How do I create a keystore with a self-signed certificate using the java keytool? With that said, this post strives to provide examples to common commands used to create and manage PKCS12 keystores that will hopefully make your life on the job a bit easier.įor numerous examples of converting to and from pkcs12 that may not be covered in this article you can read more here. It is recommended to migrate to PKCS12 which is an industry standard format

The JKS keystore uses a proprietary format. In fact, if you choose to generate a JKS keystore with the Java Keytool you will receive the following warning: The PKCS12 keystore is non-proprietary unlike the JKS and is becoming the most commonly used format. Unfortunately, there is not 100% coverage in all commands for maintaining PKCS #12 keystores in either OpenSSL or the Java Keytool so you must use both for comprehensive coverage of all the functions for maintaining your keystore. RFC 7292 goes into much much much more detail about the PKCS #12 standard: If you are in the market of purchasing a new SSL Certificate, start here. pfx for clarity, but may be anything you choose. The keystore’s purpose is to store the credential of an identity, being a person, client, or server. The keystore may contain both private keys and their corresponding certificates with or without a complete chain. A pkcs12 keystore is commonly used for both S/MIME User Certificates and SSL/TLS Server Certificates.

Keystore explorer pfx