We have followed instructions in the "ADSelfService Plus: Guide to Install SSL Certificate" with a Comodo PositiveSSL subdomain certificate.

The Keystore generation did not report any error and the SelfService.keystore generated was copied to <install_dir>\conf folder.

Server.xml has been modified to specify SelfService.keystore and default port 9251.

We're able to launch the AD Self Service Portal on the new 9251 port, but the only certificate displayed is the server's self signed certificate, not the one in the store from Comodo Positive SSL. We tried to re-import certificates, but keytool reports they are already there.

We imported the certificates with the following commands:

keytool -import -trustcacerts -alias root -file AddTrustExternalCARoot.crt -keystore selfservice.keystore

keytool -import -trustcacerts -alias POSITIVESSL2 -file PositiveSSLCA2.crt -keystore selfservice.keystore

keytool -import -trustcacerts -alias ACCOUNT1 -file account1_DOMAIN_org.crt -keystore selfservice.keystore

Any ideas why the CA certificate is not being picked up?