Question & Answer
Question
How can you import certificates in a PEM/PFX file into a Java™ KeyStore (JKS) keystore?
Cause
Keytool is the Java tool to manage keystores and certificates.
IKeyMan is the IBM tool to manage keystore and certificates. It is available in WebSphere Application Server.
Keytool and IKeyMan only recognize PKCS 12 keystores, so there is a need to transform the PFX/PEM files into PKCS12 files.
Additional information: PKCS#12 stands for Public Key Cryptography Standard #12. It is a standard that describes a portable format for storage and transportation of user private keys and certificates.
PEM encoded file contains a private key or a certificate.
PFX is a keystore format used by some application. It can contain private keys or public keys.
Answer
A PEM encoded file contains a private key or a certificate. PFX is a keystore format used by some applications. A PFX keystore can contain private keys or public keys. The information that follows explains how to transform your PFX or PEM keystore into a PKCS12 keystore.
PEM and PFX files usually carry the private and public key of a certificate. Both can be contained in one file or two distinct files.
When you have a PKCS12 keystore you can use it as is or you can import the certificates it contains into a JKS (Java KeyStore) file so you can use it in Rational Application Developer or WebSphere Studio Application Developer.
Use 'openssl' as in the OpenSSL Web site listed in the related link below:
- To Transform a PFX file into a PEM file:
openssl pkcs12 -in mypfxfile.pfx -out mypemfile.pem - To Transform a PEM file into a PKCS12 file:
openssl pkcs12 -export -out keystore.p12 -inkey myuserkey.pem -in myusercert.pem -name "FriendlyNameOfMyCertificate" - To validate the PKCS12 file:
keytool -v -list -keystore keystore.p12 -storetype pkcs12 - To import the certificates from a PKCS12 keystore into a JKS keystore:
keytool -import -file keystore.p12 -pkcs12 -keystore theJKSKeystore.jks -storepass passwordOfTheJKSKeystore -storetype JKS
You can also use IKeyman to import the certificate from the PKCS12 keystore into the JKS keystore.
Related Information
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21280977