Походу это из-за отсутствия расширения Authority Key Identifier. keytool просто не может связать конечный сертификат с выпускающим CA. В Windows CryptoAPI есть несколько типов сопоставления издателя: через Authority Key Identifier, через Issuer's DN и т.п. Поэтому в Windows такой сертификат может и заработает, но нет гарантии. Вот что пишет по поводу Authority Key Identifier стандарт RFC 5280:
The keyIdentifier field of the authorityKeyIdentifier extension
MUST
be included in all certificates generated by conforming CAs to
facilitate certification path construction. There is one exception;
where a CA distributes its public key in the form of a «self-signed»
certificate, the authority key identifier MAY be omitted. The
signature on a self-signed certificate is generated with the private
key associated with the certificate's subject public key. (This
proves that the issuer possesses both the public and private keys.)
In this case, the subject and authority key identifiers would be
identical, but only the subject key identifier is needed for
certification path building.
У вас сертификат содержит следующие расширения:
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Key Encipherment
X509v3 CRL Distribution Points:
Full Name:
URI:http://SVRIntl-G3-crl.verisign.com/SVRIntlG3.crl
X509v3 Certificate Policies:
Policy: 2.16.840.1.113733.1.7.23.3
CPS: www.verisign.com/rpa
X509v3 Extended Key Usage:
Netscape Server Gated Crypto, TLS Web Server Authentication, TLS Web Client Authentication
Authority Information Access:
OCSP - URI:http://ocsp.verisign.com
CA Issuers - URI:http://SVRIntl-G3-aia.verisign.com/SVRIntlG3.cer
1.3.6.1.5.5.7.1.12:
0`.^.\0Z0X0V..image/gif0!0.0...+......Kk.(.....R8.).K..!..0&.$http://logo.verisign.com/vslogo1.gif
Не хватает
X509v3 Authority Key Identifier:
keyid:D7:9B:7C:D8:22:A0:15:F7:DD:AD:5F:CE:29:9B:58:C3:BC:46:00:B5
Вот такие у меня мысли.
Средний
