How to install X509 certificate chain without the private key

Question

I have been given three certificates by my client:

DigiCert Global Root CA.cer - (Root certificate) GeoTrust RSA CA 2018.cer - (Intermediate certificate) krapiuat_sharekhan_com.cer - (SSL certificate for my domain)

I am expected to install all the three certificates on my Spring Boot server to enable SSL on the same.

I am using this with the embedded Tomcat server in my Spring Application and am unable to start the SSL enabled service due to errors.

My attempts are as stated below:

Attempt 1

I tried to combine all three .cer files into a single file and add it to the keystore

`cat krapiuat_sharekhan_com.cer  GeoTrust\ RSA\ CA\ 2018.cer  DigiCert\ Global\ Root\ CA.cer> combined_cert.cer

keytool -importcert -keystore krKeyStore.jks -file combined_cert.cer -alias krRiskRatingUAT -trustcacerts`

Note: The final jks file showed just one entry as trustedCertEntry

Then I added the file krKeyStore.jks in the /resource folder of my Spring app and added the following lines in my application.properties file:

`server.port=8443
server.ssl.key-store-type=JKS
server.ssl.key-store=classpath:krKeyStore.jks
server.ssl.key-store-password=mypassword
server.ssl.key-alias=krRiskRatingUAT`

The service failed to start with the exception java.io.IOException: jsse.alias_no_key_entry

---

Attempt 2

I tried to individually add the three certificates to my keystore

`keytool -import -trustcacerts -alias root -file DigiCert\ Global\ Root\ CA.cer -keystore krKeyStore20.jks
keytool -import -trustcacerts -alias intermediate -file GeoTrust\ RSA\ CA\ 2018.cer -keystore krKeyStore20.jks
keytool -import -trustcacerts -alias krRiskRatingUAT20 -file krapiuat_sharekhan_com.cer -keystore krKeyStore20.jks`

Note: The final jks file now showed three entries all as trustedCertEntry

Then I added the file krKeyStore20.jks in the /resource folder of my Spring app and added the following lines in my application.properties file:

`server.port=8443
server.ssl.key-store-type=JKS
server.ssl.key-store=classpath:krKeyStore20.jks
server.ssl.key-store-password=mypassword
server.ssl.key-alias=krRiskRatingUAT20`

But the error still persists - java.io.IOException: jsse.alias_no_key_entry

Is it always mandatory to have the key? My client is not ready to give me the private key and wants me to install the certificates without a key. Any help will be duly appreciated.

Answer 1

You simply cannot create a SSL server without having the private key for the server certificate. The private key is needed to proof to the client that you are the owner of the certificate, otherwise anybody who gets access to the certificate (which is every client connecting to the server) could claim to be owner of the certificate, ie everybody could claim to be google.com or similar.