Knowledge Base

How to install and bind a server certificate using Java keytool

Updated on July 18, 2026

Overview

By the end of this guide, you will have imported the Sectigo intermediate certificate and your signed server certificate into your Java keystore using the keytool utility, and confirmed that the server certificate is bound to its private key through a complete certificate chain. The process uses two keytool imports: first the intermediate certificate under a new alias, then the server certificate under the same alias you used to generate the Certificate Signing Request (CSR). Importing the server certificate under that original alias is what binds it to the existing private key, allowing your server to present a trusted chain for secure SSL/TLS connections. The final section shows how to verify the result by listing the keystore contents.

Prerequisites

Before you begin, make sure you have the following:

Access to the Java keytool utility

The Sectigo intermediate certificate file you downloaded

Your signed server certificate file (issued after CSR validation)

The keystore file you used when generating the CSR

The alias name you used during CSR generation (for example, servercert)

Steps

Step 1 — Import the intermediate certificate

Download the intermediate certificate file from Sectigo, then import it into your keystore under a new alias.

Note: Do not reuse the alias you used to create the CSR for the intermediate certificate. Choose a separate alias (for example, Intermediate). You will use the original CSR alias in Step 2 for the server certificate.

Run the following command:

keytool -import -alias Intermediate -keystore <your_keystore_filename> -trustcacerts -file <intermediate_filename>

Step 2 — Import the server certificate

Import your server certificate under the same alias you used when generating the CSR (for example, servercert). Using the original alias binds the server certificate to its existing private key.

Run the following command:

keytool -import -alias servercert -keystore <your_keystore_filename> -file <server_certificate_filename>

How to verify success

After each import, keytool displays the message Certificate was added to keystore. To confirm the full chain was installed correctly, list the keystore contents:

keytool -list -verbose -keystore <your_keystore_filename>

You should see: