# JKS — Java KeyStore

JKS is Java's proprietary keystore format, holding private keys and certificates in a single password-protected file managed with the `keytool` command. Since Java 9 the default keystore type is PKCS#12 and `keytool` prints a deprecation warning whenever it touches a JKS file. OpenSSL cannot read JKS at all, so any conversion in either direction goes through PKCS#12 as an intermediate step.

Source: https://certguru.io/formats/jks-keystore/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Keystore or truststore

Same format, different job, and the distinction causes a lot of confusion:

| | Keystore | Truststore |
| --- | --- | --- |
| Holds | Your private key + certificate | CA certificates you trust |
| Entry type | `PrivateKeyEntry` | `trustedCertEntry` |
| Used for | Proving your identity | Validating someone else's |
| Typical file | `keystore.jks` | `truststore.jks`, `cacerts` |

*Which one is this?*

```bash
keytool -list -keystore mystery.jks
```

Expected output:

```
myalias, 16 Aug 2026, PrivateKeyEntry,
Certificate fingerprint (SHA-256): A1:B2:C3:...
```

`PrivateKeyEntry` means a keystore. `trustedCertEntry` means a truststore.

## Everyday keytool commands

*List everything, with detail*

```bash
keytool -list -v -keystore keystore.jks
```

*Import a CA certificate into a truststore*

```bash
keytool -importcert -trustcacerts -alias corp-root -file root-ca.crt -keystore truststore.jks
```

*Export a certificate as PEM*

```bash
keytool -exportcert -rfc -alias myalias -keystore keystore.jks -file certificate.crt
```

*Delete an entry*

```bash
keytool -delete -alias oldalias -keystore keystore.jks
```

*Rename an alias*

```bash
keytool -changealias -alias 1 -destalias myalias -keystore keystore.jks
```

> **-rfc is what makes output PEM**
>
> Without `-rfc`, `keytool -exportcert` writes DER. That is the usual reason an exported certificate
>   looks like binary garbage — see [DER to PEM](/convert/der-to-pem/).

## Migrating to PKCS#12

`keytool` will do this in place, and it is the recommended move:

```bash
keytool -importkeystore \
  -srckeystore keystore.jks -srcstoretype JKS \
  -destkeystore keystore.p12 -deststoretype PKCS12
```

Afterwards, point your application at the `.p12` and set its store type to `PKCS12`. Nothing else
needs to change.

## Two passwords

JKS distinguishes the **keystore password**, which protects the file, from the **key password**,
which protects an individual private key entry. Many Java servers — Tomcat among them — assume the
two are identical and fail with unhelpful errors when they are not.

*Change a key entry's password to match the keystore*

```bash
keytool -keypasswd -alias myalias -keystore keystore.jks
```

> **There is no password recovery**
>
> Private key material in a JKS is encrypted with a key derived from the password. If it is lost,
>   the key is gone and a new certificate must be issued. Store the password somewhere durable before
>   you need it.

## Converting

| From | To | Route |
| --- | --- | --- |
| PEM | JKS | [OpenSSL to PKCS#12, then keytool](/convert/pem-to-jks/) |
| JKS | PEM | [keytool to PKCS#12, then OpenSSL](/convert/jks-to-pem/) |
| PFX | JKS | [keytool, one step](/convert/pfx-to-jks/) |


## Frequently asked questions

### Should I still use JKS?

Generally no. Java 9 made PKCS#12 the default keystore type and keytool warns that JKS is proprietary every time it is used. Unless a specific application demands JKS, use a .p12 and set the store type to PKCS12.

### Can OpenSSL read a JKS file?

No. JKS is a Java-specific format with no OpenSSL support. Convert to PKCS#12 with keytool first, then OpenSSL can read it.

### What is the difference between a keystore and a truststore?

The file format is the same; the contents and purpose differ. A keystore holds your own identity — a private key with its certificate. A truststore holds CA certificates you have decided to trust. Mixing them up produces handshake errors that point away from the real mistake.

### What is the default keystore password?

For the JDK's own bundled truststore (`cacerts`) it is `changeit`. Keystores you create have whatever password you set; there is no default and no recovery if it is lost.


## References

- [keytool reference](https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html) — the Java keystore tool and its import options

## Related pages

- https://certguru.io/convert/jks-to-pem/
- https://certguru.io/convert/pem-to-jks/
- https://certguru.io/errors/pkix-path-building-failed/
- https://certguru.io/errors/keytool-not-an-x509-certificate/
- https://certguru.io/convert/pfx-to-jks/
- https://certguru.io/formats/pkcs12-pfx-p12/
- https://certguru.io/platforms/tomcat/

--
CertGuru — https://certguru.io