how to change PKCS12 keystore password using keytool?

keytool pkcs#12
Tamal Kanti Nath picture Tamal Kanti Nath · Jul 5, 2015 · Viewed 28.4k times · Source

I cannot change PKCS keystore password using keytool (java 8). When I tried to change the key password:

keytool -keypasswd -keystore keystore.p12 -storetype PKCS12 -storepass oldpass -keypass oldpass -new newpass
keytool error: java.lang.UnsupportedOperationException: -keypasswd commands not supported if -storetype is PKCS12

It means key password cannot be changed for PKCS12 keystore. Then I tried to change the keystore password:

keytool -storepasswd -keystore keystore.p12 -storetype PKCS12 -storepass oldpass -new newpass
Warning:  Different store and key passwords not supported for PKCS12 KeyStores. Ignoring user-specified -new value.
keytool error: java.io.FileNotFoundException: keystore.p12 (Access is denied)

It means, we have to change keystore password and keypassword together. But there is no command to change both. What can I do?

Answer

Saqib Rezwan picture Saqib Rezwan · Jul 9, 2015

You can import the PKCS12 file to another PKCS12 where you can give new password for new PKCS12 file. Then you can use the new PKCS12 file or delete the previous one and rename the new file name with the old file name. Its not a straight forward way, but it fulfills the objective.A sample code is given bewlow

keytool -importkeystore -srckeystore DocCA.p12 -srcstoretype PKCS12 -srcstorepass 123456 -destkeystore DocCA2.p12 -deststoretype PKCS12 -deststorepass 11223344

Here, DocCA.p12 is the existing PKCS12 with password 123456 which is exported in the DocCA2.p12 file with password 11223344.

Related questions

How to create a certificate into a PKCS12 keystore with keytool?

I wanted to create a certificate into a PKCS12 keystore format with keytool program. The keystore has extension .pfx. How do I achieve this?

Read More
What causes keytool error "Failed to decrypt safe contents entry"?

I am trying to convert a standard PKCS #12 (.p12) key store into a Java JKS key store with this command: keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore keystore.jks It is failing with: keytool error: java.io.…

Read More
keytool -list shows different aliases for p12 keystore, depending on whether you provide the password

Really weird behaviour on a particular p12 file. If I run keytool -list -storetype pkcs12 -keystore my_debug_keystore.p12 -storepass debug keytool -v -list -storetype pkcs12 -keystore my_debug_keystore.p12 -storepass debug I get, Alias name: 1 Creation date: …

Read More