0

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another member of my team renewed the certificate in their jks. They sent me the jks, and I exported the renewed cert to it's own file. I'm now trying to import that cert back into my file under the same alias, but I am getting the following error:

keytool error: java.lang.Exception: Public keys in reply and keystore don't match

I don't want to just replace the jks, but I just need to renew that one particular cert. What does the error mean?

Improve this question
2
  • 1
    You should try superuser.com though maybe people here will be able to help. But this is a question about a particular java ecosystem tool, not about x509 certificates or PKI or security
    – Z.T.
    Commented Jul 16, 2019 at 17:59
  • @Z.T. Thanks for the info! I'll try asking there. I looked up cert issues, found this stack exchange, and just thought to post it here.
    – Brandon
    Commented Jul 16, 2019 at 18:01

2 Answers 2

Reset to default
0

Certificates are nothing but public keys signed by a certificate authority. If it is a server-side certificate you're trying to import, the certificate would need its corresponding private key as well. You probably need to import the contents of the entire jks file shared by your teammate because I assume it has the renewed key also. If you only import the certificate, it might try to match it with the old key and throw the error you are seeing.

Improve this answer
0

The issue is most likely caused by the fact that there was a new keypair generated upon renewal. And the certificate does not match the public key stored in the jks. You need to ask your colleague if he generated the CSR using the old key or if he has created a new one. If he used the old key, then you need to remove the old certificate from the jks (otherwise you wouldn't be able to import your certificate using the same alias) and import the new one reusing previous alias.

If your colleague has created the new key pair, then you need to import his jks file in order to be able to use it (you could maybe export the private key if it was set to extractable which I doubt), otherwise, you won't have access to the private key corresponding with the certificate. You can still import the certificate to a jks without its private key if you are planning on using it for encryption/signature validation only.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .