CertGuru

Convert PFX / PKCS#12 to a Java keystore

To convert a PFX to a Java keystore, run `keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS`. This is a single step because both formats are keystores that can hold a private key, unlike the PEM route which needs an OpenSSL conversion first. On Java 9 and later, consider not converting at all — PKCS#12 is the default keystore type and a `.pfx` can usually be used directly by setting the store type to PKCS12 in your application configuration.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Inspect the archive first #

Worth thirty seconds — it tells you the alias and confirms there is actually a key inside:

keytool -list -v -keystore certificate.pfx -storetype PKCS12
Expected output 
Alias name: myalias
Entry type: PrivateKeyEntry
Certificate chain length: 2

The conversion #

One command, no OpenSSL required
keytool -importkeystore \
-srckeystore certificate.pfx -srcstoretype PKCS12 \
-destkeystore keystore.jks -deststoretype JKS

keytool prompts for the destination keystore password first, then the PFX password.

Setting a usable alias #

If the PFX was exported without a friendly name, the entry lands under the alias 1, which is awkward to reference in configuration:

keytool -importkeystore \
-srckeystore certificate.pfx -srcstoretype PKCS12 -srcalias 1 \
-destkeystore keystore.jks -deststoretype JKS -destalias myalias

Or fix it afterwards:

keytool -changealias -alias 1 -destalias myalias -keystore keystore.jks

Non-interactive import # 

keytool -importkeystore \
-srckeystore certificate.pfx -srcstoretype PKCS12 -srcstorepass "$PFX_PASSWORD" \
-destkeystore keystore.jks -deststoretype JKS -deststorepass "$JKS_PASSWORD" \
-noprompt

Verify # 

keytool -list -v -keystore keystore.jks

Check for Entry type: PrivateKeyEntry and a Certificate chain length of 2 or more. A length of 1 means the chain did not come across and clients will fail to build a path to a trusted root.

Going the other way #

See convert JKS to PEM, which routes back through PKCS#12.

Frequently asked questions

Do I need OpenSSL for this?
No. Both PKCS#12 and JKS are keystore formats that keytool understands natively, so the conversion is one command. OpenSSL is only needed when your starting point is loose PEM files.
The alias came out as "1" — can I change it?
Yes. Pass -destalias myalias during the import, or rename afterwards with keytool -changealias -alias 1 -destalias myalias -keystore keystore.jks. An alias of 1 means the PFX was exported without a friendly name.
Should I convert to JKS at all?
Usually not on a modern JRE. Java 9 made PKCS#12 the default and keytool warns that JKS is proprietary. Setting your application's keystore type to PKCS12 and using the .pfx directly avoids both the conversion and a format that is on its way out.
keytool rejects my PFX — what now?
Older JDKs cannot read PKCS#12 archives that use modern AES encryption. Re-export the archive from OpenSSL with -legacy, or upgrade the JDK. The error usually mentions the algorithm rather than the password.

References

Related pages