title: How to remove just one certificate from a certificate chain in a Java keystore
body: <p>I have a Tomcat server with a certificate chain for HTTPS stored in a Java keystore.  The chain includes the self-signed root CA certificate.  Although this is apparently okay by <a href="https://www.rfc-editor.org/rfc/rfc5246" rel="nofollow noreferrer">the TLS spec</a>, some validation services warn about it, and <a href="https://security.stackexchange.com/questions/65332/ssl-root-certificate-optional">it's probably better to leave it off</a>.</p>
  <p>How can I edit the keystore to remove just the self-signed root CA certificate, but leave the rest of the chain and the private key intact?</p>