 approaches:

• first convert pkcs12 jks above, fix certs in jks; same case first paragraph: jks contains privatekey wrong cert(s)

• if have or openssl, use "unpack" pkcs12 separate privatekey , cert files, replace wrong cert files right ones, , reconstruct new pkcs12. puts in fourth paragraph: pkcs12 correct cert(s) can either use or convert jks , use that.