Convert a .p12 Keystore to .jks

The below steps seem to be a headache at my workplace. Learn to go from a p12 to jks keystore in this easy tutorial.

In step 1, we will generate the certificates required to build a p12 keystore. In step 2, we will build the .p12 keystore. Then in step 3, we will convert the p12 to a jks keystore. Make sure you are in the correct directory before running the commands. Depending on your installation of Java, it is not the path, you will need to go to the java directory to run ./keytool.

Step 1 - Generate the Certificates:

# Generate Private Key (the master key) in OpenSSL:

openssl genrsa -out johnghawi.com.key 2048

# Generate CSR (Certificate Signing Request - used to get the public certificate) from the Private Key above:

openssl req -new -key johnghawi.com.key -out johnghawi.com.csr

Submit the .csr file to a Certificate Authority (CA) and get your .cer certificate (ASCII/text). The .cer file is your public-facing certificate.

Once you get your host's certificate, you'll likely have been given a one or more intermediate certificates and a root certificate to download as well. Download those as well. What you have, is a chained certificate. It means the intermediates and root certificates are used to complete the chain of authority. In English, the certificate you were given may have been issued by a third-party company. That company may not be in your application's or browser's Trust Store. However, a major Certificate Authority will be in that Trust Store. The certificate that the major CA will have in there is known as a root certificate and it is used to validate the intermediate certificates. In turn, the Intermediates validate the certificate issued to you, and that my friends, is how you complete the chain.

Next, 'bundle' the intermediates and root into one file using the cat command. This step makes managing the certs both easy and central. The certs must be text-based. Do not add your host cert to the line below, only add the intermediates (all of them in order) and the root certificate.

cat intermediate1.cer intermediate2.cer root.cer > chain-bundle.cer

Using a text editor, you can take a look in the chain-bundle.cer file to see your results. Just type:

cat chain-bundle.cer

Step 2 - Build the .p12 Keystore

Before performing the conversion, we will build our p12 keystore in the first command. There is a good chance you arrived here because you wanted to just convert from one to the other. We will build the p12 keystore to illustrate how the OpenSSL keystore maps to the Java keytool keystore. If you have the prerequisite to convert, skip to step 3.

Create .p12 keystore with the certificates from above:

openssl pkcs12 -export -in johnghawi.com.cer -name applet -CAfile chain-bundle.cer -chain -inkey johnghawi.com.key -out myKeys.p12

Step 3 - Convert the p12 keystore to a java keystore (jks):

Depending on how keytool was installed, you may need to add ./ before keytool, such as: ./keytool

keytool -importkeystore \
-deststorepass 123456 -destkeypass 123456 -destkeystore myKeys.jks \
-srckeystore myKeys.p12 -srcstoretype PKCS12 -srcstorepass 123456 -alias applet

Let's find out what each switch in the above command means (you can find this by typing: man keytool at the terminal):
keytool is the 'java keytool' application we are using to perform the function.
-importkeystore tells keytool we are importing contents from another keystore - we don't pass any values here. It only signals to keytool the sub-function we are performing.
-deststorepass 123456 is the password (123456) of the destination jks keystore we are converting to.
-destkeypass 123456 ..when working with PKCS12 keystores, deststorepass and destkeypass need to be the same (see man keytool). This may not be necessary when going from PKCS12 to JKS but I had no issues doing it this way.
-destkeystore myKeys.jks is the path to the Java keystore we will be creating.
-srckeystore myKeys.p12 is the path of the openssl p12 keystore we created earlier.
-srcstoretype PKCS12 is the keystore type of the source openssl keystore we are importing from.
-srcstorepass 123456 the password to open and retrieve from the openssl p12 keystore.
-alias applet is the alias I used in my keystore. Most people use '1' but it helps to make it something useful for when you read the keystore at a later date.

If you've got any questions, feel free to use the comment section below.

Read More

Create Java Keystore Using OpenSSL and Keytool for JBOSS

Last week, I encountered an irritating issue getting JBoss to accept my Java Keystore. The .csr was OpenSSL-generated and the certs were derived from VeriSign. The error I would receive on start:

JBWEB003043: Error initializing endpoint: java.io.IOException: 
JBWEB002000: Alias name 1 does not identify a key entry

The steps below eventually got me up and running. Some parts may look counter-intuitive because instead of converting the keystores to a jks-supported format (doing so kept throwing the above error), I took the certs, put them in an OpenSSL keystore,  and then fed that keystore into the conversion.

In this process, I noticed that creating an empty JKS (JKS = Java KeyStore) would automatically create a key in the new .jks. Though I had my key as alias 1, JBoss would tell me it couldn't find what it was looking for.

If you're running into any of what I'm saying, try the below. If you're here to learn, a keystore is your bag and you want to put your certs in the bag. But there are two types of bags, there is the OpenSSL bag and there is the Java KeyStore bag. They are the two coworkers you have that pretend to like each other, one makes more of an effort to get along with the other,  and deep down, everyone in the office finds dealing with them a little touchy.

Let's start fresh:
1. Concatenate both intermediate and root certs (make sure all your certs are in text format). If you can open all your certs in a text editor and see ASCII characters, you're set. If you cannot, perform the below command on each cert.

# Convert certs from data to text (pem) replacing the values below. Keep track of their names. You need to know which cert is which:

openssl x509 -in <NonTextCert.crt> -inform der -outform pem -out <OutputTextCert.pem>

2. You may not have two intermediate certs. In most cases, you'll have one intermediate (your issuer) and the root certificate (known as the CA - Certificate Authority). In this example, there are two intermediates and a root that we will combine into one file called chain.crt:

cat Primary-Intermediate.pem Secondary-Intermediate.pem VeriSign-Root.pem > chain.crt

To ensure there are no Windows carriage returns in the file, use dos2unix to clean it up:

# Ubuntu:
sudo apt-get install dos2unix

# RedHat:
sudo yum install dos2unix

# Clean up:
dos2unix chain.crt

Here is where the fun begins!

3. Use keytool to generate a Java Keystore. Of course, you'll need the JDK to use the Java keytool. When you create the .jks, a key will be generated inside - a key that we don't want since we have existing keys we want to use. Each command is one line, but I broke the command up at whitespaces to make it easier to read. Change the values to yours.

# Use keytool to generate a jks:

./keytool -genkey -alias tempalias -keyalg RSA -keysize 2048 \
   -dname "CN=johnghawi.com, OU=IT, O=Company, L=Toronto, ST=Ontario, C=CA" \
   -keypass changeit \
   -keystore mykeystore.jks \
   -storepass changeit

4. Remove the unwanted key from mykeystore.jks.

./keytool -delete -alias tempalias -keystore mykeystore.jks -storepass changeit

5. Use 'openssl' to generate a .p12 keystore (the OpenSSL equivalent of a JKS) with all the certs that we will want in the java keystore from above. server.p12 will be the name of the OpenSSL keystore.

openssl pkcs12 -export \
   -out server.p12 \
   -inkey johnghawi-private.key \
   -in johnghawi-public.pem \
   -certfile chain.crt

6. Use keytool to import the .p12 keystore into the java keystore.

# keytool will take the srckeystore server.p12, convert its contents and store it in the 
# original .jks we created in Step 3. By default, the pkcs12 (.p12) keystore entry will be created under alias 1. Instead of supplying the below command with -alias, we will be more precise and explicitly specify the source and dest aliases, should you wish to change it in the destination keystore.

./keytool -importkeystore \
   -deststorepass changeit \
   -destkeypass changeit \
   -destkeystore mykeystore.jks \
   -srckeystore server.p12 \
   -srcstoretype PKCS12 \
   -srcstorepass changeit \
   -srcalias 1
   -destalias 1

At this point, the .jks is ready to use. Copy it to the location you want, secure those permissions and ownership if needed, and specify the keystore in the JBoss config.

 
# Add the new keystore into the config. Your path may differ.
vi $JBOSS_HOME/<instance>/configuration/standalone-full-ha.xml

Find the subsystem tag that contains 'connector name="https" - this will be the tag that will use the jks for web communications. Your alias in the config below needs to match the keystore alias used during the import as well as password:

<connector name="https" protocol="HTTPS/1.1" scheme="https" socket-binding="https" enable-lookups="false" secure="true" max-connections="900">

   <ssl name="ssl" key-alias="1" password="changeit" certificate-key-file="/app/certs/mykeystore.jks" protocol="TLSv1" verify-client="false"/>

</connector>

Notice that the config has the keystore passwords stored in plaintext. Usually, this is not a good idea. Encrypted passwords are a topic of their own and out of scope for this tutorial. Anyone with access - legitimate or not - can read the config and password; compromising your keystore. The Vault Tool can be used to encrypt the keystore password that JBoss will use to access the keystore. Take a look at this article in the JBoss documentation: JBossAS7SecuringPasswords

Read More