CODEWITHSUNDEEP
javacertificateruntime-errorkeytooltruststore
Ashar
Ashar

Reputation: 3065

How to resolve keytool error: java.lang.Exception: Input not an X.509 certificate

I get the public cert from secure URL as below:

openssl s_client -showcerts -verify 5 -connect portal.myshop.com:9043 < /dev/null | openssl x509 -pubkey -noout>/home/app/portalpublic.crt

and then add the public cert to trust store using the below command:

keytool -import -alias portalpubliccert -file /home/app/portalpublic.crt -storetype JKS -keystore cacerts

However, i get the below error in doing so:

Enter keystore password:
keytool error: java.lang.Exception: Input not an X.509 certificate

Can you please suggest how can i fix this issue ?

cat -ev /home/app/portalpublic.crt

-----BEGIN PUBLIC KEY-----$
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6iAD/I9U2kKAqEokzEkA$
b2QmPQb73A/bA9YD+I+pqEkqtwQmpe6Oiu3+mx2ppA/NXG2QqNb4IfpVEgRrQygG$
6giuhMikPRq6PQ7wywfxWaPkJDDcrLg7Dn8v3l5XgpeaFZN1KSGMDpdrsEpSlxFS$
ZaxDKUfySyjppsC9GV4Lv1IXET5sSmfYw2RqCkO/Q8zcItVkzjZIBw8Y/eVrloGm$
AnQj89cLJbDFq2VogVjMGdOSGQc7cQ0ZZAyrv0XV4hKpi9taiNNXv0ZKWuvk1oFo$
GyfildXPnVKORxSx6d865kj93fCsEXlLjJ1c8xHVr992hEWlWVthByqpTB7DVccj$
xQIDAQAB$
-----END PUBLIC KEY-----$

Upvotes: 1

Views: 10602

Answers (1)

dave_thompson_085
dave_thompson_085

Reputation: 39000

Meta: this is not a programming or development problem, issue or question, and nowadays is likely to be closed. It would probably be suitable on security.SX or superuser.

I get the public cert from secure URL as below:

openssl s_client ... | openssl x509 -pubkey ...

NO YOU DIDN'T. You got the public key not the cert. The publickey is only a publickey and is not a cert, and a cert is not just a publickey although a cert (of the type here) contains a publickey. Also, you didn't get it 'from a URL'. You got it from a domain name, or more exactly from the host at or apparently at a domain name. A domain name is not a URL; some URLs (not all!) contain a domain name, but they are different things.

keytool -import ... -file ...

keytool -import[cert] requires a certificate. A publickey is not a certificate. That's why the error message says the input is not a certificate -- because it isn't.

A Java keystore can store a certificate, specifically an X.509/PKIX-type certificate, as a trustedCertEntry, but it cannot store a bare publickey. If you want to store a certificate from the given URL in a keystore, get and then import the certificate -- NOT the publickey. If for some reason you want to store only the publickey, which is basically useless if it's not linked to the other information in the certificate, don't use a Java keystore and don't use keytool.

Upvotes: 1

Related Questions