1

There is a JKS file containing an entry named "mycert": https://filebin.net/l93faa9qa3rkt32h

Password is test123

Based on the following screenshot, mycert has a public key (RSA 2048 bits) and in X.509 format encoded it starts like this:

30 82 01 22 30

enter image description here

I need to export mycert from this keystore to have a single X.509 certificate. For this purpose I'm using KeyStore Explorer but opened to any other open-source alternative.

So, I did export mycert into a single certificate in X.509 format (Test_Test.cer), it succeeded:

enter image description here

Opening Test_Test.cer and checking it's public key (still RSA), it differs based on the following screenshot:

enter image description here

30 82 01 0A 02

What is the reason for this? Is it intended? (How) can I export mycert and still keep the public key?

0

1 Answer 1

3

What is shown is not the raw key bytes only but the key inside a specific container. There are various containers for an RSA key. To reproduce it on the command line:

# extract the certificate from the JKS
$ keytool -export -keystore test.jks -alias mycert -file test.cer

# extract the public key from the certificate
$ openssl x509 -in test.cer -inform der -pubkey -out pubkey.pem -noout

# show the bytes of the pubkey in the RSA specific container
$ openssl rsa -pubin  -in pubkey.pem -RSAPublicKey_out -outform der | xxd
writing RSA key
00000000: 3082 010a 0282 0101 00bb be14 4111 577f  0...........A.W.
...

# show the bytes of the pubkey in the more generic container suitable for various kinds of keys
$ openssl rsa -pubin  -in pubkey.pem  -outform der | xxd 
writing RSA key
00000000: 3082 0122 300d 0609 2a86 4886 f70d 0101  0.."0...*.H.....
00000010: 0105 0003 8201 0f00 3082 010a 0282 0101  ........0.......
...

As you can see, the output in the RSA specific container reflects what you see in your second output while the output in the more generic container reflects what you see in your first output. Thus it is just a difference in displaying the same key.

You could also see that the length of the keys differs. This is because the more generic container has more information inside. If you look closer you could actually see in the second line of the second output the start of the "inner" container which is exactly the output in the RSA specific format.

00000010: 0105 0003 8201 0f00 3082 010a 0282 0101  ........0.......
                              ^^^^^^^^^^^^^^^^^^^
1
  • Note Keystore Explorer is a Java program, and Java crypto uses the key-encoding name "X.509" to mean specifically the SubjectPublicKeyInfo structure from X.509/PKIX (documented in the javadoc for java.security.Key) which is what you describe correctly as a 'generic' container. Mar 26, 2021 at 3:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .