Keystore type: which one to use?

by

There are a few more types than what’s listed in the standard name list you’ve linked to. You can find more in the cryptographic providers documentation. The most common are certainly JKS (the default) and PKCS12 (for PKCS#12 files, often with extension .p12 or sometimes .pfx).

JKS is the most common if you stay within the Java world. PKCS#12 isn’t Java-specific, it’s particularly convenient to use certificates (with private keys) backed up from a browser or coming from OpenSSL-based tools (keytool wasn’t able to convert a keystore and import its private keys before Java 6, so you had to use other tools).

If you already have a PKCS#12 file, it’s often easier to use the PKCS12 type directly. It’s possible to convert formats, but it’s rarely necessary if you can choose the keystore type directly.

In Java 7, PKCS12 was mainly useful as a keystore but less for a truststore (see the difference between a keystore and a truststore), because you couldn’t store certificate entries without a private key. In contrast, JKS doesn’t require each entry to be a private key entry, so you can have entries that contain only certificates, which is useful for trust stores, where you store the list of certificates you trust (but you don’t have the private key for them).

This has changed in Java 8, so you can now have certificate-only entries in PKCS12 stores too. (More details about these changes and further plans can be found in JEP 229: Create PKCS12 Keystores by Default.)

There are a few other keystore types, perhaps less frequently used (depending on the context), those include:

  • PKCS11, for PKCS#11 libraries, typically for accessing hardware cryptographic tokens, but the Sun provider implementation also supports NSS stores (from Mozilla) through this.
  • BKS, using the BouncyCastle provider (commonly used for Android).
  • Windows-MY/Windows-ROOT, if you want to access the Windows certificate store directly.
  • KeychainStore, if you want to use the OSX keychain directly.

More Related Contents:

  1. SSLContext initialization
  2. How can I use different certificates on specific connections?
  3. How are SSL certificate server names resolved/Can I add alternative names using keytool?
  4. Java client certificates over HTTPS/SSL
  5. javax.net.ssl.SSLException: Received fatal alert: protocol_version
  6. Registering multiple keystores in JVM [duplicate]
  7. java – path to trustStore – set property doesn’t work?
  8. How to force java server to accept only tls 1.2 and reject tls 1.0 and tls 1.1 connections
  9. Why does Java’s SSLSocket send a version 2 client hello?
  10. Java and SSL – java.security.NoSuchAlgorithmException
  11. How to override the cipherlist sent to the server by Android when using HttpsURLConnection?
  12. Setting multiple truststore on the same JVM
  13. Using Apache httpclient for https
  14. Resolving javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed Error?
  15. Encrypt Password in Configuration Files? [closed]
  16. Java SSLHandshakeException “no cipher suites in common”
  17. Allowing Java to use an untrusted certificate for SSL/HTTPS connection
  18. Difference between java.util.Random and java.security.SecureRandom
  19. How to extract CN from X509Certificate in Java?
  20. Importing the private-key/public-certificate pair in the Java KeyStore [duplicate]
  21. JavaMail IMAP over SSL quite slow – Bulk fetching multiple messages
  22. How to do an HTTPS POST from Android?
  23. Unit testing with Spring Security
  24. Disable Java reflection for the current thread
  25. Properly closing SSLSocket
  26. SSL Connection Reset
  27. How can I know if the request to the servlet was executed using HTTP or HTTPS?
  28. Maven: resource binary changes file size after build
  29. SSL “Peer Not Authenticated” error with HttpClient 4.1
  30. Creating .p12 truststore with openssl

Leave a Comment