title: adding private key to a keystore
body: <p>In connection to renewal of some certificates I had to convert a jks keystore to a PKCS#12 keystore and include the private key during the conversion as well. We received the keystore as a JKS keystore, however our webservers uses PKCS#12 keystores, and the keystores we received only contained the certificates and not the private key. </p>
  
  <p>I tried to google around and readthrough several entries at SO, and I have only come up with a solution, which seems more like a workaround than a good approach, so I was wondering if someone out there has a better approach how to inject private keys and convert from a jks keystore to a PKCS#12 keystore in a simpler manner.</p>
  
  <p>It seems like JKS keystores can only be manipulated by the keytool, however the keytool utility does not support injecting private keys into trustedCertEntries AFAIK, so the approach I used was as follows:</p>
  
  <p>assuming I have the private key as a pem file.</p>
  
  <ol>
  <li>extracted all certificates from the jks keystore using the keytool. </li>
  <li>created a PKCS#12 keystore using the openssl</li>
  <li>rename the alias in the created PKCS12 using keytool</li>
  <li>create another PKCS#12 keystore using the openssl</li>
  <li>rename the alias in the other created PKCS#12 using keytool</li>
  <li>merge the two keystore into one using the keytool</li>
  <li>importing the non private keyed certificates</li>
  </ol>
  
  <p>So the whole flow is as follows (In case also needs it):</p>
  
  <pre><code>openssl pkcs12 -in orig.alias.p12 -nodes -nocerts -out key.pem -passin pass:PASSWORD
  keytool -keystore keystore1 -storepass PASSWORD -list
  keytool -keystore keystore1 -storepass PASSWORD -rfc -file alias.root.pem -alias "root" -exportcert
  keytool -keystore keystore1 -storepass PASSWORD -rfc -file alias.ca3.pem -alias "ca3" -exportcert
  keytool -keystore keystore1 -storepass PASSWORD -rfc -file alias.long.pem -alias "long" -exportcert
  keytool -keystore keystore1 -storepass PASSWORD -rfc -file alias.short.pem -alias "short" -exportcert
  openssl pkcs12 -export -out keystore.p12 -inkey key.pem -in alias.short.pem -passout pass:PASSWORD
  keytool -changealias -alias "1" -destalias "short" -keypass PASSWORD -keystore keystore.p12 -storepass PASSWORD
  openssl pkcs12 -export -out keystore2.p12 -inkey key.pem -in alias.long.pem -passout pass:PASSWORD
  keytool -changealias -alias "1" -destalias "long" -keypass PASSWORD -keystore keystore2.p12 -storepass PASSWORD
  keytool -importkeystore -srckeystore keystore2.p12 -srcstoretype pkcs12 -srcstorepass PASSWORD -destkeystore keystore.p12 -deststoretype pkcs12 -deststorepass PASSWORD
  keytool -keystore keystore.p12 -storepass PASSWORD -file alias.ca3.pem -alias "ca3" -importcert -noprompt
  keytool -keystore keystore.p12 -storepass PASSWORD -file alias.root.pem -alias "root" -importcert  -noprompt
  keytool -keystore keystore.p12 -storepass PASSWORD -list
  </code></pre>
  
  <p>I imagined for instance if I could set the alias while importing a private keyed certificate then I would not need rename the alias' afterwards. Is that possible? </p>
  
  <p>At any rate thanks in advance</p>