title: Obtaining all certificates in a chain; both intermediate and root
body: <p>I'm working in Java with Apache's HTTPClient and trying to connect to graph.facebook.com. I'm getting "SSLPeerUnverifiedException: No peer certificate" errors, so I guess Facebook's CA isn't in the default keystore. So I need to create my own keystore with all the certificates that I want to trust, yes? So I found the following command for obtaining the certificate:</p>
  
  <pre><code>echo | openssl s_client -connect graph.facebook.com:443 2&gt;&amp;1 | \
   sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' &gt; mycert.pem
  </code></pre>
  
  <p>Don't know what's going on there, but it seems to have worked. I added the cert to a Bouncy Castle formatted keystore. I created an SSLSocketFactory using the new keystore, but it still doesn't work.</p>
  
  <p>My first guess was, perhaps I don't have all the certificates in the chain (apparently these things come in chains). So how do I know whether there are so-called "intermediate" CAs involved? And how do I grab those certificates? Am I even on the right track?</p>