Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a newer private key I have to import into an older server.

How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

Java has its own internal storage format for certificates and keys, called a "keystore". The keytool command-line tool which is provided with Java is perfectly able to import PKCS#12 files (aka ".pfx") into a keystore. See this question for details.

If you have issues, then this might be about algorithm support. PKCS#12 is a highly versatile format which can configured to use various encryption algorithms, notably some that any given piece of software (such as Java) might not support. Note that due to US export regulations, stock Java frameworks are limited to 128-bit encryption and do not support, e.g., AES-256. You need to install the unlimited strength policy files to unlock such algorithms (I am not sure the policy files for Java 5 are still easily found).

If the algorithms used in a PKCS#12 file are an issue for you, you can repackage it with other algorithms, using the OpenSSL command-line tool.

PKCS#7 files do not (commonly) contain private keys, only certificates (the containers for public keys), so they will hardly be relevant for your situation.

share|improve this answer
    
To extend great answer, Java uses JCA (Java Cryptographic API) to access keystores, and it's completly transparent to programmer in what format is key stored... but native support for formats is very poor, you may look into other java libs that will support this format directly, wihtout need of repackaging. –  fatfredyy Jan 3 '13 at 18:55
add comment

Easiest way is probably to import it on a system that supports PKSC#12 and then export in a different format (assuming there aren't any rules in the cert about not allowing re-export, not sure if that is even possible in PKSC#12 or not though).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.