I'm writing a Java 8 application and want to set up a simple keystore and truststore using a self-signed certificate.
Normally this goes as follows:
- Create a keypair + certificate using
openssl
. - Create a .jks keystore + .jks truststore using
keytool
Now I'd like to only use openssl
and create .p12 keystores instead of .jks keystores.
Creating a .p12 keystore works great using the following commands:
# Create private key and certificate
openssl req -x509 -newkey rsa:"${rsa}" -sha256 \
-keyout "${key}" \
-out "${cert}" \
-days "${days}"
# Create .p12 keystore
openssl pkcs12 -export -in "${cert}" -inkey "${key}" -out "${keystore}"
This keystore seems to be working correctly, as providing a corresponding .jks trustore in my Java application will get the TLS connection going. However I can't get a .p12 truststore working.
I tried creating the truststore as suggested here:
# Create .p12 truststore
openssl pkcs12 -export -nokeys -in "${cert}" -out "${truststore}"
and then loading it like this:
FileInputStream fis = new FileInputStream(new File(trustorePath));
KeyStore trustStore = KeyStore.getInstance("PKCS12");
trustStore.load(fis, truststorePassword.toCharArray());
fis.close();
but I receive the following exception in my java code:
Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
Any ideas what I'm doing wrong?
(A working snippet using .p12 truststore with Java 8 would be greatly appreciated.)
keytool
may be an easier tool to use.