jarsigner reads private key and certchain from the same entry in a single keystore. Sometimes, the certchain inside the keystore may not be complete (especially in the case of a PKCS# 11 token when the capacity is not big enough), and jarsigner cannot work with such kind of keystore.