(A bit late now).

I contacted DigiCert (who I'd recommend, given their prompt service) and they told me to generate a new cert, but following their java/tomcat instructions as the OpenSSL style...

And to compound matters, I'm using one of their wildcard certs... which work fine with Apache httpd.

I've created a keystore using their instructions at: SSL Certificate Installation - Tomcat...