# Convert a Java keystore to PEM

There is no direct JKS-to-PEM conversion. Convert the keystore to PKCS#12 first with `keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -destkeystore keystore.p12 -deststoretype PKCS12`, then extract PEM files with `openssl pkcs12 -in keystore.p12 -nodes -out output.pem`. Use `-nocerts` to get only the private key and `-nokeys` to get only the certificates. You need the keystore password to do any of this; without it the private key is not recoverable.

Source: https://certguru.io/convert/jks-to-pem/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Step 1 — find the alias

```bash
keytool -list -keystore keystore.jks
```

Expected output:

```
Keystore type: jks
Keystore provider: SUN

Your keystore contains 1 entry

myalias, 16 Aug 2026, PrivateKeyEntry,
Certificate fingerprint (SHA-256): A1:B2:C3:...
```

`PrivateKeyEntry` is the one that has a key attached. A `trustedCertEntry` is a CA certificate with
no key, and there is nothing to extract from it beyond the certificate itself.

## Step 2 — JKS to PKCS#12

*Convert the whole keystore*

```bash
keytool -importkeystore \
  -srckeystore keystore.jks -srcstoretype JKS \
  -destkeystore keystore.p12 -deststoretype PKCS12 \
  -srcalias myalias
```

## Step 3 — PKCS#12 to PEM

Extract the pieces into separate files, which is what a web server needs:

*Private key*

```bash
openssl pkcs12 -in keystore.p12 -nocerts -nodes -out private.key
```

*Server certificate*

```bash
openssl pkcs12 -in keystore.p12 -clcerts -nokeys -out certificate.crt
```

*CA chain*

```bash
openssl pkcs12 -in keystore.p12 -cacerts -nokeys -out chain.crt
```

> **You now have an unencrypted private key on disk**
>
> `-nodes` writes the key in the clear. Restrict it immediately with `chmod 600 private.key`, and
>   delete the intermediate `keystore.p12` when you are done — it contains the same key.

If any of those commands fails with a MAC or algorithm error, the keystore came from an older JDK:

```bash
openssl pkcs12 -legacy -in keystore.p12 -nocerts -nodes -out private.key
```

## Extracting only the certificate

If you do not need the key at all, `keytool` can export a certificate on its own — no PKCS#12 detour
and no password exposure:

```bash
keytool -exportcert -rfc -alias myalias -keystore keystore.jks -file certificate.crt
```

`-rfc` is what makes the output PEM. Without it you get DER, and you will need
[der-to-pem](/convert/der-to-pem/) afterwards.

## Verify the extraction

*The key and certificate must still belong together*

```bash
openssl x509 -in certificate.crt -noout -pubkey | openssl sha256
openssl pkey -in private.key -pubout | openssl sha256
```

Matching hashes mean the extraction preserved the pair. See
[check whether a key matches a certificate](/openssl/check-key-matches-certificate/) if they differ.


## Frequently asked questions

### Can keytool export a private key on its own?

No. `keytool` has no export-private-key operation, by design. Converting the whole keystore to PKCS#12 is the supported route, and it still requires the keystore password.

### What if I do not know the keystore password?

Then the private key is not recoverable. The key material inside a JKS is encrypted with a key derived from that password, and there is no bypass. You will need to generate a new key and have a new certificate issued.

### My keystore has several entries — how do I extract just one?

Pass `-srcalias theAlias` to the `keytool -importkeystore` command so only that entry is carried into the PKCS#12 file. Run `keytool -list` first to see what is there.

### Why does OpenSSL reject the PKCS#12 that keytool produced?

Older JDKs write PKCS#12 archives using 3DES and a SHA-1 MAC, which OpenSSL 3 moved into its legacy provider. Add `-legacy` to the openssl pkcs12 command. See that error in detail.


## References

- [keytool reference](https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html) — the Java keystore tool and its import options
- [RFC 7292: PKCS #12](https://www.rfc-editor.org/rfc/rfc7292) — the archive format, including the MAC OpenSSL 3 rejects on legacy files

## Related pages

- https://certguru.io/convert/pem-to-jks/
- https://certguru.io/convert/pfx-to-pem/
- https://certguru.io/formats/jks-keystore/
- https://certguru.io/formats/pem/
- https://certguru.io/platforms/tomcat/

--
CertGuru — https://certguru.io