Dohhh .... 24 hours of pain for missing out one vital step!!!!
For anyone finding this in the future - and If you're using sslforfree here's what I needed to do. The vital missing step is in CAPS
1) create a new keystore in the PKSC12 format
2) Import the CA-Bundle certificate
3) import the Key pair (PKCS8 key format - Private.key and Certificate.crt
4) CONVERT THE WHOLE BLOODY LOT (THE KEYSTORE) BACK TO JKS FORMAT
5) Be sure to name it Keystore
6) set the correct path in Tomcat's server.xml
7) Restart AwareIM
NOTE - the actual keystore password (asked for at the end when you save it) MUST be the same as the password you use for the key pair otherwise Tomcat will complain
I'm guessing that in 3 months the procedure will be to convert the keystore back to PKCS12 format, import the new key pair, then convert it back to JKS, and in 2021 when the root and intermediate runs out, import the new CA-Bundle certificate. Will post again in 60 days to confirm.
