Key and Certificate Management

For more details on keys and certificates management with the keytool utility, please refer to the keytool(1) man page, or online documentation.

The system-wide keystore with CA certificates is a cacert file, which is located in the java.home/lib/security directory, where java.home is the runtime environment's directory.

Note: the default password of the system-wide keystore is changeit.

Import a private key and a certificate

The Java keytool utility does not support importing a private key directly from a file. First convert the private key into PKCS12 format, then merge that file with the Java keystore:

openssl pkcs12 -export -in server.crt -inkey server.key -name company -out file.p12

keytool -importkeystore -srckeystore file.p12 -destkeystore file.keystore -srcstoretype PKCS12 -destalias company

Import a certificate

To import a certificate into a keystore:

keytool -importcert -keystore file.keystore -file file.crt -alias company