Search code examples
javasecuritykeytoolpkcs#12jks

Extract PKCS12 file from Java Keystore while changing the password using keytool

I have a Java Keystore: myKeystore.jks, and given an alias : someAlias, I'm trying to extract the corresponding resource in a p12 format while changing the password.

The JKS password is 12345678 which is the same password as the someAlias key.

I want my p12 file to be protected with the new password : 1122334455

What I've tried :

keytool -importkeystore -srckeystore myKeystore.jks -destkeystore test.p12 -deststoretype PKCS12 -srcalias someAlias -srcstorepass 12345678 -deststorepass 1122334455

In this case the test.p12 is exported, but I'm unable to read it because either the password is incorrect OR the file is corrupted.

enter image description here

But when I try this (Keeping the same password) :

keytool -importkeystore -srckeystore myKeystore.jks -destkeystore test.p12 -deststoretype PKCS12 -srcalias someAlias -srcstorepass 12345678 -deststorepass 12345678

I can open my test.p12 file with the given password.

P.S : I also tried to add the -srckeypass argument, but no luck.

P.S 2 : I'm using keystore explorer 5.11 to open my stores

What am I missing ?

Solution

  • You have only changed the password of the keystore with the first command. The password for the key is still 12345678.

    While it is possible for PKCS#12 to have different passwords for container/content, it is a bad idea because most applications assume that the passwords are equal (which is the reason why KeyStore Explorer shows that error message).

    To change the password for the key you have to add -destkeypass:

    keytool -importkeystore -srckeystore myKeystore.jks -destkeystore myKeystore.p12 
-deststoretype PKCS12 -srcalias someAlias -srcstorepass 12345678 -deststorepass 
1122334455 -destkeypass 1122334455

    BTW, since Java 8 keytool shows an error message for your command:

    keytool error: java.lang.Exception: The destination pkcs12 keystore has different storepass and keypass. Please retry with -destkeypass specified.