Merge 2 .jks truststore files

java security keytool jks
nikkatsa picture nikkatsa · Nov 11, 2013 · Viewed 29.6k times · Source

I am using a Tomcat that is SSL enabled, using truststores for client authentication.

I have two .jks trustore files.

The first, I use it for the PROD environment and the other for the TEST environment client certificates.

I deploy the web application, on a Tomcat and until now i was setting one of the above files in the configuration (according to the environment).

Is it possible i can merge those files into one .jks truststore that will accept client certificates both for PROD and TEST environments?

I need to mention that i have the passwords for both truststores.

Thanks!

Answer

Jcs picture Jcs · Dec 20, 2013

You can use the -importkeystore option of keytool to import an entry from one keystore/truststore to another:

keytool -importkeystore -srckeystore test.jks -destkeystore common.jks -srcalias myRootCA -destalias myRootCA_TEST -srcstorepass **** -deststorepass ****
keytool -importkeystore -srckeystore prod.jks -destkeystore common.jks -srcalias myRootCA -destalias myRootCA_PROD -srcstorepass **** -deststorepass ****

The common.jks will then contain both CA to validate the client certificates. However, the application may also need to be reconfigured.

Related questions

Imported certificate to Java keystore, JVM ignores the new cert

I'm trying to get an application running on top of Tomcat 6 to connect to an LDAP server over SSL. I imported certificate of the server to keystore using: C:\Program Files\Java\jdk1.6.0_32\jre\lib\security>keytool -importcert -trustcacerts …

Read More
keytool - see the public and private keys

I created Java keystore programmatically of type jks (i.e. default type). It is initially empty so I created a DSA certificate. keytool -genkey -alias myCert -v -keystore trivial.keystore How can I see the public and private keys? I.…

Read More
Answer password to keytool in batch files

i need use keytool and jarsigner to sign a lot o files here in many folders. Each time i start sign theses files i need delete the .cert and keystore file to recreate it. Im on development enviroment and using …

Read More