Creating a Keystore in PKCS12 Format

To create a PKCS12 keystore from your private key file, certificate, and root public certificate, use the following command:

Bash
    
openssl pkcs12 -export -out corp_cert_chain.pfx -inkey <private-key>.key -in <cert.cer> -certfile <root_intermediate>.cer
Copy

Examples

Bash
    
 
# Concatenate Intermediate and Root CA certificatescat <Intermediate_cert> <RootCA_cert> > ca-chain.pem
Copy

Bash
    
 
# Create a PKCS12 keystore from the server key and certificateopenssl pkcs12 -export -inkey server.key -in server.pem -certfile ca-chain.pem -out keystore.pfx
Copy

Bash
    
# Convert PKCS12 keystore to JKSkeytool -v -importkeystore -srckeystore keystore.pfx -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS -srcalias 1 -destalias `hostname -f`
Copy

Importing Intermediate Certificates to Truststore

To import missing intermediate certificates into the truststore:

Bash
    
 
keytool -import -keystore truststore.jks -file <Intermediate_cert> -alias "Intermediate_cert"
Copy

Bash
    
 
keytool -import -keystore truststore.jks -file <Root_cert> -alias "Root_cert"
Copy

Last updated on Nov 18, 2024

Was this page helpful?