title: Newbie keytool command -- how to update cert already added to keystore?
body: <p>I have a self-signed cert for my linux email server exim. To enable my Java functions to access this email server via GlassFish, I originally issued:</p>
  
  <pre><code># keytool -importcert -v -noprompt -alias mail.mycompany.com -file /path/to/mail.mycompany.com.der -keystore /path/to/config/cacerts.jks -storepass changeit
  Certificate was added to keystore
  </code></pre>
  
  <p>This worked fine, until the certificate expired. I had to create a new self-signed cert, and now Java gives the error <code>PKIX path validation failed … path does not chain with any of the trust anchors</code>. </p>
  
  <p>To attempt to fix this, I derived a new <code>mail.mycompany.com.der</code> file from the new exim cert (as done originally). But when I issue the above keytool command (as done originally), it gives error <code>Certificate not imported, alias &lt;mail.mycompany.com&gt; already exists.</code></p>
  
  <p>I think the problem is that I can't use that same keytool command. I need to use a different one that doesn't add the cert to the keystore, but updates the cert already there with a newer version. Anyone can point me in the right direction for that command?</p>
  
  <p>As an aside, is there some automated process that I'm missing? That is, cert's expire all the time... does that mean IT admins need to always update the keystore with the new certs manually using code like this? Or, can this be automated somehow?</p>