1. ITTT Create jks from pem. crt. key

07/09/2026
Tags: Stufo Dev , IT Tricks & Tips

IT Tricks & Tips

What Are “IT Tricks and Tips”?

“IT Tricks and Tips” is a collection of real-world problems I’ve encountered throughout my career as a software developer, along with the solutions that worked for me.

I hope these practical tips will help others solve similar problems, save valuable time, avoid unnecessary frustration—and perhaps even prevent a few new wrinkles and moments of pure rage.

A few days ago, I ran into an interesting problem at work. I needed to install a certificate on a server using a .jks file—a Java KeyStore. Coming from the Microsoft world, this certificate format was quite unfamiliar to me.

The biggest problem was that we had received only .pem, .crt, and .key files—no .jks file. I started searching online, but I couldn’t find a clear guide explaining how to create a Java KeyStore from the files I already had. Then I thought to myself: “Even if you’re not a big fan of AI, maybe it’s time to give it a try. Who knows—it might actually help.”

So, I logged in to Perplexity and entered this magical prompt:


> “I have PEM, CRT, and KEY files. How can I create a JKS file?”

A highly sophisticated prompt, as you can see. 😄

Within seconds, I had an answer. To my surprise, the proposed solution actually worked! That’s why I decided to share it with you. Below, you’ll find the complete answer provided by AI.

To create a .jks file (Java KeyStore) from .pem, .crt, and .key files, first create a PKCS#12 (.p12/.pfx) file with OpenSSL, then import it into a JKS file with Java keytool.

Prerequisites

Make sure you have:

  • OpenSSL
  • A Java JDK, including keytool

Input files

Assume you have:

  • certificate.crt or certificate.pem — server/client certificate
  • private.key or private.pem — matching private key
  • ca-chain.crt or ca-chain.pem — optional intermediate/root CA chain

The file extension is not important: a .crt file containing PEM text is still usable by OpenSSL.

1. Create a P#12 file

Combine the certificate, its private key, and—if available—the CA certificate chain:


openssl pkcs12 -export \

  -inkey private.key \

  -in certificate.crt \

  -certfile ca-chain.crt \

  -name "myalias" \

  -out keystore.p12

OpenSSL will ask you to set an export password. Keep it safe: you will need it in the next step. If you do not have a CA-chain file, omit the -certfile ca-chain.crt line:


openssl pkcs12 -export \

  -inkey private.key \

  -in certificate.crt \

  -name "myalias" \

  -out keystore.p12

2. Convert P#12 to JKS

Import the newly created .p12 file into a Java KeyStore:


keytool -importkeystore \

  -srckeystore keystore.p12 \

  -srcstoretype PKCS12 \

  -srcstorepass "p12_password" \

  -destkeystore keystore.jks \

  -deststoretype JKS \

  -deststorepass "jks_password" \

  -alias "myalias"

Replace:

  • p12_password with the password chosen during the OpenSSL export
  • jks_password with the desired JKS password
  • myalias with the alias specified in the OpenSSL command

3. Verify the JKS file

Check that the certificate and private key were imported correctly:


keytool -list -v \

  -keystore keystore.jks \

  -storepass "jks_password"

The output should show a PrivateKeyEntry associated with your alias.

Important notes

  • The private key must match the certificate; otherwise the conversion will fail.
  • Include intermediate CA certificates whenever possible. Without them, Java clients may fail to validate the certificate chain.
  • If you have multiple intermediate certificates, place them in ca-chain.crt, normally ordered from the issuing intermediate CA toward the root CA.
  • Modern Java applications often support PKCS#12 directly, so using keystore.p12 may be sufficient and avoids the need for JKS.

https://stackoverflow.com/questions/11952274/how-can-i-create-keystore-from-an-existing-certificate-abc-crt-and-abc-key-fil https://stackoverflow.com/questions/38250271/creating-a-jks-from-a-crt-and-key-file-is-that-possible https://serverfault.com/questions/483465/import-of-pem-certificate-chain-and-key-to-java-keystore https://www.cleverence.com/articles/oracle-documentation/creating-a-keystore-in-jks-format-4927/ https://codingtechroom.com/question/create-jks-from-crt-and-key https://gist.github.com/npathai/c40dd638ea66c37a8093b69b9269684e https://admin.kuleuven.be/icts/english/services/certificates/installcertificate/java_keytool_install https://superuser.com/questions/1050726/how-to-import-p7s-certificate-chain-into-keystore https://www.herongyang.com/crypto/Key_Formats_PKCS8_PKCS12_4.html https://docs.oracle.com/cd/E72987_01/owsm/OWSMR/import-pkcs-cert-jks.htm https://stackoverflow.com/questions/11700132/how-to-import-a-jks-certificate-in-java-trust-store https://blogs.oracle.com/blogbypuneeth/steps-to-create-a-jks-keystore-using-key-and-crt-files https://andreisid.github.io/2015/11/add-a-certificate-chain-and-private-key-to-a-jks-keystore.html https://northcoder.com/post/transfer-pem-based-certificate-into/ https://gist.github.com/peatiscoding/df5c1367a883dea3a2799ad50eceb274