3

Attempting to add a certificate to the keystore so I can use it in an java based application. This is a new concept to me.

I have a .p7b certificate for the site and I put together a keytool command. When I enter it, I am prompted to specify a pwd and then I am prompted with the following error

keytool error: java.lang.Exception: Input not an X.509 certificate

Can anyone provide insight?

C:\Users\Desktop\>keytool -import -trustcacerts -file "service.site.com - SSL Cert.p7b" -keystore service.site.com.jks
Enter keystore password:
Re-enter new password:
keytool error: java.lang.Exception: Input not an X.509 certificate
1
  • Where did you get this certificate from?
    – user207421
    Sep 22, 2014 at 23:59

2 Answers 2

2

You could try converting the key to CER (X509) and then try importing it:

openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer

I have encountered a similar problem even though I was trying to import a .pem file. The file contained only the a single certificate in both humain readable form and encapsulated within —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–. In java 7 (patch 71) the keytool failed to parse such file and threw the same error you've got. Once I removed the text portion of the file:

Certificate:
Data:
    Version: 3 (0x2)
    Serial Number: 11864724255945479761 (0xa4a7f7d949c31d11)
Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=COM, ST=CA, O=Company, OU=ORG, CN=ORG/[email protected]
    Validity
        Not Before: Jan  5 15:30:35 2015 GMT
        Not After : Jan  2 15:30:35 2025 GMT

it worked alright for me.

Please also take a look at the following article (https://myonlineusb.wordpress.com/2011/06/19/what-are-the-differences-between-pem-der-p7bpkcs7-pfxpkcs12-certificates/) as it explains the differences between various formats and provides commands how to convert from one format to another

0

I faced the same error when importing a certificate using keytool. Starting with Java 6 release,an enhancement was added to keytool: namely that keytool can merge and import keystores that are in PKCS12 format. I concur with tazarov answer, you need to convert the PKCS#7 or P7B format (which basically is stored in Base64 ASCII format and has a file extension of .p7b or .p7c).

Before jumping in the solution I think is worth it to clarify some concepts. I will quote the below concepts from an excellent book:Bulletproof SSL and TLS by Ivan Ristić Copyright © 2015 Feisty Duck Limited. All rights reserved.

PKCS#7 certificate(s) A complex format designed for the transport of signed or encrypted data, defined in RFC 2315. It’s usually seen with .p7b and .p7c extensions and can include the entire certificate chain as needed. This format is supported by Java’s keytool utility.

Binary (DER) certificate Contains an X.509 certificate in its raw form, using DER ASN.1 encoding.

ASCII (PEM) certificate(s) Contains a base64-encoded DER certificate, with -----BEGIN CERTIFICATE----- used as the header and -----END CERTIFICATE----- as the footer. Usually seen with only one certificate per file, although some programs allow more than one certificate depending on the context. For example, the Apache web server requires the server certificate to be alone in one file, with all intermediate certificates together in another.

SOLUTION

Fetch and Convert:

 openssl s_client -showcerts -connect "service.site.com - SSL Cert.p7b":443 </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem

Hope it helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.