I successfully renewed my letsencrypt certificates. But, now, I need to feed my truststore with the new certificate for Jetty to accept it.

2 months ago, when I studied this whole letsencrypt certificates, I left a note to myself, saying:

//After each renew, do:
openssl pkcs12 -export -in /etc/letsencrypt/live/mydomain.fr/fullchain.pem -inkey /etc/letsencrypt/live/mydomain.fr/privkey.pem -out server.p12 -name mydomain
keytool -importkeystore -deststorepass xxxxx -destkeypass xxxxx -destkeystore server.keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass xxxxx -alias mydomain
keytool -import -file /etc/letsencrypt/live/mydomain.fr/fullchain.pem -alias mydomain -keystore myTrustStore

That is what I did, but when I go to my web page, I still get an error saying that the certificate has expired.

What am I missing?

Edit: After

keytool -list -v -keystore server.keystore -storepass <<password>> | egrep "Alias|Valid"

I get

Valide du : Thu Oct 06 13:54:00 CEST 2016 au : Wed Jan 04 12:54:00 CET 2017
Valide du : Thu Mar 17 17:40:46 CET 2016 au : Wed Mar 17 17:40:46 CET 2021
  • 2
    Do you need to tell the web server to reload the certificate? Apache httpd 2.4 needs that, for example.
    – user
    Commented Oct 6, 2016 at 20:52

1 Answer 1


Try the following command to check the expiration dates of the certificates in the keystore

keytool -list -v -keystore server.keystore -storepass <<password>> | egrep "Alias|Valid"

This should tell you if the new certificate is in the store with the valid dates you expect.

If the certificate is present and valid then check the following

If you imported the key and certificate originally using the PKCS12 method, use an alias of "1" rather than "jetty", because that is the alias the PKCS12 process enters into the keystore.

This is documented in the jetty documentation about renewing certificates found here.

  • See my edit for your first question. About the second one, I tried to replace -alias mydomain by -alias 1 in my previous commands, but I get errors, first about the alias <1> doesn't exist, then source key file exists, but is empty, and now, I'm quite lost about what state my keystore currently is :'(
    – Sharcoux
    Commented Oct 6, 2016 at 20:36
  • Ok, after playing a while with all kind of combinations, and using the link you provided in your answer, I restarted the server and it worked. The issue is that I don't know exactly which solution made it work exactly. I belive that it is the -trustcacerts option which is missing in my first attempt. Thanks a lot anyway. Hope the next renewal will go smooth now.
    – Sharcoux
    Commented Oct 7, 2016 at 7:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .