keytool error: java.lang.Exception: Input not an X.509 certificate

Question

I am trying to import Gmails smtp certificate for use with Jira, but I get this error when importing using Javas keytool.

I used openssl to get the certificate, everything between ----Begin Certificate---- and ----End Certificate---- (inclusive). I also attempted to create an x.509 certificate using Windows Certificate Manager, but still get this error. I have verified that there are no extra whitespaces in the file.

I have seen many people with this problem online, but none of the solutions seem to work for me. Any help would be appreciated.

Thanks

Borealid · Accepted Answer · 2010-08-10 14:02:04Z

16

openssl x509 -outform der -in foo.pem -out foo.der

Then use the DER-encoded output certificate.

answered Aug 10, 2010 at 14:02

Borealid

99.4k9 gold badges111 silver badges123 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

dbbooh01 Over a year ago

I was really hoping this would work, but I jut keep getting the same error. Here is what I'm doing exactly. openssl s_client -connect smtp.gmail.com:465 I copy that to a file called gmail.pem openssl x509 -outform der -in gmail.pem -out gmail.der keytool -import -file pathTo/gmail.der -keystore pathTo/cacerts

dbbooh01 Over a year ago

This actually did work, I forgot the argument -trustcacerts when using keytool. Thanks for the help

Alastair McCormack Over a year ago

@dbbooh01 the reason this probably worked is because -trustcacerts imports the standard root CAs from the distributed cacerts file. This would include the root CAs that were in the trust chain for Gmail.

Java Curious ღ Over a year ago

@dbbooh01 : will you give me whole command you have entered. i have also write x509 -outform der -in gmail.pem -out gmail.der but it doesn't generate file gamil.der. where it generate file gmail.der ?

Subodh Joshi · Accepted Answer · 2018-01-29 07:18:40Z

5

The answer is correct but be sure to INCLUDE the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- in the copy/paste. This command will then work:

openssl x509 -outform der -in gmail.pem -out gmail.der

and then you do:

sudo keytool -import -file gmail.der -keystore $JAVA_HOME/jre/lib/security/cacerts -trustcacerts

edited Jan 29, 2018 at 7:18

Subodh Joshi

13.7k37 gold badges123 silver badges212 bronze badges

answered Mar 6, 2011 at 3:53

Robert Glover

511 silver badge1 bronze badge

1 Comment

Andrejs Over a year ago

Yepp, this was the cause of my problem too

Sydwell · Accepted Answer · 2012-07-23 12:35:28Z

Unfortunately, openssl didn't work for me.

unable to load certificate 2740:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:./crypto/as n1/tasn_dec.c:1294: 2740:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:./ crypto/asn1/tasn_dec.c:380:Type=X509_CINF 2740:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 e rror:./crypto/asn1/tasn_dec.c:749:Field=cert_info, Type=X509 2740:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:./crypto/pem/pem_oth .c:83:

Used this knowledge base and success followed.

https://knowledge.verisign.ch/support/code-signing-support/index?page=content&id=SO18659&actp=search&viewlocale=en_US&searchid=1343045026667

Collectives™ on Stack Overflow

keytool error: java.lang.Exception: Input not an X.509 certificate

3 Answers 3

4 Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related