Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
2

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?

share|improve this question

3 Answers

up vote 13 down vote accepted

Since Java 6, you can import/export private keys into PKCS#12 (.p12) files using keytool, using -importkeystore (not available in previous versions).

For example:

keytool -importkeystore -srckeystore existing-store.jks -destkeystore new-store.p12 -deststoretype PKCS12

The PKCS12 keystore type is also supported as a standard keystore type in the default Oracle/Sun security provider.

share|improve this answer
up vote 2 down vote

There is a format that allows the moving of private keys is called PKCS#12. This format came later in the evolution of PKI certificates and related keystores as the need evolved. If you consider the chain of trust issues created by accessing and transporting the private key you can see why it was not included in the initial features but rather came after pressure by operational need. This is the core reason for the challenge.

Java keystores were one of the initial users of the PKCS#12 format but as importers not exporters. It appears the security design of Java keystores still does not support exporting private keys as a standard feature. Again, there are good security reasons for this fact. That said, private routines have been written as referenced here: http://www.startux.de/index.php/java/44-dealing-with-java-keystoresyvComment44

If at all possible I would consider creating a new keystore in OpenSSL and new keys rather than trying to pry out the private key from the Java keystore. By opening the Java keystore and extracting the private key one is moving beyond the designed security features. The export PKCS#12 feature has been desired for many years but still is not supported in Java. My thinking is that is for very good cryptologic reasons thus I would be leary of taking that step unless it was absolutely necessary.

share|improve this answer
Could you clarify why you recommend against reusing the Java key? – nealmcb May 13 '11 at 20:15
1  
OK I will edit to explain I am concerned with exposing the private key. – zedman9991 May 13 '11 at 20:32
2  
export to PKCS#12 (via the PKCS12 keystore type) has been supported by keytool since the release of Java 6. – Bruno May 13 '11 at 21:21
1  
I'm not sure if this concern about exporting the private key (or converting its container) is really justified. It makes perfect sense to re-use the same private key if it matches a certificate that has been signed by a CA, for example (otherwise, the cert would have to be re-issued too), which may happen when changing the implementation of the server (e.g. Java-based server to Apache HTTPD or a reverse proxy). Converting from one format to another doesn't mean you have to be careless. – Bruno May 13 '11 at 21:45
@Bruno Thanks for the correction. – zedman9991 May 15 '11 at 17:50
up vote 2 down vote

I agree with Bruno. Keytool is ultimate tool when dealing with java keystore, but there is one fancy and quite powerful free tool: Keystore explorer

I use it a lot and never had a need for something else.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.