Keystore, truststore, JKS, PKCS#12: the terms
Java applications such as Tomcat, Spring Boot, Jira, Keycloak or Elasticsearch do not store certificates as loose files but in a keystore: a password-protected file with named entries (aliases).
- Keystore: holds your own private key with its certificate and intermediates. A server (or a client with mTLS) identifies itself with it.
- Truststore: holds only certificates of CAs that are trusted. Java’s truststore is called
cacertsand lives in$JAVA_HOME/lib/security/. - JKS is the old Java-specific format. Since Java 9 PKCS#12 (.p12, .pfx) is the default, which OpenSSL, Windows and browsers read too.
- JCEKS is a JKS variant with stronger key protection that can also store secret keys (e.g. AES).
Typical errors and what they mean
- “Keystore was tampered with, or password was incorrect”: the password is wrong. Here it shows up as a failed integrity check.
- “Cannot recover key” / “Given final block not properly padded”: with JKS, the key has a different password than the keystore. The tool then asks for the key password.
- “PKIX path building failed” on the client: the server’s keystore lacks intermediates, or the client’s truststore lacks the root CA. The tool shows both.
- Truststore is ignored although the certificate is in it: PKCS#12 files created with OpenSSL have no Java trust attribute, so Java does not see the certificates as trusted entries. Truststores created here have the attribute.
- “Alias name does not identify a key entry”: the alias in the configuration points to a certificate-only entry instead of the key.
Convert JKS to PKCS#12
Open the file, choose “PKCS#12” below, set a password and download. Then adjust the type in the configuration, e.g. certificateKeystoreType="PKCS12" in Tomcat or server.ssl.key-store-type=PKCS12 in Spring Boot. “PKCS#12 compatible” uses older methods (3DES, SHA-1) for Windows Server 2016, older Java 8 versions and appliances that cannot read AES in PKCS#12.
If intermediates are missing, the certificate converter adds them. The SSL check shows what the server really sends afterwards, and the key match also checks whether key, certificate and CSR belong together.
FAQ
Is my keystore uploaded anywhere?
No. The file is read and decrypted in your browser; passwords and keys never leave your device. After loading, the page also works offline.
What is the cacerts password?
changeit by default. Since Java 9 keytool can access it directly with the -cacerts option, without specifying the path.
Can I recover a forgotten keystore password?
No. With JKS the certificates can be shown without a password, but the private keys cannot. The only way out is a new key and a new certificate.
Why does PKCS#12 have only one password?
For PKCS#12, Java uses the same password for file and key, and many programs such as Tomcat even require it. Separate key passwords practically only exist in JKS.
What happens to secret keys from JCEKS?
They are shown but not carried over because their content is stored as a serialised Java object. keytool -importkeystore can transfer them to PKCS#12.