I'm interfacing with a secure web service, and authenticating using a client certificate. I'm confused about step #3 in the client configuration:
- Generate a private key into keystore
- Generate a CSR to have your public key signed
- Import the Certificate Authority certificate into your keystore so that a proper certificate chain can be established when you import your signed certificate in Step 4.
- Import the certificate provided in response to the CSR
Steps 1, 2, and 4 all make sense. Step 3 makes no sense to me. I already have my private key in the keystore, and the certificate is a statement that xyz third party has signed my keypair. If I skip step three, I get an error: "keytool error: java.lang.Exception: Failed to establish chain from reply". I don't understand what it is validating / why such a validation is necessary. Hypothetically, if I happened to import a CSR response from someone I didn't trust, it doesn't seem like that grants any privileges / does any damage.
The certificate imported in step #3 is NOT related to the certificate chain used to validate the server's identity when the client connects (that certificate is separately imported into my truststore). The certificate in step #3 is required in order to import the response to my CSR.
Why is step 3 necessary?