CertGuru

JKS — Java KeyStore

JKS is Java's proprietary keystore format, holding private keys and certificates in a single password-protected file managed with the `keytool` command. Since Java 9 the default keystore type is PKCS#12 and `keytool` prints a deprecation warning whenever it touches a JKS file. OpenSSL cannot read JKS at all, so any conversion in either direction goes through PKCS#12 as an intermediate step.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Keystore or truststore #

Same format, different job, and the distinction causes a lot of confusion:

Keystore Truststore
Holds Your private key + certificate CA certificates you trust
Entry type PrivateKeyEntry trustedCertEntry
Used for Proving your identity Validating someone else’s
Typical file keystore.jks truststore.jks, cacerts
Which one is this?
keytool -list -keystore mystery.jks
Expected output 
myalias, 16 Aug 2026, PrivateKeyEntry,
Certificate fingerprint (SHA-256): A1:B2:C3:...

PrivateKeyEntry means a keystore. trustedCertEntry means a truststore.

Everyday keytool commands #

List everything, with detail
keytool -list -v -keystore keystore.jks
Import a CA certificate into a truststore
keytool -importcert -trustcacerts -alias corp-root -file root-ca.crt -keystore truststore.jks
Export a certificate as PEM
keytool -exportcert -rfc -alias myalias -keystore keystore.jks -file certificate.crt
Delete an entry
keytool -delete -alias oldalias -keystore keystore.jks
Rename an alias
keytool -changealias -alias 1 -destalias myalias -keystore keystore.jks

Migrating to PKCS#12 #

keytool will do this in place, and it is the recommended move:

keytool -importkeystore \
-srckeystore keystore.jks -srcstoretype JKS \
-destkeystore keystore.p12 -deststoretype PKCS12

Afterwards, point your application at the .p12 and set its store type to PKCS12. Nothing else needs to change.

Two passwords #

JKS distinguishes the keystore password, which protects the file, from the key password, which protects an individual private key entry. Many Java servers — Tomcat among them — assume the two are identical and fail with unhelpful errors when they are not.

Change a key entry's password to match the keystore
keytool -keypasswd -alias myalias -keystore keystore.jks

Converting #

From To Route
PEM JKS OpenSSL to PKCS#12, then keytool
JKS PEM keytool to PKCS#12, then OpenSSL
PFX JKS keytool, one step

Frequently asked questions

Should I still use JKS?
Generally no. Java 9 made PKCS#12 the default keystore type and keytool warns that JKS is proprietary every time it is used. Unless a specific application demands JKS, use a .p12 and set the store type to PKCS12.
Can OpenSSL read a JKS file?
No. JKS is a Java-specific format with no OpenSSL support. Convert to PKCS#12 with keytool first, then OpenSSL can read it.
What is the difference between a keystore and a truststore?
The file format is the same; the contents and purpose differ. A keystore holds your own identity — a private key with its certificate. A truststore holds CA certificates you have decided to trust. Mixing them up produces handshake errors that point away from the real mistake.
What is the default keystore password?
For the JDK's own bundled truststore (cacerts) it is changeit. Keystores you create have whatever password you set; there is no default and no recovery if it is lost.

References

Related pages