title: Exception: Public keys in reply and keystore don't match
body: <p><code>keytool -import -alias tomcat -keystore keystore.jks -file secure.mysite.com.crt</code></p>
  
  <blockquote>
    <p><strong>keytool error: java.lang.Exception: Public keys in reply and keystore don't match</strong></p>
  </blockquote>
  
  <p>I had followed the instructions in this Apple Technical Note exactly.<br>
  <strong><a href="https://developer.apple.com/library/mac/technotes/tn2326/_index.html" rel="nofollow">https://developer.apple.com/library/mac/technotes/tn2326/_index.html</a></strong></p>
  
  <p>This has allowed me to create my own CA identity, and then use that CA to issue an SSL certificate for my internal server (all done through Apple's Keychain). On the server (Tomcat 6), I've used <code>keytool</code> to import <code>.p12</code> (exported from Apple's keychain) and merge it into a new <code>.jks</code> keystore that is later configured in Tomcat. That all worked fine.</p>
  
  <p>However all guides and documentation I come across, <a href="http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html" rel="nofollow"><strong>even the one from Tomcat itself</strong></a>, say to generate a <strong>CSR</strong> from the <code>keytool</code> and then import the CA's response cert back into <code>.jks</code>. I want to do this through <strong>Certificate Signing Request</strong> method for a number of reason, but I've been struggling to get this to work for couple of days now.</p>
  
  <p>My steps are:</p>
  
  <ul>
  <li>Create own CA on Apple's Keychain as described in the first link.</li>
  <li><p>Export own CA as <code>myCA.cer</code> as described in the first link.</p></li>
  <li><p>From Tomcat's server machine:<br>
  <code>keytool -genkey -alias tomcat -keyalg RSA -keystore keystore.jks</code><br>
  <strong>password:</strong> keystorepass<br>
  <strong>renter pass:</strong> keystorepass<br>
  <strong>first and last name:</strong> secure.mysite.com<br>
  <strong>other info:</strong> stuff<br>
  <strong>Enter key password for <code>&lt;tomcat&gt;</code>:</strong> keystorepass</p></li>
  <li><p><code>keytool -certreq -alias tomcat -keyalg -RSA -keystore keystore.jks -file secure.mysite.com.csr</code></p></li>
  <li><p>Next I open Apple <code>Keychain Access</code> > <code>Certificate Assistant</code> > <code>Create a Certificate For Someone Else as a Certificate Authority...</code></p></li>
  <li>I drag the <code>secure.mysite.com.csr</code> to the required area</li>
  <li>Select my own CA, select validity time, provide certificate information<br>
  <strong>Common Name:</strong> <code>secure.mysite.com</code><br>
  and other information</li>
  <li>Make sure that <strong>SSL Server Authentication</strong> is enabled under Extended Key Usage Extension</li>
  <li>Make sure that <strong>dNSName</strong> is <code>secure.mysite.com</code> under Subject Alternative Name Extension</li>
  <li><p>And now I have <code>secure.mysite.com</code> (<strong>certificate and private key</strong>) in my Keychain.</p></li>
  <li><p>I export <code>secure.mysite.com</code> as <code>.p12</code> (as in the linked documentation)</p></li>
  <li><p>I then extract the cert and key:<br>
  <code>openssl pkcs12 -in secure.mysite.com.p12 -nokeys -out secure.mysite.com.crt</code><br>
  <code>openssl pkcs12 -in secure.mysite.com.p12 -nocerts -nodes -out secure.mysite.com.key</code></p></li>
  <li><p>Finally, I am trying to import the certs back to keystore<br>
  <code>keytool -import -alias root -keystore keystore.jks -trustcacerts -file myCA.cer</code><br>
  <strong>Do you want to trust:</strong> yes<br>
  All good.</p></li>
  <li><p><code>keytool -import -alias tomcat -keystore keystore.jks -file secure.mysite.com.crt</code>  </p></li>
  </ul>
  
  <h2><strong>keytool error: java.lang.Exception: Public keys in reply and keystore don't match</strong></h2>
  
  <p>I have tried with and without importing the <code>myCA.cert</code>.<br>
  I have tried exporting <code>secure.mysite.com</code> from Keychain directly in <code>.cer</code> format.<br>
  Started the process from scratch multiple times.</p>
  
  <p>What am I missing here?</p>