...

Export the Certificate Chain for Client-side Use (self-signed certs only)

If using self-signed certificates, the required CA certificates are not known to MQTT clients by default as they would be if the certificate was generated by a real CA. This requires one to acquire and upload the CA certificates that make up the certificate chain (aka. "chain-of-trust"). The certificate chain can be exported from an existing keystore (like the one created here) using the steps below. Return to the KeyStore Explorer application and generate the necessary root.ca.pem file.  Save this file in same location (by default) as your cert.jks file.  Use this template below to upload this root.ca.pem file to Transmission and Engine.  (Password not required on these pages.)

...