Develop Reference

java keystore CA certificate validity extension

I had a CA certificate which is expiring this year. My key.jks file list as below.
inter, Dec 17, 2019, trustedCertEntry,
....
root, Dec 17, 2019, trustedCertEntry,
....
app.domain.com, Dec 29, 2019, PrivateKeyEntry,
To extend validity I gave the same CSR file given last year. Now I have new 3 crt files for inter, root and domain-name.
Now I tried to remove old entries by
keytool -delete -alias inter -keystore key.jks -storepass pword
keytool -delete -alias root -keystore key.jks -storepass pword
keytool -delete -alias app.domain.com -keystore key.jks -storepass pword
and imported the new cert files like
keytool -import -alias inter -file intermediate.crt -keystore key.jks -storepass pword
keytool -import -alias root -file TrustedRoot.crt -keystore key.jks -storepass pword
keytool -import -alias app.domain.com -file app_domain_com.crt -keystore key.jks -storepass pword
Now keytool -list does not show PrivateKeyEntry for app_domain_com.crt and application not coming up.
inter, Dec 15, 2020, trustedCertEntry,
....
root, Dec 15, 2020, trustedCertEntry,
....
app.doamin.com, Dec 15, 2020, trustedCertEntry,
I have ADFS SSO integration and wanted to avoid changes with it because of this certificate change.

Your third delete command deleted your private key as well. That's why your application is broken, you need your private key for SSL to work.
When you said you wanted to reuse the same CSR that was used last time, it means you were planning on using the same private key, but you deleted it. That's why you see them as different types after you deleted and imported. In your first keytool list you have app.domain.com as a PrivateKeyEntry (contains private key and certificate), but after you deleted and imported the cert, you have the app.domain.com as a TrustedCertEntry (only certificate). If you had not deleted the private key, the import command will have associated the new certificate with it, since the private key is not found, it just adds the certificate.
In your case you should have done these steps:
Not run the third delete command
Imported the new certificate and associated with the existing private key using keytool's -importcert command.
Something to consider when trying to reuse the same CSR as last time can be found here, here and here.
P.S: I hope you have backed up your original keystore.

KeyStore and TrustStore load failed - Private key must be accompanied by certificate chain

I have created a self signed certificate using the following command:
keytool -genkeypair -keyalg RSA -alias test-api -keystore test-api.p12 -storepass password -validity 3650 -keysize 2048 -storetype pkcs12
I then imported this keystore into new truststore:
keytool -import -trustcacerts -alias test-api-2018 -file test.crt -keystore trusted-keystore.p12 -storetype pkcs12
In Java, creating a custom SSL store provider (org.springframework.boot.context.embedded.SslStoreProvider). As a part of it, loaded keystore and truststore using the following Java code:
try {
try (final InputStream keyStoreStream = new ByteArrayInputStream(Base64.decode(keyStoreEncoded))) {
keyStore = KeyStore.getInstance(KEYSTORE_TYPE_PKCS12);
LOGGER.info("Loading a KeyStore object based on the decoded value.");
keyStore.load(keyStoreStream, serverSslKeyPassword.toCharArray());
}
....
trustStore.load(trustStoreStream, serverSslTrustStorePassword.toCharArray());
}
Created custom implementation of EmbeddedServletContainerCustomizer and set SSL Provider:
public void customize(final ConfigurableEmbeddedServletContainer configurableEmbeddedServletContainer) {
configurableEmbeddedServletContainer.setSslStoreProvider(awsSslStoreProvider);
}
Application fails to start because of the following error:
Caused by: java.lang.IllegalArgumentException: Private key must be accompanied by certificate chain
at java.security.KeyStore.setKeyEntry(KeyStore.java:1136)
at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:253)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)
... 19 common frames omitted

I just jad this problem to today, the problem occurs when the security config in the application.properties file isnt configured properly, this causes the certificate chain to break.
in my case i used
server.ssl.key-password=123456789
instead of
server.ssl.key-store-password=123456789
minor issues like this can cause issues.

This also happens when using BouncyCastle as PKCS12 key store provider and the key alias is using incorrect upper case.
E.g. (incorrect):
server.ssl.key-alias=17B2E92E5694C7AE11A65C4A4EBFC75558399E05
instead (correct):
server.ssl.key-alias=17b2e92e5694c7ae11a65c4a4ebfc75558399e05
The strange thing about this error is that the key is found, so obviously is not case sensitive, but the check for ks.getCertificateChain(keyAlias) is.

Unable to load certificate chain to java keystore

I have a blah.p7b certificate type PKCS#7 which i want to import it to a java keystore using keytool in order to enable HTTPS on tomcat , i don't have the alias name and keystore when the certificate was generated i took it from the client whose want to enable https on our web-application server that they use, can this works without having the original alias name and keystore ?
when i tried to import the certificate i used this command
keytool -import -trustcacerts -file certificate.p7b -keystore keystore -storepass <mypasswd> -alias "myalias"
but it gives me this error
keytool error: java.lang.Exception: Certificate reply does not contain public key for <mydomain>
Please help...

If you haven't got the original KeyStore you are hosed. You have to generate a new KeyStore, a new keypair, a new CSR, get it signed, and then import the signed cert and its chain into the KeyStore using the same alias as the keypair.

java.security.KeyStoreException: failed to extract any certificates or private keys - maybe bad password?

I'm using Not-yet commons SSL to develop my own TLS Socket.
But always got No private keys found in keystore on following code
private SSLServer sslS=null;
//...
sslS=new SSLServer();
KeyMaterial km=new KeyMaterial(certChain, privateKeyFile, certPassword.toCharArray(), privateKeyPassword.toCharArray());
The certChain used original JRE's cacert:
C:/Program Files/Java/jre1.8.0_101/lib/security/cacerts
This give me a java.security.KeyStoreException: No private keys found in keystore!
The certChain used my own:
keytool -certreq -alias 127.0.0.1 -keystore ServerKey.jks -file 127.0.0.1.csr
This give me a java.security.KeyStoreException: failed to extract any certificates or private keys - maybe bad password?
But I can 100% sure that my password is right. My password is a simple "123456", there is no reason I can do wrong on it.
The privateKey I generated by:
keytool -genkey -alias 127.0.0.1 -keyalg RSA -keystore ServerKey.jks -keysize 2048
How can I solve this problem, any suggestion ?

Import Public Private key pair to a Keystore

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for verification. The question is how do I load this public private key pair into a keystore? I cant use KeyStore.SetKeyEntry as it requires a certificate parameter along with the private key.
I thought that I would have to wait for the CA to send back a certificate which should then be used for loading the key pair. But If I create the keystore using the keytool command -
keytool -genkey -keyalg RSA -keysize 2048 -sigalg sha1withRSA -alias aliasname -validity 365 -keystore keystorename
and then load this keystore into the Java keystore class, the keystore object contains a privatekeyentry and a CertificateEntry. How is this possible without obtaining a certificate back from the CA.

The keytool command that you used creates a self-signed certificate. When you receive the new certificate signed by the CA, you can import that certificate into the keystore, which will then replace the self-signed certificate.
About your Java question, you will either need to generate a self-signed certificate based on the public key that you created (and signed by the private key), or you will need to wait for the CA to return your signed certificate and use that with the private key in SetKeyEntry.