importing pfx certificate WITH private key into JKS keystore?
843811Jan 9 2003 — edited Feb 26 2004Hi.
I am writing a SOAP client application which connects to a HTTPS server with mutual authentication (ie both server and client authentication). The server authentication is working OK, as I have correctly imported the web server Root CA certificate into the truststore I am using.
But, from the server I have received the client certificate to be used, as a PKCS12 certificate to be used in a .pfx file. That is, the certificate which the client will have to use to authenticate itself with the server. The certificate file also includes the private key (of course, as it will be needed when encrypting the data to be sent).
The file is working, as the
Now, how do I import it into the Java keystore?
I have read on this very forum (and tried myself without success), that keytool does not import certificates in PKCS12 format with private keys into the keystore.
Now, programmatically I have been able to read the certificate from the pfx file directly, as shown below:
KeyStore ks2 = KeyStore.getInstance("PKCS12", "SunJSSE");
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SUNX509");
ks2.load(null, null);
FileInputStream fin = new FileInputStream(new File("client_cert.pfx");
// Certificate read from file?
ks2.load(fin, "client_password".toCharArray());
kmf.init(ks2, "keystore_password".toCharArray());
fin.close();
com.sun.net.ssl.SSLContext ctx = com.sun.net.ssl.SSLContext.getInstance("SSLv3");
KeyManager[] km = kmf.getKeyManagers();
/*
TrustManager[] tm = tmf.getTrustManagers();
ctx.init(km, tm, null);
*/
And it works for initiating simple URL connections and reading from them with inputstreams. I am however using the Apache Axis SOAP toolkit, and it completely ignores the above code, trying to read the client certificate from the keystore anyway, even though I have already have performed an SSL handshake, and of course failing (as the certificate simply is not there).
So, if anyone knows how to import a pfx certificate WITH its private key into the default JKS keystore, I will greatly appreciate some feedback.