How to generate keystore for root signed certificate?

Question

I need to create keystore and truststore with root signed certificates.

I have these files (at this step they are identical for client and for server):

1. client_cert.pem

2. client_prv_key.pem

3. root_cert.pem

4. client_password lets say 12345

I will create the truststore with the client certificate. Now I need to create keystore. I tried this:

openssl pkcs12 -export -inkey root_cert.pem -in client_cert.pem -out client.p12

This result in an error: "unable to load private key".

Next command, after creating the .p12 file is (when openssl command will end successfully):

keytool -importkeystore -srckeystore client.p12 -srcstoretype pkcs12 -destkeystore client.jks -deststoretype jks

What should be the command in order to create keystore with root-signed certificates? How should I build the .p12 file with the root signed certificate?

Also, for mutual authentication in Java truststore is required. After trying some options the correct way to build the truststore is: (12345 is client_password which I used in all places where password was required)

keytool -importcert -trustcacerts -keystore client_truststore.jks -storetype jks -storepass 12345 -file root_cert.pem

Where 12345 is client_password (which I used in all places where password was required)

Answer 1

Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format:

openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12
# prompts for the input-key passphrase, then the output passphrase (twice)

# to specify passphrase on commandline for client_prv_key -passin pass:xyz
# similarly passphrase on commandline for the output -passout pass:xyz
# however these make the password(s) visible in ps or similar on most OSes,
# and usually visible in your shell (or CMD) history, which is often insecure

Alternatively you can provide them all on standard input in correct order:

cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12
# same options for passphrase

PS- do NOT enter an empty passphrase for the PKCS12. OpenSSL lets you create it even though it's silly, but Java can't decrypt it which defeats your purpose.