Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

Java applications commonly store TLS certificates and private keys inside a Java Keystore. If you work with Java servers such as Tomcat, Spring Boot applications, or enterprise middleware, you will likely encounter keystore files.

This article is part of the PKI for DevOps Engineers training series. In the previous lesson we covered PKCS12 certificates. In this lesson you will learn how Java keystores work and how they store TLS certificates.

If you need to install the Java keytool utility used to manage keystores, see our guide on installing keytool.

—

Table of Contents

—

What is a Java keystore?

A Java Keystore is a file used by Java applications to store cryptographic keys and certificates.

Keystores are commonly used for:

  • HTTPS servers running on Java
  • mutual TLS authentication
  • application trust stores
  • certificate validation

Java applications use keystores to determine which certificates to trust and which certificates should be presented during TLS connections.

If you need a refresher on certificate structure, see our lesson on X.509 certificates.

—

JKS vs PKCS12 keystore formats

There are two primary formats used for Java keystores.

JKS (Java Keystore)

The original Java keystore format is JKS. It was historically the default keystore format used by the Java platform.

JKS files typically use the extension:

  • .jks

PKCS12

Modern versions of Java support the PKCS12 format, which is widely used across different platforms.

PKCS12 files typically use:

  • .p12
  • .pfx

Because PKCS12 is interoperable across multiple systems, it has largely replaced JKS as the default keystore format.

To learn more about PKCS12 files, see our article on PKCS12 certificates.

—

What keystores store

A keystore can contain multiple entries identified by unique aliases.

These entries may include:

  • private keys
  • server certificates
  • trusted certificate authorities
  • certificate chains

Each entry inside a keystore is referenced by an alias. This allows applications to identify which certificate should be used for TLS operations.

—

View keystore contents

You can inspect the contents of a Java keystore using the keytool utility.

keytool -list -keystore keystore.jks

This command displays all certificate entries stored in the keystore.

For a more detailed example, see our article on listing certificates in a keystore.

—

Import certificates into a keystore

Certificates can be imported into a keystore using keytool.

keytool -importcert \
-file certificate.crt \
-keystore keystore.jks \
-alias myserver

This command imports a certificate into the keystore under the specified alias.

If the certificate includes intermediate authorities, the entire certificate chain should be imported to avoid validation errors.

If you want to understand certificate chains better, see our lesson on certificate chains.

—

Where keystores fit in TLS deployments

In many Java environments, the certificate deployment process looks like this:

  1. Generate private key
  2. Create CSR
  3. Submit CSR to CA
  4. Receive signed certificate
  5. Import certificate into keystore
  6. Configure application to use keystore

This connects directly with earlier lessons in this training series including creating CSRs and packaging certificates using PKCS12.

—

Frequently Asked Questions

What is a Java keystore?

A Java keystore is a file that stores cryptographic keys and certificates used by Java applications.

What is the difference between JKS and PKCS12?

JKS is a Java-specific keystore format while PKCS12 is a cross-platform certificate container format.

How do I view certificates inside a keystore?

You can list entries using the keytool command:

keytool -list -keystore keystore.jks

Can Java use PKCS12 files?

Yes. Modern Java versions support PKCS12 and often use it as the default keystore format.

—

Next Lesson

In the next lesson you will learn how certificate expiration monitoring works and how DevOps teams prevent TLS outages.

Lesson 8 – Certificate Expiration Monitoring →

—

Training Series Navigation