1. Overview

A KeyStore, as the name suggests, is basically a repository of certificates, public and private keys. Moreover, JDK distributions are shipped with an executable to help manage them, the keytool.

On the other hand, certificates can have many extensions, but we need to keep in mind that a .cer file contains public X.509 keys and thus it can be used only for identity verification.

In this short article, we’ll take a look at how to import a .cer file into a Java KeyStore.

2. Importing a Certificate

Without further ado, let’s now import the Baeldung public certificate file inside a sample KeyStore.

The keytool has many options but the one we’re interested in is importcert which is as straightforward as its name. Since there are usually different entries inside a KeyStore, we’ll have to use the alias argument to assign it a unique name:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore
> Enter keystore password:
> Trust this certificate? [no]:  y
> Certificate was added to keystore

Although the command prompts for a password and a confirmation, we can bypass them by adding the storepass and noprompt arguments. This comes especially handy when running keytool from a script:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storepass pass123 -noprompt
> Certificate was added to keystore

Furthermore, if the KeyStore doesn’t exist, it’ll be automatically generated. In this case, we can set the format through the storetype argument. If not specified, the KeyStore format defaults to JKS if we’re using Java 8 or older. From Java 9 on it defaults to PKCS12:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storetype PKCS12
> Enter keystore password:
> Re-enter new password:
> Trust this certificate? [no]: y
> Certificate was added to keystore

Here we’ve created a PKCS12 KeyStore. The main difference between JKS and PKCS12 is that JKS is a Java-specific format, while PKCS12 is a standardized way of storing keys and certificates

In case we need, we can also perform these operations programmatically.

3. Conclusion

In this tutorial, we went through how to import a .cer file inside a KeyStore. In order to do that, we used the keytool’s importcert option.

Course – LSS (cat=Security/Spring Security)

I just announced the new Learn Spring Security course, including the full material focused on the new OAuth2 stack in Spring Security:

Course – LS (cat=Java)

Get started with Spring and Spring Boot, through the Learn Spring course:

res – Security (video) (cat=Security/Spring Security)
Comments are open for 30 days after publishing a post. For any issues past this date, use the Contact form on the site.