Java Keytool Commands Reference: Complete Guide for JKS, PKCS12 & Trust Stores

Format Conversion

Convert JKS to PKCS12

# Migrate legacy JKS to PKCS12 (recommended)
keytool -importkeystore \
  -srckeystore legacy.jks \
  -srcstoretype JKS \
  -srcstorepass oldpassword \
  -destkeystore modern.p12 \
  -deststoretype PKCS12 \
  -deststorepass newpassword

# Migrate a single alias only
keytool -importkeystore \
  -srckeystore legacy.jks \
  -srcstoretype JKS \
  -srcstorepass oldpassword \
  -srcalias mykey \
  -destkeystore modern.p12 \
  -deststoretype PKCS12 \
  -deststorepass newpassword

Convert PKCS12 to JKS (When Legacy Systems Require It)

keytool -importkeystore \
  -srckeystore modern.p12 \
  -srcstoretype PKCS12 \
  -srcstorepass password \
  -destkeystore legacy.jks \
  -deststoretype JKS \
  -deststorepass password

Import PEM Certificate + Key into PKCS12 (via OpenSSL)

Keytool cannot directly import PEM private keys. Use OpenSSL as an intermediary:

# Step 1: Create PKCS12 from PEM files using OpenSSL
openssl pkcs12 -export \
  -in server.crt \
  -inkey server.key \
  -certfile ca-chain.crt \
  -out server.p12 \
  -name "server" \
  -passout pass:changeit

# Step 2: (Optional) Import into JKS if needed
keytool -importkeystore \
  -srckeystore server.p12 \
  -srcstoretype PKCS12 \
  -srcstorepass changeit \
  -destkeystore server.jks \
  -deststoretype JKS \
  -deststorepass changeit

Export Certificate from Keystore to PEM

# Export certificate in DER format
keytool -exportcert \
  -alias server \
  -keystore server.p12 \
  -storetype PKCS12 \
  -storepass changeit \
  -file server.der

# Convert DER to PEM with OpenSSL
openssl x509 -inform der -in server.der -out server.pem

# Or export directly as PEM (RFC format)
keytool -exportcert \
  -alias server \
  -keystore server.p12 \
  -storetype PKCS12 \
  -storepass changeit \
  -rfc \
  -file server.pem

Managing the JVM Trust Store (cacerts)

Find Your cacerts Location

# Find JAVA_HOME
java -XshowSettings:properties 2>&1 | grep java.home

# cacerts is at: $JAVA_HOME/lib/security/cacerts
# Default password: changeit

List All Trusted CAs

keytool -list \
  -keystore "$JAVA_HOME/lib/security/cacerts" \
  -storepass changeit | grep "trustedCertEntry"

Add a Custom CA to cacerts

# Import your organization's internal CA
keytool -importcert \
  -alias acme-internal-ca \
  -file acme-root-ca.crt \
  -keystore "$JAVA_HOME/lib/security/cacerts" \
  -storepass changeit \
  -noprompt

Remove a CA from cacerts

keytool -delete \
  -alias acme-internal-ca \
  -keystore "$JAVA_HOME/lib/security/cacerts" \
  -storepass changeit

Production warning: Modifying cacerts affects every Java application using that JRE. For application-specific trust, use a custom trust store via JVM flags:

java -Djavax.net.ssl.trustStore=/path/to/custom-truststore.p12 \
     -Djavax.net.ssl.trustStorePassword=password \
     -Djavax.net.ssl.trustStoreType=PKCS12 \
     -jar myapp.jar

Configuring Java Applications

Spring Boot (application.yml)

server:
  ssl:
    enabled: true
    key-store: classpath:keystore.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12
    key-alias: server
    # For mTLS — require client certificates
    client-auth: need
    trust-store: classpath:truststore.p12
    trust-store-password: ${TRUSTSTORE_PASSWORD}
    trust-store-type: PKCS12
    protocol: TLS
    enabled-protocols: TLSv1.3,TLSv1.2
    ciphers:
      - TLS_AES_256_GCM_SHA384
      - TLS_AES_128_GCM_SHA256
      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Tomcat (server.xml)

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig protocols="TLSv1.2+TLSv1.3"
                   ciphers="TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384">
        <Certificate certificateKeystoreFile="/opt/tomcat/conf/server.p12"
                     certificateKeystorePassword="changeit"
                     certificateKeystoreType="PKCS12"
                     certificateKeyAlias="server" />
    </SSLHostConfig>
</Connector>

JVM System Properties (Any Java App)

# KeyStore (your identity)
-Djavax.net.ssl.keyStore=/path/to/keystore.p12
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.ssl.keyStoreType=PKCS12

# TrustStore (who you trust)
-Djavax.net.ssl.trustStore=/path/to/truststore.p12
-Djavax.net.ssl.trustStorePassword=password
-Djavax.net.ssl.trustStoreType=PKCS12

# Debug TLS (extremely verbose — use for troubleshooting only)
-Djavax.net.debug=ssl:handshake:verbose

Troubleshooting Common Errors

”keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect”

Causes:

1. Wrong password (most common)
2. Keystore file is corrupted
3. Wrong store type specified (JKS vs PKCS12)

Fix:

# Try with explicit store type
keytool -list -keystore store.p12 -storetype PKCS12 -storepass yourpassword

# If you forgot the password, there's no recovery — regenerate the keystore
# For cacerts, the default is always "changeit"

“keytool error: java.lang.Exception: Failed to establish chain from reply”

Cause: You’re importing a signed certificate but the issuer chain isn’t in the keystore yet.

Fix: Import root and intermediate CAs first, then import your signed certificate:

keytool -importcert -alias root -file root.crt -keystore store.p12 -storepass pass -noprompt
keytool -importcert -alias inter -file intermediate.crt -keystore store.p12 -storepass pass -noprompt
keytool -importcert -alias server -file signed.crt -keystore store.p12 -storepass pass

“PKIX path building failed: unable to find valid certification path to requested target”

The most common Java TLS error. The remote server’s CA isn’t in your trust store.

Diagnosis:

# Download the server's certificate chain
openssl s_client -connect remote-server.com:443 -servername remote-server.com -showcerts \
  2>/dev/null | openssl x509 -outform PEM > remote-cert.pem

# Check which CA signed it
openssl x509 -in remote-cert.pem -noout -issuer

# Import the missing CA into your trust store
keytool -importcert \
  -alias remote-ca \
  -file remote-ca.crt \
  -keystore "$JAVA_HOME/lib/security/cacerts" \
  -storepass changeit \
  -noprompt

“java.security.UnrecoverableKeyException: Cannot recover key”

Cause: The key password differs from the store password (common in JKS, not in PKCS12).

Fix:

# In JKS, key password and store password can differ
# Specify key password explicitly:
keytool -list -v -keystore store.jks -storepass storepass -keypass keypass -alias mykey

# Better fix: migrate to PKCS12 where key password = store password
keytool -importkeystore \
  -srckeystore store.jks -srcstoretype JKS -srcstorepass storepass \
  -destkeystore store.p12 -deststoretype PKCS12 -deststorepass newpass \
  -srckeypass keypass

#!/bin/bash
# import-cas.sh — Import all CA certificates from a directory into a trust store

TRUSTSTORE="/opt/app/truststore.p12"
STOREPASS="changeit"
CA_DIR="/opt/certs/trusted-cas"

for cert_file in "$CA_DIR"/*.crt; do
  alias=$(basename "$cert_file" .crt | tr '[:upper:]' '[:lower:]' | tr ' ' '-')
  echo "Importing: $alias from $cert_file"
  keytool -importcert \
    -alias "$alias" \
    -file "$cert_file" \
    -keystore "$TRUSTSTORE" \
    -storetype PKCS12 \
    -storepass "$STOREPASS" \
    -noprompt
done

echo "Trust store now contains $(keytool -list -keystore $TRUSTSTORE -storepass $STOREPASS | grep -c 'trustedCertEntry') trusted CAs"

#!/bin/bash
# check-keystore-expiry.sh — Alert on certificates expiring within N days

KEYSTORE="/opt/app/server.p12"
STOREPASS="changeit"
THRESHOLD_DAYS=30

# Get all aliases
aliases=$(keytool -list -keystore "$KEYSTORE" -storetype PKCS12 -storepass "$STOREPASS" | \
  grep "Entry," | awk -F, '{print $1}')

for alias in $aliases; do
  expiry=$(keytool -list -v -keystore "$KEYSTORE" -storetype PKCS12 \
    -storepass "$STOREPASS" -alias "$alias" 2>/dev/null | \
    grep "Valid from" | sed 's/.*until: //')

  if [ -n "$expiry" ]; then
    expiry_epoch=$(date -d "$expiry" +%s 2>/dev/null)
    now_epoch=$(date +%s)
    days_left=$(( (expiry_epoch - now_epoch) / 86400 ))

    if [ "$days_left" -lt "$THRESHOLD_DAYS" ]; then
      echo "WARNING: '$alias' expires in $days_left days ($expiry)"
    fi
  fi
done

# Export the certificate and check its public key fingerprint
keytool -exportcert -alias server -keystore store.p12 -storepass pass -rfc | \
  openssl x509 -noout -modulus | openssl md5

# Compare with the key's modulus (requires extracting via PKCS12→OpenSSL)
openssl pkcs12 -in store.p12 -nocerts -nodes -passin pass:pass | \
  openssl rsa -noout -modulus | openssl md5

keytool -printcert -sslserver api.example.com:443