Converting a PEM File to Java KeyStore Format

1. Overview

In a previous tutorial, we showed how to convert a Java KeyStore (JKS) into PEM format. In this tutorial, we're going to convert the PEM format to the standard Java KeyStore (JKS) format. A Java KeyStore is a container that stores certificates with their matching private keys.

We'll use a combination of keytool and openssl commands to convert from PEM to JKS. The keytool command comes with the JDK (Java Development Kit) and is used to convert from PEM to PKCS12. The second command, openssl, needs to be downloaded, and its role is to convert from PKCS12 to JKS.

2. File Formats

JKS is a Java-specific file format that was the default format for KeyStores until Java 8. Starting from Java 9, PKCS#12 is the default KeyStore format. Despite JKS, PKCS#12 is a standardized and language-neutral format for storing encrypted data. The PKCS#12 format is also known as PKCS12 or PFX.

PEM (Privacy Enhanced Mail) is also a certificate container format. The PEM files are encoded in Base64. This ensures that data remains intact during translation between different systems.

Further, a PEM file can contain one or more instances, each of them being separated by a plain-text header and footer:

-----BEGIN CERTIFICATE-----
// base64 encoded
-----END CERTIFICATE-----

3. Converting PEM to JKS Format

We'll now go through the steps to convert all certificates and private keys from PEM to JKS format.

For the purpose of example, we're going to create a self-signed certificate.

3.1. Creating the PEM File

We'll start by generating two files, key.pem and cert.pem, using openssl:

openssl req -newkey rsa:2048 -x509 -keyout key.pem -out cert.pem -days 365 

The tool will prompt us to enter a PEM passphrase and other information.

Once we've answered all the prompts, the openssl tool outputs two files:

• key.pem (the private key)
• cert.pem (a public certificate)

We'll use these files to generate our self-signed certificate.

3.2. Generating the PKCS12 Certificate

In most cases, the certificate is in Public Key Cryptography Standards #12 (PKCS12) format. Less frequently, we use a Java KeyStore (JKS) format.

Let's convert PEM into a PKCS12 format:

openssl pkcs12 -export -in cert.pem -inkey key.pem -out certificate.p12 -name "certificate"

While the command runs, we'll be prompted to enter the passphrase that we created previously for key.pem:

Enter pass phrase for key.pem:

And then we'll see the prompt asking for a new password for certificate.p12:

Enter Export Password:

After that, we'll have a certificate.p12 KeyStore stored in PCKS12 format.

3.3. PKCS#12 to JKS

The last step is to convert from PKCS12 to JKS format:

keytool -importkeystore -srckeystore certificate.p12 -srcstoretype pkcs12 -destkeystore cert.jks

As the command executes, it'll prompt for a new password for the cert.jks file:

Enter destination keystore password:

And it'll prompt us for the certificate.p12 password we created earlier:

Enter source keystore password:

Then, we should see the final output:

Entry for alias certificate successfully imported.
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled

The result is a cert.jks KeyStore stored in JKS format.

4. Conclusion

In this article, we described the steps for converting a PEM file to JKS format, with the help of the intermediate PKCS12 format.

As helping tools, we used the keytool and openssl commands.