Is keystore file (server.jks), my private key file?

Question

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers.

Below are the steps I used to generate the .p7b file:

1. I generated a .jks (java keystore) file using below command

   C:\Program Files\Java\jdk1.6.0_33\bin>keytool -genkey -alias serverkey -keyalg RSA -keystore C:\server\production\ssl\Server.jks -keysize 2048
   

2. From keystore file I created a CSR using following command

   keytool -certreq -alias serverkey -file ServerCSR.csr -keystore Server.jks
   

3. I provided this .CSR file to a local CA certificate authority. They provided me the certificate in .p7b format

I have two questions:

1. And how we can convert .p7b file into .pfx format ?
2. Is keystore file (server.jks), my private key file which is being asked to convert on various available links on google?

Answer 1

Yes, you did keytool genkey in the file server.jks so that file contains your private key. What you need to do is, first add your cert (chain) to the JKS, THEN convert the JKS to "PFX". The p7b by itself does not contain sufficient information.

The .p7b from the CA contains the cert for your server, and may contain other "chain" or "intermediate" certs which your server cert depends on. You say this cert is from a "local CA"; is that CA itself delegated from a well-known "root" CA like Verisign? If not, if the local CA has its own root, is that root already added to the cacerts and/or jssecacerts file in your JAVA_HOME/lib/security? (If you or other users on your system have been interacting with systems using this CA and it has a private root, you likely have already needed to add it to a truststore, but not necessarily the standard one.)

IF the chain the CA gave you uses a root that is either already in the Java-distributed cacerts like Verisign or has been added to cacerts on your specific system, run

keytool -keystore server.jks -alias serverkey -import -file whatever.p7b -trustcacerts 

The response should be "Certificate reply was installed in keystore". If it says "Certificate was added to keystore" that is actually an error even though it doesn't say so. Then convert to PKCS#12, which is the actual standard Microsoft and some other people call PFX, as one line but broken for posting:

keytool -importkeystore -srckeystore server.jks -destkeystore server.pfx 
-deststoretype pkcs12 -srcalias serverkey 

On the first step, if the needed root (or anchor) isn't in cacerts (well-known or already added) but at least one CA cert is in the p7b, keytool will display info about the "top-level" certificate and ask Install reply anyway?; just answer "yes". If anything more complicated is wrong, give details.