I'm working in an environment with a working Microsoft Active Directory Certificate Services (MS ADCS) PKI. In that environment, I'm deploying this Java app which uses a java key store to manage the keys and certificates for its https server. The de facto tool for administration seems to be keytool.exe. The documentation for keytool can be found here.

A generally-recommended method of generating a key pair, creating a certificate request, and importing the the certificate is as something like this:

1. Generate Key Pair keytool -genkey -keyalg RSA -keysize 2048 -alias securekey -keystore keystore

2. Generate Certificate Request keytool -certreq -alias securekey -keystore keystore -file NewCertRequest.csr

3. Import Root Certificate keytool -importcert -alias root -keystore keystore -file rootcert.csr

4. Import Intermediate Certificate keytool -importcert -alias intermediateX -keystore keystore -file intcert.csr <= repeat this for each intermediate certificate, in order

5. Import Newly-Signed Certificate keytool -importcert -alias securekey -keystore keystore -file NewlySignedCert.csr

keytool and Establishing a Certificate Chain

Step 3 establishes the trust anchor. keytool 'prints out' the certificate for your review and requires you to answer "yes" to explicitly trust that certificate.

Step 4 imports the intermediate certificates in the trust chain that link from the root to the newly signed certificate. When you import each successive subordinate intermediate certificate, keytool automatically trusts them (or at least it's supposed to). The way that keytool signals that it has a complete certificate path to a trust anchor (i.e. the root certificate from step 3) is subtle and weakly documented:

If the certificate is not found and -noprompt option is not specified, the information of the last certificate in the chain is printed out, and the user is prompted to verify it.

The unwritten corollary to this is as follows: "If keytool can verify a complete certificate path to a trust anchor, it will not print out any certificate."

You can confirm this by using, for example, the GeoTrust Global CA and Google Internet Authority G2 certificates for steps 3 and 4, respectively. (Find these certs behind the green lock when you go to https://www.google.com.) keytool will print out the root GeoTrust Global CA and ask you to explicitly trust it. After trusting GeoTrust Global CA keytool will import Google Internet Authority G2 without printing out any certificate thus indicating that keytool trusts Google Internet Authority G2.

keytool can't chain my Microsoft ADCS certs

When I attempt to build the trust chain using my MS ADCS certificates (a la the google chain described above) keytool fails to establish a chain of trust. I'm not sure what, exactly, the difference is, but the failure is betrayed when keytool prints out the certificate in step 4 indicating that it didn't establish the trust chain up to the already-trusted root certificate from step 3.

What to do?

Given that keytool doesn't seem to be able to chain MS ADCS certs, what should I do for applications in our environment that use the java key store for managing keys and certificates?