I need to create keystore and truststore with root signed certificates.

I have these files (at this step they are identical for client and for server):

  1. client_cert.pem

  2. client_prv_key.pem

  3. root_cert.pem

  4. client_password lets say 12345

I will create the truststore with the client certificate. Now I need to create keystore. I tried this:

openssl pkcs12 -export -inkey root_cert.pem -in client_cert.pem -out client.p12

This result in an error: "unable to load private key".

Next command, after creating the .p12 file is (when openssl command will end successfully):

keytool -importkeystore -srckeystore client.p12 -srcstoretype pkcs12 -destkeystore client.jks -deststoretype jks

What should be the command in order to create keystore with root-signed certificates? How should I build the .p12 file with the root signed certificate?

Also, for mutual authentication in Java truststore is required. After trying some options the correct way to build the truststore is: (12345 is client_password which I used in all places where password was required)

keytool -importcert -trustcacerts -keystore client_truststore.jks -storetype jks -storepass 12345 -file root_cert.pem

Where 12345 is client_password (which I used in all places where password was required)

1 Answer 1


Assuming your filenames are accurate, so client_cert.pem and client_prv_key.pem actually contain the client cert and privatekey respectively in PEM format:

openssl pkcs12 -export -in client_cert.pem -inkey client_prv_key.pem -certfile root_cert.pem -out client.p12
# prompts for the input-key passphrase, then the output passphrase (twice)

# to specify passphrase on commandline for client_prv_key -passin pass:xyz
# similarly passphrase on commandline for the output -passout pass:xyz
# however these make the password(s) visible in ps or similar on most OSes,
# and usually visible in your shell (or CMD) history, which is often insecure

Alternatively you can provide them all on standard input in correct order:

cat client_prv_key.pem client_cert.pem root_cert.pem | openssl pkcs12 -export -out client.p12
# same options for passphrase

PS- do NOT enter an empty passphrase for the PKCS12. OpenSSL lets you create it even though it's silly, but Java can't decrypt it which defeats your purpose.

  • Tried what you suggested. Used the same passphrase for input and output. Then I used keytool to create .jks file in the same way I described in my question. Put them in Java code, with the passphrase as password. I start the server and client. When sending request I get an error: javax.net.ssl.SSLHandshakeException: null cert chain. Any suggestions?
    – KerenSi
    Aug 5, 2015 at 9:09
  • It works! I had another problem with my truststore. I will edit my question and add an explanation about this. Thanks.
    – KerenSi
    Aug 5, 2015 at 13:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .