#pkcs12

INTRODUCTION

Here are a few CLI commands to convert a java key store file to a PKCS12 encoded cert chain and back. This requires the java development kit (Sun/Oracle JDK) 6 or newer.  

INSTRUCTIONS

JKS → P12

$> keytool -importkeystore \ -srckeystore keystore.jks \ -srcstoretype JKS \ -deststoretype PKCS12 \ -destkeystore keystore.p12

P12 → JKS

In case it's helpful to other folks, here's how to convert a Java Keystore file (JKS) to a PKCS#12 archive file (PFX). You'll need java installed somewhere on a local system so you can leverage the handy keytool command.

1) Copy the JKS file to the respective jre bin folder. Versions and specific paths can vary but an example would be c:\Program Files\Java\<jre version>\bin\

2) Navigate to that directory from the Windows command prompt and leverage the following command:

keytool -importkeystore -srckeystore "<source jks filename>" -srcstoretype JKS -srcstorepass <jks password> -destkeystore "<destination pfx filename>" -deststoretype PKCS12 -deststorepass <desired pfx password>

So for example, let's say my JKS file was named myjksfile.jks and it had a password of foopassword... and let's say that I wanted to convert it to a PFX file called mypfxfile.pfx with a different password of foopassword2. The complete command would look like:

keytool -importkeystore -srckeystore "myjksfile.jks" -srcstoretype JKS -srcstorepass foopassword -destkeystore "mypfxfile.pfx" -deststoretype PKCS12 -deststorepass foopassword2

Additional tidbits:

The quotation marks are optional. I just put them there in case the file paths/names have spaces.

Convert SSL Certificate to pfx from Linux

OpenSSL is used for many things other than running encryption on a website. It is also used for the generation of CSR keypairs, and more importantly within this article converting.

The Italic parts in the conversions below are examples of you own files, or your own unique naming conventions adapt these Italic name examples to your own files names for openssl commands. Note: .pem, .cer, crt. are…

openssl pkcs12 -export -in [ssl_cert.crt] -inkey [ssl_cert.key] -out keystore.p12 -name [alias]

if you then wish to export it to a JKS (for Java/Tomcat), then do:

인증서 구성요소

인증서 만들기: 인증서 요청 파일(windows: csr / linux or unix: pem) ->  private key / 패스워드 생성 (.key) -> 인증센터(인증업체) 로 요청 -> 인증서(.cer/.crt) 수령 -> .pfx/.p12(PKCS12;주로 Windows) 또는 .jks/.keystore(JKS;linux/unix) 패키지로 추출

인증서 추출 후 설치 시 “신뢰할 수 없는 인증서” 로 나오는 경우 => https://www.comodossl.co.kr/support/faq/view.aspx?category=SSL&Seq=70 일부 브라우져에서 SSL 이 적용된 웹사이트에 접속시, “신뢰할 수 없는 인증서” 라는 류의 경고 메시지가 출력되는 경우가…

Though these CFHTTP attributes have been available since ColdFusion 8, I missed it, and thought some of you may have, too. The tag-based attributes are clientcert and clientcertpassword, but below I show you how to do it in CF script.

Before this was available in CF 8, integrating PKCS12 (.p12 or .pfx) files with the ColdFusion JVM was a lot more involved. Being able to do this strictly in code saves developers and/or your Sys Admin/IT crowd from a lot of work.

You used to have to use the keytool, and converting to the right encoding was a concern. With ClientCert and ClientCertPassword attributes, pain (as described below in some old CF blogs) is drastically reduced:

http://www.talkingtree.com/blog/index.cfm/2004/7/1/keytool

http://jochem.vandieten.net/2008/02/28/cfhttp-and-client-certificates/

You have a certificate in PKCS#12 format (also known as PFX), it's a binary format and you need the certificate and key in a text format (PEM).

You can use the openssl command to do that (note that the Apache Web Server comes with the openssl command in its bin directory). The following two commands with export first the key and the the signed certificate: