CertGuru

Convert a Java keystore to PEM

There is no direct JKS-to-PEM conversion. Convert the keystore to PKCS#12 first with `keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -destkeystore keystore.p12 -deststoretype PKCS12`, then extract PEM files with `openssl pkcs12 -in keystore.p12 -nodes -out output.pem`. Use `-nocerts` to get only the private key and `-nokeys` to get only the certificates. You need the keystore password to do any of this; without it the private key is not recoverable.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Step 1 — find the alias # 

keytool -list -keystore keystore.jks
Expected output 
Keystore type: jks
Keystore provider: SUN

Your keystore contains 1 entry

myalias, 16 Aug 2026, PrivateKeyEntry,
Certificate fingerprint (SHA-256): A1:B2:C3:...

PrivateKeyEntry is the one that has a key attached. A trustedCertEntry is a CA certificate with no key, and there is nothing to extract from it beyond the certificate itself.

Step 2 — JKS to PKCS#12 #

Convert the whole keystore
keytool -importkeystore \
-srckeystore keystore.jks -srcstoretype JKS \
-destkeystore keystore.p12 -deststoretype PKCS12 \
-srcalias myalias

Step 3 — PKCS#12 to PEM #

Extract the pieces into separate files, which is what a web server needs:

Private key
openssl pkcs12 -in keystore.p12 -nocerts -nodes -out private.key
Server certificate
openssl pkcs12 -in keystore.p12 -clcerts -nokeys -out certificate.crt
CA chain
openssl pkcs12 -in keystore.p12 -cacerts -nokeys -out chain.crt

If any of those commands fails with a MAC or algorithm error, the keystore came from an older JDK:

openssl pkcs12 -legacy -in keystore.p12 -nocerts -nodes -out private.key

Extracting only the certificate #

If you do not need the key at all, keytool can export a certificate on its own — no PKCS#12 detour and no password exposure:

keytool -exportcert -rfc -alias myalias -keystore keystore.jks -file certificate.crt

-rfc is what makes the output PEM. Without it you get DER, and you will need der-to-pem afterwards.

Verify the extraction #

The key and certificate must still belong together
openssl x509 -in certificate.crt -noout -pubkey | openssl sha256
openssl pkey -in private.key -pubout | openssl sha256

Matching hashes mean the extraction preserved the pair. See check whether a key matches a certificate if they differ.

Frequently asked questions

Can keytool export a private key on its own?
No. keytool has no export-private-key operation, by design. Converting the whole keystore to PKCS#12 is the supported route, and it still requires the keystore password.
What if I do not know the keystore password?
Then the private key is not recoverable. The key material inside a JKS is encrypted with a key derived from that password, and there is no bypass. You will need to generate a new key and have a new certificate issued.
My keystore has several entries — how do I extract just one?
Pass -srcalias theAlias to the keytool -importkeystore command so only that entry is carried into the PKCS#12 file. Run keytool -list first to see what is there.
Why does OpenSSL reject the PKCS#12 that keytool produced?
Older JDKs write PKCS#12 archives using 3DES and a SHA-1 MAC, which OpenSSL 3 moved into its legacy provider. Add -legacy to the openssl pkcs12 command. See that error in detail.

References

Related pages