> ## Content Index
> Fetch the complete content index at: https://kudithipudi.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# HOW TO : Convert PFX/P12 crypto objects into a java keystore
- URL: https://kudithipudi.org/how-to-convert-pfxp12-crypto-objects-into-a-java-keystore/
- Published: 2013-04-10T13:37:36.000Z
- Updated: 2013-04-10T13:37:36.000Z
- Description: We needed to add a certificate that is currently in PKCS#12 format currently into a java keystore at work recently. The typical step would be due...
- Author: admin
- Tags: HOWTO, security, Technology, Uncategorized, #wp, #wp-post, #Import 2026-08-23 02:32

We needed to add a certificate that is currently in PKCS#12 format currently into a java keystore at work recently. The typical step would be due to create an empty keystore and then import the certificate from the PKCS#12 store using the following command

```
keytool -importkeystore -srckeystore sourceFile.p12 -srcstoretype PKCS12 -destkeystore destinationFile.jks
```

Note: PKCS#12 files can have extensions “.p12” or “.pfx”

The command executed without any issues, but we received the following error when we started the application server using this newly created keystore

```
java.io.IOException: Error initializing server socket factory SSL context: Cannot recover key
```

It didn’t make sense, because we were able to view the certificate in the keystore and were using the right password in the configuration files.

After a lot of searching and head scratching, the team came up with the following solution

1. Export the public key and private key from the PKCS#12 store using openssl.
2. Import these keys into the java keystore (default format of JKS)

The commands used were

```

openssl pkcs12 -in sourcePKCS12File.p12 -nocerts -out privateKey.pem
openssl pkcs12 -in sourcePKCS12File.p12 -nokeys -out publicCert.pem
openssl pkcs12 -export -out intermittentPKCS12File.p12 -inkey privateKey.pem -in publicCert.pem
keytool -importkeystore -srckeystore intermittantPKCS12File.p12 -srcstoretype PKCS12 -destkeystore finalKeyStore.jks
```