I'm unsure whether the key you're downloading is meant as the *client's* key (i.e., you're making SOAP calls against salesforce and it is optionally requiring client key authentication, not always needed with SSL), or is the server's public cert (i.e., you're making SOAP calls against salesforce). Since you're downloading the key, I'm assuming the latter (i.e., you're downloading the salesforce's public key with the intention of making SOAP calls against it--am I correct?), you normally don't download self-signed certificates but instead create them yourself (see Step #1 here:
http://www.jroller.com/gmazza/entry/ssl_for_web_services). If this is the case:
1.) In your keytoool -import of the server's key, you should be using the -trustcacerts flag, see item #8 here:
http://www.jroller.com/gmazza/entry/ssl_for_web_services
You also won't have a -keypass setting, as you won't know the private key password, you're just importing the server's public cert and it doesn't have an internal password. (-keypass is needed though for client key generation).
2.) Once done, use the keytool -list command to confirm you have the keystore password (*not* key password) correct, as shown in Step #3 here:
http://www.jroller.com/gmazza/entry/metro_sts_tutorial#MetroSTS3.
Again, though I don't know what the purpose is of the cert you're downloading--I can't see salesforce providing self-signed certs, rather public certs for making SOAP calls against it. (i.e., you may not even need the cert salesforce is providing you if you're not making SOAP calls against it.)
