Can we load multiple Certificates & Keys in a Key Store?

java ssl certificate keystore
Jay picture Jay · Jun 16, 2011 · Viewed 57.3k times · Source

Can we load multiple Certificates & Keys in a Key Store?

Is it always required to load only Pairs (i.e. Certificates & Keys together)?

If a Key Store has multiple Certificates and Keys, which one will get selected when Java SSL tries to establish connection as a Server?

Answer

Bruno picture Bruno · Jun 16, 2011

Although this depends on the KeyStore type, generally, you can store multiple private keys and certificates in a single store.

Which key and certificate combination is used for a Java-based server will depend on how the application was implemented. A number of applications let you select a given certificate using the alias name. The key and certificate getters in KeyStore take an alias parameter to make this choice. Usually, when this is not specified in the configuration, the application or framework will use the first suitable one it finds based on the KeyStore.aliases() enumeration.

Tomcat, for example, uses the keyAlias attribute in its Connector configuration:

keyAlias: The alias used to for the server certificate in the keystore. If not specified the first key read in the keystore will be used.

Regarding key pairs, some KeyStores (again, depending on the type) can be used to store SecretKeys (e.g. DES), that is shared keys, as well as public-private key pairs.

Related questions

Checking certificates expiration dates in java keystore

My java application uses a keystore file in which I have a certificate which is used in ssl connection with active directory server. What I have to do is to check its expiration date and prompt user if its close …

Read More
How to specify outbound certificate alias for HTTPS-calls?

I am calling a webservice that requires client certificate authentication. If I specify a Java keystore containing a single certificate (the client certificate the service expects) then everything works fine. However if I use a keystore that contains multiple certificates …

Read More
Java/Keystore Verify Signed certificate

I'm working on a client-cert authentication between a embedded jetty server and a client. They both use keystore. The client certificate is signed by the server's certificate which is signed by a CA. Jetty use 2 method to authenticate a client …

Read More