1. Overview
A KeyStore, as the name suggests, is basically a repository of certificates, public and private keys. Moreover, JDK distributions are shipped with an executable to help manage them, the keytool.
On the other hand, certificates can have many extensions, but we need to keep in mind that a .cer file contains public X.509 keys and thus it can be used only for identity verification.
In this short article, we’ll take a look at how to import a .cer file into a Java KeyStore.
2. Importing a Certificate
Without further ado, let’s now import the Baeldung public certificate file inside a sample KeyStore.
The keytool has many options but the one we’re interested in is importcert which is as straightforward as its name. Since there are usually different entries inside a KeyStore, we’ll have to use the alias argument to assign it a unique name:
> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore
> Enter keystore password:
...
> Trust this certificate? [no]: y
> Certificate was added to keystore
Although the command prompts for a password and a confirmation, we can bypass them by adding the storepass and noprompt arguments. This comes especially handy when running keytool from a script:
> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storepass pass123 -noprompt
> Certificate was added to keystore
Furthermore, if the KeyStore doesn’t exist, it’ll be automatically generated. In this case, we can set the format through the storetype argument. If not specified, the KeyStore format defaults to JKS if we’re using Java 8 or older. From Java 9 on it defaults to PKCS12:
> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storetype PKCS12
> Enter keystore password:
> Re-enter new password:
...
> Trust this certificate? [no]: y
> Certificate was added to keystore
Here we’ve created a PKCS12 KeyStore. The main difference between JKS and PKCS12 is that JKS is a Java-specific format, while PKCS12 is a standardized way of storing keys and certificates
In case we need, we can also perform these operations programmatically.
3. Conclusion
In this tutorial, we went through how to import a .cer file inside a KeyStore. In order to do that, we used the keytool’s importcert option.