How to Import a .cer Certificate Into a Java KeyStore

1. Overview

A KeyStore, as the name suggests, is basically a repository of certificates, public and private keys. Moreover, JDK distributions are shipped with an executable to help manage them, the keytool.

On the other hand, certificates can have many extensions, but we need to keep in mind that a .cer file contains public X.509 keys and thus it can be used only for identity verification.

In this short article, we’ll take a look at how to import a .cer file into a Java KeyStore.

2. Importing a Certificate

Without further ado, let’s now import the Baeldung public certificate file inside a sample KeyStore.

The keytool has many options but the one we’re interested in is importcert which is as straightforward as its name. Since there are usually different entries inside a KeyStore, we’ll have to use the alias argument to assign it a unique name:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore
> Enter keystore password:
...
> Trust this certificate? [no]:  y
> Certificate was added to keystore

Although the command prompts for a password and a confirmation, we can bypass them by adding the storepass and noprompt arguments. This comes especially handy when running keytool from a script:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storepass pass123 -noprompt
> Certificate was added to keystore

Furthermore, if the KeyStore doesn’t exist, it’ll be automatically generated. In this case, we can set the format through the storetype argument. If not specified, the KeyStore format defaults to JKS if we’re using Java 8 or older. From Java 9 on it defaults to PKCS12:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storetype PKCS12
> Enter keystore password:
> Re-enter new password:
...
> Trust this certificate? [no]: y
> Certificate was added to keystore

Here we’ve created a PKCS12 KeyStore. The main difference between JKS and PKCS12 is that JKS is a Java-specific format, while PKCS12 is a standardized way of storing keys and certificates

In case we need, we can also perform these operations programmatically.

1. Overview

A KeyStore, as the name suggests, is basically a repository of certificates, public and private keys. Moreover, JDK distributions are shipped with an executable to help manage them, the keytool.

On the other hand, certificates can have many extensions, but we need to keep in mind that a .cer file contains public X.509 keys and thus it can be used only for identity verification.

In this short article, we’ll take a look at how to import a .cer file into a Java KeyStore.

2. Importing a Certificate

Without further ado, let’s now import the Baeldung public certificate file inside a sample KeyStore.

The keytool has many options but the one we’re interested in is importcert which is as straightforward as its name. Since there are usually different entries inside a KeyStore, we’ll have to use the alias argument to assign it a unique name:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore
> Enter keystore password:
...
> Trust this certificate? [no]:  y
> Certificate was added to keystore

Although the command prompts for a password and a confirmation, we can bypass them by adding the storepass and noprompt arguments. This comes especially handy when running keytool from a script:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storepass pass123 -noprompt
> Certificate was added to keystore

Furthermore, if the KeyStore doesn’t exist, it’ll be automatically generated. In this case, we can set the format through the storetype argument. If not specified, the KeyStore format defaults to JKS if we’re using Java 8 or older. From Java 9 on it defaults to PKCS12:

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storetype PKCS12
> Enter keystore password:
> Re-enter new password:
...
> Trust this certificate? [no]: y
> Certificate was added to keystore

Here we’ve created a PKCS12 KeyStore. The main difference between JKS and PKCS12 is that JKS is a Java-specific format, while PKCS12 is a standardized way of storing keys and certificates

In case we need, we can also perform these operations programmatically.

3. Adding a Certificate Chain to a KeyStore

In real-world scenarios, certificates are rarely issued directly by a root Certificate Authority (CA). Instead, they are part of a certificate chain that includes a leaf certificate, one or more intermediate CA certificates, and a root CA certificate.

When working with KeyStores, we may need to either import CA certificates into a truststore or associate a full certificate chain with an existing private key entry.

Let’s examine both cases.

3.1. Importing CA Certificates into a TrustStore

If our goal is to trust certificates signed by a particular CA, we typically import the CA certificates, such as the root and intermediate certificates, into a truststore. For example:

keytool -importcert -alias my_intermediate_ca
  -file intermediate.cer
  -keystore sample_keystore
  -storetype PKCS12

keytool -importcert -alias my_root_ca
  -file root.cer
  -keystore sample_keystore
  -storetype PKCS12

Each certificate is stored under a unique alias. We can verify the entries using:

keytool -list -v -keystore sample_keystore -storetype PKCS12

This approach is commonly used when configuring Java applications to trust external services.

3.2. Importing a Certificate Chain for a Private Key Entry

If the KeyStore already includes a private key entry, for instance, one that we previously generated using the -genkeypair command, we’ll need to attach the certificate chain provided by the Certificate Authority to that entry.

To begin, we create a new key pair:

keytool -genkeypair -alias my_tls_key
  -keyalg RSA -keysize 2048
  -keystore sample_keystore
  -storetype PKCS12

Once the key pair is ready, we proceed by generating a Certificate Signing Request (CSR):

keytool -certreq -alias my_tls_key
  -file my_tls_key.csr
  -keystore sample_keystore
  -storetype PKCS12

After the CA issues the certificate, it usually provides either a PEM file containing the full certificate chain or a PKCS#7 (.p7b) bundle. We can then import the CA response into the same alias:

keytool -importcert -alias my_tls_key
  -file ca-reply.pem
  -keystore sample_keystore
  -storetype PKCS12

If we’re using a PKCS#7 bundle:

keytool -importcert -alias my_tls_key
  -file ca-reply.p7b
  -keystore sample_keystore
  -storetype PKCS12

After importing, the alias should contain a private key entry with an associated certificate chain. We can confirm this by running:

keytool -list -v -alias my_tls_key
  -keystore sample_keystore
  -storetype PKCS12

If the chain was correctly imported, we’ll see a certificate chain length greater than one.

4. Conclusion

In this tutorial, we went through how to import a .cer file inside a KeyStore.

In order to do that, we used the keytool’s importcert option.