Comments on: Verisign’s New Intermediate CA and You

By: Daniel

Daniel — Mon, 25 Jan 2010 08:29:57 +0000

Thanks! Well written and useful!

By: ron

ron — Wed, 07 Oct 2009 15:19:40 +0000

your doc is really helpful. Thanks

By: anionic

anionic — Fri, 04 Sep 2009 16:11:07 +0000

In case anyone is worried like I was, it seems you can use any (novel) alias you like for the intermediate certificate; the SSL certificate will find it. The main use for the intermediate’s alias is in case you want to keep notes elsewhere about why it is there, or you later want to delete it.

If, like me, you install the SSL cert first, it seems that it’s then too late to add the intermediate; if you “keytool -delete” the SLL cert, you will lose its private key and stuff remembered from when you generated the CSR, and it will never work. I know of no alternative but to revoke the cert and reapply (shouldn’t cost you any extra).

HTH someone…

By: Mike Fleming

Mike Fleming — Thu, 26 Mar 2009 00:48:50 +0000

Lim, Have a look at Andreas Sterbenz's post. Hopefully, that will help you.

By: Lim

Lim — Fri, 20 Mar 2009 08:43:07 +0000

why i keep having error message

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBui
lderException: unable to find valid certification path to requested target

when i restart the tomcat

By: Anon

Anon — Thu, 05 Jul 2007 08:34:24 +0000

Thanks for the tips. I had absolutely no idea what happened with “keytool error: java.security.cert.CertificateException: java.io.IOException: DerInputStream.getLength(): lengthTag=127, too big.”