I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
asked Jan 3, 2013 at 16:58
Add a comment
|
2 Answers
Java has its own internal storage format for certificates and keys, called a "keystore". The keytool command-line tool which is provided with Java is perfectly able to import PKCS#12 files (aka ".pfx") into a keystore. See this question for details.
If you have issues, then this might be about algorithm support. PKCS#12 is a highly versatile format which can configured to use various encryption algorithms, notably some that any given piece of software (such as Java) might not support. Note that due to US export regulations, stock Java frameworks are limited to 128-bit encryption and do not support, e.g., AES-256. You need to install the unlimited strength policy files to unlock such algorithms (I am not sure the policy files for Java 5 are still easily found).
If the algorithms used in a PKCS#12 file are an issue for you, you can repackage it with other algorithms, using the OpenSSL command-line tool.
PKCS#7 files do not (commonly) contain private keys, only certificates (the containers for public keys), so they will hardly be relevant for your situation.
answered Jan 3, 2013 at 18:38
-
To extend great answer, Java uses JCA (Java Cryptographic API) to access keystores, and it's completly transparent to programmer in what format is key stored... but native support for formats is very poor, you may look into other java libs that will support this format directly, wihtout need of repackaging. Jan 3, 2013 at 18:55
Easiest way is probably to import it on a system that supports PKSC#12 and then export in a different format (assuming there aren't any rules in the cert about not allowing re-export, not sure if that is even possible in PKSC#12 or not though).
answered Jan 3, 2013 at 17:05
