 <p>I've looked at your code, and I think the problem is that you're outputting the cert in raw binary DER format using certificate.getEncoded() when the browser expects PKCS #12 format. I've never done this programatically, I've always used keytool or openssl to convert between formats so I can't help more than that.</p> <p>eta: this explains how to create, sign and export a PKCS12 in java: <a href="http://www.mayrhofer.eu.org/create-x509-certs-in-java" rel="nofollow">http://www.mayrhofer.eu.org/create-x509-certs-in-java</a> (note: it's an old post and requires bouncycastle and a bit of hacking :( - a modern version of bouncycastle may simply provide this functionality)</p>