How to properly generate a keystore for ssl

godaddykeystoressh-keysssl-certificate

I'm trying to get an ssl certificate from godaddy for use with jetty. These are my steps:

keytool -keystore keystore -alias jetty -genkey -keyalg RSA -keysize 2048

What is your first and last name?: example.com
What is the name of your organizational unit?: me
What is the name of your organization?: me
What is the name of your City or Locality?: someplace
What is the name of your State or Province?: somewhere
What is the two-letter country code for this unit?: XX
no?: yes

That generates my keystore file. Next:

keytool -certreq -alias jetty -keystore keystore -file jetty.csr

That generates my csr file. I now have two files:

keystore
jetty.csr

I open jetty.csr with a text editor, copy its contents, send it to the godaddy ssl service (I pick SHA-2 as the signature algorithm fwiw).

I get a response back from godaddy with two files:

gd_bundle-g2-g1.crt  // is this the 'public/intermediate' certificate?
123456789.crt        // is this my private key? why is it named so?

Now the jetty doc on this says:

"You need both the private key and the certificate in the keystore. You should load the certificate into the keystore used to generate the CSR with keytool"

So I try to load the public/intermediate certificate into my keystore file:

keytool -import -trustcacerts -alias godaddy -keystore keystore -file gd_bundle-g2-g1.crt

Trust this certificate? [no]:  yes
Certificate was added to keystore

That seems to work. I wasn't sure what alias to use, I just guessed "godaddy".

Lastly I try to load the private key into my keystore file:

keytool -import -trustcacerts -alias jetty -keystore keystore -file 123456789.crt 

which results in:

keytool error: java.lang.Exception: Failed to establish chain from reply

and I'm not sure what that means.

This is the jetty doc that I've been following, but I can't see where I'm going wrong now:

http://wiki.eclipse.org/Jetty/Howto/Configure_SSL#Loading_Keys_and_Certificates

Thanks for any help

Best Answer

Oh sweet heavens, the answer from this question by s_t_e_v_e worked:

https://stackoverflow.com/questions/4008837/configure-ssl-on-jetty

I have no idea why and the documentation for this stuff is really wild, kudos to anyone that can figure it out on their own!