How to convert Intermediate & Leaf Certs (PEM) to JKS

Question

I have the following file keystore.txt:

-----BEGIN CERTIFICATE-----
MIIFkDCCA3ig2wIB4gIBPDANBgkqhkiG9w0BAQ0FADCBnzELMAkGA1UE5hMCZGUx
DDAKBaNVBAgT...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
IaIGLTCCBBWgAwIBAg9w0BAQsBAjABAjABAjABjFADCBnzELMAkGA1UEBhMCZGUx
DDAKINBgkqhkiGBgNVBAgTA...
-----END CERTIFICATE-----

This is an intermediate cert followed by a leaf cert. How do you convert that to JKS format?

"I don't see which certificate is which." What does that mean? — President James K. Polk, Mar 10 '18 at 02:43
The first one looks like the start of a certificate. The second one doesn't. You might want to mention how you created this file. A certificate and a private key are two very different things. — President James K. Polk, Mar 10 '18 at 02:47
File was given to me to create a JKS from it. Is there any command to run to identify which is which? — Kam, Mar 10 '18 at 02:48
OK will ask the originator to clarify and will update this question :) Thank you James — Kam, Mar 10 '18 at 02:57

score 0 · Answer 1 · answered Mar 12 '18 at 19:13

Typically a certificate chain, which is what you now have, only makes sense in association with a Private Key. "JKS" is a particular keystore format, whose entries match those described by the Java KeyStore javadocs. See the description for KeyStore.PrivateKeyEntry in the KeyStore docs. You'd already have the private key in the JKS keystore. Thus a typical flow is something like the following:

keytool -genkeypair -keystore myks.jks -alias server1
keytool -certreq -keystore myks.jks -alias server1 -file server1.p10

server1.p10 contains a PKCS#10 certificate request. Included in that is the public key that corresponds to the private key in alias server1 in the keystore. Now you'd take the file server1.p10 and supply it to your certificate authority (CA). If all is well they'll return to you a file containing a properly signed leaf certificate and 0 or more intermediate certificates. This is likely to be the file keystore.txt you are referring to. (Note that all reputable SSL CAs I am aware of will always include at least 1 intermediate cert along with your leaf cert).

You then import these certificates into the keystore, specifying the alias that corresponds to the correct private key, with the following command.

keytool -importcert -keystore myks.jks -alias server1

And this completes the transaction. The keystore now contains a private key and associated certificate chain accessible through the alias server1.

How to convert Intermediate & Leaf Certs (PEM) to JKS

1 Answers1