Skip to main content

Convert PFX certificate to JKS, P12, CRT

I recently had to use a PFX certificate for client authentication (maybe another post will be coming) and for that reason I had to convert it to a Java keystore (JKS). 

 We will create BOTH a truststore and a keystore, because based on your needs you might need one or the other. 
The difference between truststore and keystore if you are not aware is(quote from the JSSE ref guide:

TrustManager: Determines whether the remote authentication credentials (and thus the connection) should be trusted.
KeyManager: Determines which authentication credentials to send to the remote host.

Ok that's enough what you will need is openssl and Java 7+ ;) !

First let's generate a key from the pfx file, this key is later used for p12 keystore.

openssl pkcs12 -in example.pfx -nocerts -out example.key  
Enter Import Password:
MAC verified OK
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

As shown here you will be asked for the password of the pfx file, later you will be asked to enter a PEM passphase lets for example use 123456 for everything here.
The second commands is almost the same but it is about nokey and a crt this time

openssl pkcs12 -in example.pfx -clcerts -nokeys -out example.crt
Enter Import Password:
MAC verified OK

Now we have a key and and a crt file
Next step is to create a truststore.

keytool -import -file example.crt -alias exampleCA -keystore truststore.jks
Enter keystore password:
Re-enter new password:
Owner: CN=.....
.......
Trust this certificate? [no]:  yes
Certificate was added to keystore

As you can see here you just import this crt file into a jks truststore and set some password. For the question do you trust this certificate you say yes, so it is added in the truststore.

We are done if you only need a truststore. 
The last step(s) is to create a keystore

openssl pkcs12 -export -in example.crt -inkey example.key -certfile example.crt -name "examplecert" -out keystore.p12
Enter pass phrase for example.key:
Enter Export Password:
Verifying - Enter Export Password:

This p12 keystore is enough in many cases, still if you need a JKS keystore you need one additional command

keytool -importkeystore -srckeystore keystore.p12 -srcstoretype pkcs12 -destkeystore keystore.jks -deststoretype JKS
Importing keystore keystore.p12 to keystore.jks...
Enter destination keystore password:
Re-enter new password:
Enter source keystore password:
Entry for alias examplecert successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.jks -deststoretype pkcs12".

That is all folks ! I hope this helps someone :) 

ls                                                                        
example.pfx  example.key            keystore.p12
example.crt  keystore.jks           truststore.jks

See you in post 2 how to use this keystore for client side authentication. Also how to use the truststore if you need to use it.

Labels:

Comments

Post a Comment

Popular Posts

Hibernate Generic DAO.

When you use Hibernate and DAO pattern it is a good idea to use a Generic Base Dao. The fallowing code snippet contains GenericDAO that is a base class for all my DAO classes. This GenericDAO uses HibernateDaoSupport from Spring for its implementation if you want you can use JpaDaoSupport or JdbcDaoSupport in your projects. My Generic DAO interface looks like this : package org.joke.myproject.dao.base; import java.io.Serializable; import java.util.List; /** * @author Naiden Gochev * @param <E> * @param <PK> */ public interface GenericDao<E,PK  extends Serializable> {     PK save(E newInstance);     void update(E transientObject);     void saveOrUpdate(E transientObject);     void delete(E persistentObject);     E findById(PK id);     List<E> findAll();     List<E> f...
10 comments
Read more

JavaEE 5 (JSF + JPA + EJB3) using Eclipse

Today I will show you how to create Enterprise Application using Java EE 5 and GlassFish. I will use - Eclipse 3.5 + WTP - GlassFish v. 2.1 - JSF Mojarra implementation. - EJB 3.0. - JPA Toplink essentials implementation. - MySQL No NetBeans or JDeveloper magic involved :) The prerequirement is: Add datasource in glassfish. Read this how you can make this here: http://gochev.blogspot.com/2009/10/creating-datasource-in-glassfish-v-21.html 1) First you need to add glassfish in your eclipse. - Go to Servers View - Right Click, New - Choose GlassFish v 2.1 if you dont have glassfish click on Download additional adapters link choose glassfish wait and restart eclipse. Than try again. 2) Create the database CREATE TABLE ` lesson ` . ` USERS ` ( ` id ` INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, ` username ` VARCHAR ( 45 ) NOT NULL , ` password ` VARCHAR ( 45 ) NOT NULL , ` name ` VARCHAR ( 45 ) NOT NULL , PRIMARY KEY ( ` id ` ) ) ENGINE = InnoDB...
9 comments
Read more

Generate JavaDoc with UML diagrams

In my life many times has happened when I am assigned to a totally new project that I have no idea what it is about, that has to go live in 2 weeks and that I have to fix some issues in this ultra strange code sometimes even code written in different language. On my question is there any documentation the answer is: Yes but it is very old or no. So in short they want me to start working on a project with no documentation at all. My second question is is there a javadoc and the anwer is : yeah … kind of … so I am in a project with 30% javadoc with methods in French language for example ( I don’t know even a single word in French) so in short I am loosing 2 weeks to understand what is using what what is the model what is PersonnePhysique  and what is this crazy domain model. I believe this has happened with everyone of you at least once so what can you do ? You can start digging into the java code like crazy ( like everyone of us have tried many times) You can install ...
2 comments
Read more