Deepak Prasad

Fix keytool Invalid keystore format by matching JKS or PKCS12 storetype to the file, avoiding PEM certificates as keystores, and repairing empty or corrupt keystore paths.

Build a custom PKCS12 Java truststore with keytool for Docker and Kubernetes: RUN importcert in the image, set JAVA_TOOL_OPTIONS with trustStoreType=PKCS12, or use an initContainer with a mounted CA Secret and emptyDir …

Find which Java cacerts file your application actually uses: compare JAVA_HOME, java.home, bundled JRE paths, and javax.net.ssl.trustStore overrides before importing a CA certificate.

Fix Java No subject alternative names present by adding DNS and IP SAN entries with keytool -ext SAN so the certificate matches the hostname or IP clients use.

Fix keytool Failed to establish chain from reply by importing missing intermediate and root CA certificates before the server reply, using the correct keystore alias, or importing a complete PKCS7 chain bundle.

Fix keytool Certificate not imported, alias already exists by listing aliases, deleting or renaming the old entry, and re-importing to the correct keystore with a unique alias.

Fix keytool Input not an X.509 certificate by importing valid PEM, DER, or supported certificate-chain input instead of HTML, private keys, PFX files, or malformed PEM.

Fix java.security.UnrecoverableKeyException: Cannot recover key by aligning keystore and private key passwords in Tomcat, Spring Boot, and KeyManagerFactory.

Fix keytool Keystore was tampered with, or password was incorrect by checking storepass, file path, JKS vs PKCS12, cacerts, import passwords, and corruption.

Enable Spring Boot HTTPS on port 8443 with a PKCS12 keystore from keytool, set server.ssl.key-store in application.properties, add an optional truststore for private CAs, and verify with Java HttpClient.

Enable Tomcat 10 HTTPS on port 8443 with a PKCS12 keystore from keytool: import the CA chain before the server certificate, set certificateKeystoreFile in server.xml, and verify the TLS handshake.

Fix javax.net.ssl.SSLHandshakeException PKIX path building failed by importing your private CA chain into a PKCS12 truststore with keytool, then point the JVM at it with javax.net.ssl.trustStore — without editing …

Generate a private key with keytool -genkeypair, build a CSR with -certreq, sign it with a local OpenSSL CA, and replace the self-signed entry using -importcert on the same alias.

Fix keytool error Public keys in reply and keystore do not match by importing the signed certificate into the same alias that generated the CSR. Verify public-key hashes and distinguish this error from missing CA chain …

Generate a PKCS12 keystore with keytool -genkeypair, add DNS and IP Subject Alternative Names for localhost and 127.0.0.1, verify with keytool -list -v, and see why CN alone fails modern HTTPS hostname checks.

Import a CA or TLS certificate into Java cacerts on Ubuntu, Debian, RHEL, and Rocky Linux with keytool -importcert: locate cacerts, use a copy for safe testing, default password changeit, and distro-specific system trust …

Import a TLS chain into a Java PKCS12 keystore with keytool: root CA and intermediate as trustedCertEntry, server reply on the PrivateKeyEntry alias, correct order, -trustcacerts, and chain verification with keytool …

Compare keytool and OpenSSL for CSR generation, remote certificate inspection with openssl s_client, PEM key handling, PKCS12 creation, Java keystore import, and TLS chain debugging — with a task-by-task table so you …

Rename keystore aliases with keytool -changealias, rotate the store password with -storepasswd, change per-key passwords on JKS (not PKCS12), and remove entries with -delete — with real PKCS12 and JKS output from Ubuntu.

Export a certificate from a Java keystore with keytool -exportcert: DER binary without -rfc, PEM text with -rfc, verify with keytool -printcert and file, and know when the private key is not included.

Use keytool -list and keytool -list -v to read keystore aliases, entry types, SHA-256 fingerprints, certificate expiry, and Subject Alternative Names on PKCS12 files, plus an awk one-liner to spot certificates nearing …

Convert Java JKS keystores to PKCS12 and PKCS12 back to JKS with keytool -importkeystore, understand the proprietary JKS warning, and learn why OpenJDK defaults to PKCS12 since Java 9 (JEP 229).

Import a PKCS12 or PFX bundle into a Java keystore with keytool -importkeystore, use PKCS12 directly as the store type on OpenJDK 9+, merge into an existing keystore, and verify PrivateKeyEntry after import.

keytool cannot import a PEM private key on its own. Learn why -importcert creates trustedCertEntry instead of PrivateKeyEntry, then wrap cert and key with openssl pkcs12 -export and use keytool -importkeystore for a …

A Java keystore holds your TLS identity (private key and certificate chain). A truststore holds CA certificates you trust when validating peers. Learn PrivateKeyEntry vs trustedCertEntry, cacerts vs custom truststore, …

Prefer a custom PKCS12 truststore over editing JDK cacerts: isolate private CA trust per app, survive package upgrades, and set javax.net.ssl.trustStore without touching the global Java CA bundle.

keytool is the Java CLI for keystores and truststores: generate key pairs, build CSRs, import CA-signed certificates and PKCS12 bundles, list aliases, export PEM certs, and manage passwords. This cheat sheet covers …

Fix keytool command not found on Ubuntu by installing OpenJDK (default-jdk or openjdk-21-jdk), set JAVA_HOME and PATH, verify with keytool -help, run a PKCS12 smoke test, update through apt, and uninstall cleanly.

Compare OpenSSL, LibreSSL, and BoringSSL for TLS and cryptography: intended audience, API stability, FIPS, how Linux distributions package each library, and when each is the right choice—with commands to verify what your …

OpenSSL is the standard CLI for TLS keys, X.509 certificates, CSRs, chain verification, PKCS#12 bundles, file encryption, and live HTTPS inspection. This cheat sheet covers everyday subcommands with copy-paste tables and …