PKCS12 Java Keystore from CA and User certificate in java

by

The PKCS#12 format is intended for storing a private key associated with a certificate chain, and both are required (although you might not need the whole chain).
Although the PKCS12 keystore type does a good job for mapping this format to a Java KeyStore, not everything is supported for this reason.

What you’re trying to do in your first attempt is storing a certificate on its own, which won’t work.

What you’re trying to do in your second attempt (ks.setKeyEntry("SomeAlias", userCert.getPublicKey().getEncoded(), chain)) is to for a public key in place of what should be a private key (see KeyStore#setKeyEntry).

.cer file tend to be just for certificates not private keys (although of course, the extension is ultimately just an indication). If you export your .cer file from Keychain Access.app, you won’t get the private key with it (that’s what the .p12 export format is for).

EDIT about KeychainStore:

If the reason you’re trying to do this conversion is ultimately to access private keys and certificates that are already in the keychain you could load them from the KeychainStore directly:

KeyStore ks = KeyStore.getInstance("KeychainStore", "Apple");
ks.load(null, "-".toCharArray());

A couple of notes for this:

  • Any non-null, non-empty password will do to use the private key (e.g. "-".toCharArray()), as access will be prompted by the OS’s security service (like it would in other applications).
  • As far as I’m aware, there is still a bug and it only allows access to one private key/certificate pair (even if a number of pairs of private key/certificate pairs are present in the keychain)

More Related Contents:

  1. How to convert fuzzy hash string to a file? [closed]
  2. Java 256-bit AES Password-Based Encryption
  3. What is the most appropriate way to store user settings in Android application
  4. How to encrypt String in Java
  5. Encrypt Password in Configuration Files? [closed]
  6. Given final block not properly padded
  7. How to extract CN from X509Certificate in Java?
  8. Importing the private-key/public-certificate pair in the Java KeyStore [duplicate]
  9. IllegalBlockSizeException when trying to encrypt and decrypt a string with AES
  10. Java, How to implement a Shift Cipher (Caesar Cipher)
  11. Do I need to store the salt with bcrypt?
  12. How to encrypt or decrypt with Rijndael and a block-size of 256 bits?
  13. How can I convert a String to a SecretKey
  14. JCE cannot authenticate the provider BC in java swing application
  15. How do I securely store encryption keys in java? [closed]
  16. Better way to create AES keys than seeding SecureRandom
  17. convert openSSH rsa key to javax.crypto.Cipher compatible format
  18. How to create a secure random AES key in Java?
  19. javax.crypto.IllegalBlockSizeException : Input length must be multiple of 16 when decrypting with padded cipher [duplicate]
  20. How to get server certificate chain then verify it’s valid and trusted in Java
  21. Creating an X509 Certificate in Java without BouncyCastle?
  22. Decrypting an OpenSSL PEM Encoded RSA private key with Java?
  23. java.security.NoSuchAlgorithmException:Cannot find any provider supporting AES/ECB/PKCS7PADDING
  24. Java equivalent of C++ encryption [duplicate]
  25. Is Cipher thread-safe?
  26. PGP Encryption and Decryption with Java [closed]
  27. How can I make my AES encryption identical between Java and Objective-C (iPhone)?
  28. Encrypt and decrypt large string in java using RSA [closed]
  29. Generate Subject Hash of X509Certificate in Java
  30. Breaking down RSA/ECB/OAEPWithSHA-256AndMGF1Padding

Leave a Comment