# Convert PFX / PKCS#12 to a Java keystore

To convert a PFX to a Java keystore, run `keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS`. This is a single step because both formats are keystores that can hold a private key, unlike the PEM route which needs an OpenSSL conversion first. On Java 9 and later, consider not converting at all — PKCS#12 is the default keystore type and a `.pfx` can usually be used directly by setting the store type to PKCS12 in your application configuration.

Source: https://certguru.io/convert/pfx-to-jks/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Inspect the archive first

Worth thirty seconds — it tells you the alias and confirms there is actually a key inside:

```bash
keytool -list -v -keystore certificate.pfx -storetype PKCS12
```

Expected output:

```
Alias name: myalias
Entry type: PrivateKeyEntry
Certificate chain length: 2
```

## The conversion

*One command, no OpenSSL required*

```bash
keytool -importkeystore \
  -srckeystore certificate.pfx -srcstoretype PKCS12 \
  -destkeystore keystore.jks -deststoretype JKS
```

`keytool` prompts for the destination keystore password first, then the PFX password.

## Setting a usable alias

If the PFX was exported without a friendly name, the entry lands under the alias `1`, which is
awkward to reference in configuration:

```bash
keytool -importkeystore \
  -srckeystore certificate.pfx -srcstoretype PKCS12 -srcalias 1 \
  -destkeystore keystore.jks -deststoretype JKS -destalias myalias
```

Or fix it afterwards:

```bash
keytool -changealias -alias 1 -destalias myalias -keystore keystore.jks
```

> **Set the alias at export time instead**
>
> If you control the PFX, pass `-name myalias` to `openssl pkcs12 -export` when creating it. See
>   [convert PEM to PFX](/convert/pem-to-pfx/). That avoids this whole class of problem.

## Non-interactive import

```bash
keytool -importkeystore \
  -srckeystore certificate.pfx -srcstoretype PKCS12 -srcstorepass "$PFX_PASSWORD" \
  -destkeystore keystore.jks -deststoretype JKS -deststorepass "$JKS_PASSWORD" \
  -noprompt
```

> **Passwords in the process list**
>
> `-srcstorepass` and `-deststorepass` put the secrets in `ps` output for the duration of the
>   command. Reading them from environment variables as above is better than literals, but on a shared
>   host neither is really safe — prefer running the import somewhere isolated.

## Verify

```bash
keytool -list -v -keystore keystore.jks
```

Check for `Entry type: PrivateKeyEntry` and a `Certificate chain length` of 2 or more. A length of 1
means the chain did not come across and clients will fail to build a path to a trusted root.

## Going the other way

See [convert JKS to PEM](/convert/jks-to-pem/), which routes back through PKCS#12.


## Frequently asked questions

### Do I need OpenSSL for this?

No. Both PKCS#12 and JKS are keystore formats that keytool understands natively, so the conversion is one command. OpenSSL is only needed when your starting point is loose PEM files.

### The alias came out as "1" — can I change it?

Yes. Pass `-destalias myalias` during the import, or rename afterwards with `keytool -changealias -alias 1 -destalias myalias -keystore keystore.jks`. An alias of `1` means the PFX was exported without a friendly name.

### Should I convert to JKS at all?

Usually not on a modern JRE. Java 9 made PKCS#12 the default and keytool warns that JKS is proprietary. Setting your application's keystore type to PKCS12 and using the .pfx directly avoids both the conversion and a format that is on its way out.

### keytool rejects my PFX — what now?

Older JDKs cannot read PKCS#12 archives that use modern AES encryption. Re-export the archive from OpenSSL with `-legacy`, or upgrade the JDK. The error usually mentions the algorithm rather than the password.


## References

- [keytool reference](https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html) — the Java keystore tool and its import options
- [RFC 7292: PKCS #12](https://www.rfc-editor.org/rfc/rfc7292) — the archive format, including the MAC OpenSSL 3 rejects on legacy files

## Related pages

- https://certguru.io/convert/pem-to-jks/
- https://certguru.io/convert/jks-to-pem/
- https://certguru.io/errors/keytool-not-an-x509-certificate/
- https://certguru.io/formats/jks-keystore/
- https://certguru.io/formats/pkcs12-pfx-p12/
- https://certguru.io/platforms/tomcat/

--
CertGuru — https://certguru.io