KSE Manual - Key Pairs (2024)

A Key Pair contains a private key and its associated certificate chain. KeyPairs can be used to digitally sign objects such as Java applications. Key Pairentries are represented in KeyStore Explorer by the following icon:

As the private key part of the Key Pair should remain secret, Key Pair entriesare normally protected by a password. In KeyStore Explorer such entries aredescribed as being locked and have a closed padlock displayed againstthem:

To access the private key the entry must be unlocked (see next chapter)by supplying the correct password. If an entry is successfully unlocked thenan open padlock is displayed against it:

If a Key Pair entry is unlocked once during a KeyStore Explorer session it does not need to be unlocked again. A Key Pair entry may be unlocked explicitly or as part of an operation that requires the private key.

A Key Pair must be unlocked to utilize it for operations such as digital signing or to view or export the private key.

Unlock a Key Pair

To unlock a Key Pair:

Right-click on the Key Pair entry in the KeyStore Entries table. Select Unlock from the pop-up menu.
The Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Key Pair entry's lock status will be changed to unlocked in the KeyStore Entries table.

View a Key Pair's Certificate Chain

To view a Key Pair's certificate chain:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the View Details sub-menu from the pop-up menu and from there choose Certificate Chain Details. Alternatively, double-click the Key Pair entry.
The Certificate Details dialog will appear. After viewing the details close the dialog by pressing the OK button.

View a Key Pair's Private Key

To view a Key Pair's private key:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the View Details sub-menu from the pop-up menu and from there choose Private Key Details.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Private Key Details dialog will appear. After viewing the details close the dialog by pressing the OK button.

View a Key Pair's Public Key

To view a Key Pair's public key:

Generate a Key Pair

To generate a Key Pair:

From the Tools menu, choose Generate Key Pair. Alternatively click on the Generate Key Pair tool bar button:
The Generate Key Pair dialog will be displayed. Select an Algorithm and a Key Size and press the OK button.
The Generating Key Pair dialog will be displayed and will remain visible until Key Pair generation has completed. For larger key sizes this may be quite some time.
The Generate Key Pair Certificate dialog will be displayed.
Select a Version and Signature Algorithm and enter a Validity Period, Serial Number and Name.
Optionally, for a version 3 certificate, add certificate extensions by clicking on the Add Extensions button.
Press the OK button.
The New Key Pair Entry Alias dialog will be displayed.
Enter the alias for the new Key Pair entry and press the OK button.
If required the New Key Pair Entry Password dialog will be displayed. Enter the password with which to protect the new Key Pair entry, confirm it and press the OK button.
The new Key Pair entry will appear in the KeyStore Entries table.

Generate a CSR

To generate a CSR for a Key Pair:

Right-click on the Key Pair entry in the KeyStore Entries table. Select Generate CSR from the pop-up menu.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Generate CSR dialog is displayed. Select a Format and Signature Algorithm and enter a Challenge.
For PKCS#10 format you can optionally enter a company name (which becomes an "unstructuredName" attribute in the request) and/or add the extensions from the certificate to the request. The latter is useful for SSL certificates with SubjectAlternativeName extensions.
Use the Browse button to select a CSR File.
Press the OK button to commence generation and produce the CSR.

Import a CA Reply

To import a CA Reply into a Key Pair:

Select the drive and folder where the CA Reply file is stored.
Click on the required CA Reply file or type the filename into the File Name text box.
Click on the Import button.
If the Import CA Reply Trust Check is enabled and the CA Reply file contains a single certificate:

If KeyStore Explorer can establish a trust path between the certificate and an existing self-signed Trusted Certificate in your KeyStore or the Authority Certificates then the import will continue. Otherwise it will fail at this point.

Alternatively if the Import CA Reply Trust Check is enabled and the CA Reply file contains a chain of certificates:

KeyStore Explorer will attempt to match the reply's root CA to an existing Trusted Certificate in your KeyStore or the Authority Certificates.
If it cannot then the Certificate Details dialog will appear displaying the details of the reply's root CA certificate for you to verify.
After viewing the details close the dialog by pressing the OK button.
A further dialog will appear asking if you wish accept the certificate.
Press the Yes button if you wish to trust the certificate and import the CA Reply and No if you do not. If you reply No the import will fail at this point.

The Key Pair entry will be updated to reflect the content of the CA Reply.

Get a Key Pair Signed by a CA (Certificate Authority)

To get a Key Pair signed by a CA:

First create a new KeyStore.
Either import an existing Key Pair into the KeyStore or generate a new Key Pair in the KeyStore.
Next generate a CSR (Certificate Signing Request) file from the Key Pair.
Send the CSR file to a CA for signing. Each CA has different procedures for signing certificates and will charge a fee. Check the CA's web site for details.
The CA will send back a CA Reply. This will most likely take the form of a file with the extension p7r or cer.
Import the CA Reply into the original Key Pair.
The Key Pair has now been signed by the CA. View the Key Pair's certificate chain. Your certificate, at the end of the chain, will contain the CA's details in the issuer field.
Finally save the KeyStore.

Append to Certificate Chain

To append a certificate to the end of a Key Pair's Certificate Chain:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Edit Certificate Chain sub-menu from the pop-up menu and from there choose Append Certificate.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Append Certificate dialog will appear.
Select the drive and folder where the certificate file to be appended is stored.
Click on the required certificate file or type the filename into the File Name text box.
Click on the Append button.
For the append to succeed, the chosen certificate's private key must have been used to sign the end certificate of the chain. An indication that this is the case is if the chosen certificate's subject is identical to the end certificate's issuer.
If the append is successful the Key Pair entry's certificate chain will be updated to include the appended certificate.

Remove from Certificate Chain

To remove a certificate from the end of a Key Pair's Certificate Chain:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Edit Certificate Chain sub-menu from the pop-up menu and from there choose Remove Certificate.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
For the removal to succeed, certificate chain must contain more than one certificate.
If the removal is successful the Key Pair entry's certificate chain will be updated to remove the end certificate.

Import a Key Pair

A Key Pair can be imported from a variety of source formats.

Import a Key Pair from PKCS #12

To import a Key Pair from PKCS #12:

From the Tools menu, choose Import Key Pair. Alternatively click on the Import Key Pair tool bar button:
The Import Key Pair Type dialog will appear.
Select the PKCS #12 radio button and press the OK button.
The Import PKCS #12 Key Pair dialog will appear.
Enter the decryption password for the PKCS #12 file into the Decryption Password field.
Use the Browse button to select the PKCS #12 key pair file and the Details button to examine your choice.
If after examination you decide to import the Key Pair press the Import button. Otherwise use the Cancel button to halt the import.
The New Key Pair Entry Alias dialog will be displayed.
Enter the alias for the new Key Pair entry and press the OK button.
If required the New Key Pair Entry Password dialog will be displayed. Enter the password with which to protect the new Key Pair entry, confirm it and press the OK button.
The new Key Pair entry will appear in the KeyStore Entries table.

Import a Key Pair from PKCS #8 and Certificates

To import a Key Pair from PKCS #8 and Certificates:

Import a Key Pair from PVK and Certificates

To import a Key Pair from PVK and Certificates:

From the Tools menu, choose Import Key Pair. Alternatively click on the Import Key Pair tool bar button:
The Import Key Pair Type dialog will appear.
Select the PVK radio button and press the OK button.
The Import PVK Key Pair dialog will appear.
If the PVK private key file is unencrypted then uncheck the Encrypted Private Key check box.
Alternatively if the PVK private key file is encrypted enter the decryption password into the Decryption Password field.
Use the Browse buttons to select private key and certificates files and the Details buttons to examine your choices.
If after examination you decide to import the Key Pair press the Import button. Otherwise use the Cancel button to halt the import.
The New Key Pair Entry Alias dialog will be displayed.
Enter the alias for the new Key Pair entry and press the OK button.
If required the New Key Pair Entry Password dialog will be displayed. Enter the password with which to protect the new Key Pair entry, confirm it and press the OK button.
The new Key Pair entry will appear in the KeyStore Entries table.

Import a Key Pair from OpenSSL and Certificates

To import a Key Pair from OpenSSL and Certificates:

From the Tools menu, choose Import Key Pair. Alternatively click on the Import Key Pair tool bar button:
The Import Key Pair Type dialog will appear.
Select the OpenSSL radio button and press the OK button.
The Import OpenSSL Key Pair dialog will appear.
If the OpenSSL private key file is unencrypted then uncheck the Encrypted Private Key check box.
Alternatively if the OpenSSL private key file is encrypted enter the decryption password into the Decryption Password field. The supported PBE encryption algorithms for import are:

PBE with DES CBC
PBE with DESede CBC
PBE with 128 bit AES CBC
PBE with 192 bit AES CBC
PBE with 256 bit AES CBC

Use the Browse buttons to select private key and certificates files and the Details buttons to examine your choices.

If after examination you decide to import the Key Pair press the Import button. Otherwise use the Cancel button to halt the import.

The New Key Pair Entry Alias dialog will be displayed.

Enter the alias for the new Key Pair entry and press the OK button.

If required the New Key Pair Entry Password dialog will be displayed. Enter the password with which to protect the new Key Pair entry, confirm it and press the OK button.

The new Key Pair entry will appear in the KeyStore Entries table.

Export a Key Pair

Export a Key Pair as PKCS #12

To export a Key Pair as PKCS #12:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Export sub-menu from the pop-up menu and from there choose Export Key Pair.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Export Key Pair dialog is displayed.
Enter an PKCS #12 Password to protect the exported PKCS #12 file with and confirm it.
Use the Browse button to select an Export File.
Press the Export button to commence the export.

Export a Key Pair's Certificate Chain

To export a Key Pair's certificate chain:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Export sub-menu from the pop-up menu and from there choose Export Certificate Chain.
The Export Certificate Chain dialog is displayed.
Use the Export Length radio buttons to choose whether the Entire Chain of certificates should be exported or the Head Only. The X.509 export format is not available when the entire chain is to be exported.
Select an Export Format. The options available are:

X.509 ITU-T standard for public key infrastructure.
PKCS #7 RSA public key cryptography standard.
PKI Path Certification path.
SPC Software Publisher Certificate, Microsoft's certificate format.

Check the PEM checkbox if the exported certificate is to be PEM encoded. PEM encoding is not available for PKI Path and SPC format exports.

Use the Browse button to select an export file.

Press the Export button to commence the export.

Export a Key Pair's Private Key

Export a Key Pair's Private Key as PKCS #8

To export a Key Pair's private key as PKCS #8:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Export sub-menu from the pop-up menu and from there choose Export Private Key.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Export Private Key Type dialog will appear.
Select the PKCS #8 radio button and press the OK button.
The Export Private Key as PKCS #8 dialog is displayed.
If the exported PKCS #8 private key file is to be unencrypted then uncheck the Encrypt check box.
Alternatively if the PKCS #8 private key file is to be encrypted select an Encryption Algorithm and enter and confirm an Encryption Password. The supported PBE encryption algorithms for export are:

PBE with SHA-1 and 2 key DESede
PBE with SHA-1 and 3 key DESede
PBE with SHA-1 and 40 bit RC2
PBE with SHA-1 and 128 bit RC2
PBE with SHA-1 and 40 bit RC4
PBE with SHA-1 and 128 bit RC4

Check the PEM checkbox if the exported private key is to be PEM encoded.

Use the Browse button to select an export file.

Press the Export button to commence the export.

Export a Key Pair's Private Key as PVK

To export a Key Pair's private key as PVK:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Export sub-menu from the pop-up menu and from there choose Export Private Key.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Export Private Key Type dialog will appear.
Select the PVK radio button and press the OK button.
The Export Private Key as PVK dialog is displayed.
Select a Key Type of Exchange or Signature.
If the exported PVK private key file is to be unencrypted then uncheck the Encrypt check box.
Alternatively if the PVK private key file is to be encrypted select an Encryption Strength (Strong or Weak) and enter and confirm an Encryption Password.
Use the Browse button to select an export file.
Press the Export button to commence the export.

Note: DSA private keys are not suitable for the purposes ofExchange. For the PVK export of DSA Key Pairs the Key Type optionsare disabled and Signature is pre-selected.

Export a Key Pair's Private Key as OpenSSL

To export a Key Pair's private key as OpenSSL:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Export sub-menu from the pop-up menu and from there choose Export Private Key.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The Export Private Key Type dialog will appear.
Select the OpenSSL radio button and press the OK button.
The Export Private Key as OpenSSL dialog is displayed.
If the exported OpenSSL private key file is to be unencrypted then uncheck the Encrypt check box.
Alternatively if the OpenSSL private key file is to be encrypted select an Encryption Algorithm and enter and confirm an Encryption Password. The supported PBE encryption algorithms for export are:

PBE with DES CBC
PBE with DESede CBC
PBE with 128 bit AES CBC
PBE with 192 bit AES CBC
PBE with 256 bit AES CBC

Check the PEM checkbox if the exported private key is to be PEM encoded. When a private key is to be encrypted it must also be PEM encoded.

Use the Browse button to select an export file.

Press the Export button to commence the export.

Export a Key Pair's Public Key as OpenSSL

To export a Key Pair's public key as OpenSSL:

Right-click on the Key Pair entry in the KeyStore Entries table. Select the Export sub-menu from the pop-up menu and from there choose Export Public Key.
The Export Public Key as OpenSSL dialog is displayed.
Check the PEM checkbox if the exported public key is to be PEM encoded.
Use the Browse button to select an export file.
Press the Export button to commence the export.

Drag Export a Key Pair

To drag export a Key Pair:

Ensure the Key Pair entry is unlocked.
Select the Key Pair entry for dragging by pressing and holding the left mouse button over it in the KeyStore entries table.
Use the mouse to drag the entry to the desired export location. For example: the desktop, a folder or a text editor.
Release the left mouse button over the export location.
The entry will be exported. The export format used depends on the export location:

When exporting as a file the export format is PKCS #12. This is applicable when the entry is dragged to the desktop or to a folder.
When exporting as text the export is in two parts. The private key is exported as Encrypted PKCS #8 PEM and the certificate chain is exported as PKCS #7 PEM. This is applicable when the entry is dragged to an application that deals with text.

Exports that are password protected inherit the password of the originating Key Pair entry.

Set a Key Pair's Password

To set a Key Pair entry's password:

Right-click on the Key Pair entry in the KeyStore Entries table. Select Set Password from the pop-up menu.
The Set Key Pair Entry Password dialog will appear.
Complete the dialog's fields with the old password, new password and new password confirmation. If the Key Pair Entry is unlocked then the old password field will already be completed.
Press the OK button to confirm the dialog.

Cut and Paste a Key Pair

To cut and paste a Key Pair:

Click on the Key Pair entry to select it.
From the Edit menu, choose Cut. Alternatively click on the Cut tool bar button:
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
Select the target KeyStore by clicking on its tab.
From the Edit menu, choose Paste. Alternatively click on the Paste tool bar button:
The Key Pair entry will appear in the target KeyStore Entries table. The Key Pair entry's password will remain unchanged.

Notes:

KeyStore Explorer has an internal clipboard for cut, copy and paste operations called the buffer. Therefore KeyStore entries cannot be cut or copied from KeyStore Explorer to other applications and vice versa.

Copy and Paste a Key Pair

To copy and paste a Key Pair:

Click on the Key Pair entry to select it.
From the Edit menu, choose Copy. Alternatively click on the Copy tool bar button:
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
If copying to a different KeyStore select it by clicking on its tab.
From the Edit menu, choose Paste. Alternatively click on the Paste tool bar button:
A copy of the Key Pair entry will appear in the target KeyStore Entries table. The Key Pair entry's password will be the same as the original's.

Notes:

KeyStore Explorer has an internal clipboard for cut, copy and paste operations called the buffer. Therefore KeyStore entries cannot be cut or copied from KeyStore Explorer to other applications and vice versa.

Delete a Key Pair

To delete a Key Pair:

Right-click on the Key Pair entry in the KeyStore Entries table. Select Delete from the pop-up menu.
The Key Pair entry will be removed from the KeyStore Entries table.

Rename a Key Pair

To rename a Key Pair:

Right-click on the Key Pair entry in the KeyStore Entries table. Select Rename from the pop-up menu.
If required the Unlock Entry dialog will be displayed. Enter the Key Pair entry's password and press the OK button.
The New Entry Alias dialog will appear.
Enter the new alias into the dialog and acknowledge it by pressing the OK button.
The Key Pair entry will be renamed in the KeyStore Entries table.

FAQs

How to get the private key from KeyStore? ›

How to export private key and public key from keystore

Export the private key from pkcs12 format keystore.
openssl pkcs12 -in keystore_name.p12 -nodes -nocerts -out private.key.
Export the public certificate from pkcs12 format keystore.
openssl pkcs12 -in keystore_name.p12 -nokeys -out public-cert-file.

Read On ›

What is a secret key in KeyStore? ›

A Secret Key entry contains a single symmetric cryptographic key. Key entries are represented in KeyStore Explorer by the following icon: Key entries are protected by a password.

Discover More Details ›

How to generate keys using KeyStore Explorer? ›

To create a new KeyStore:

From the File menu, choose New. Alternatively click on the New tool bar button:
The New KeyStore Type dialog is displayed. Select the desired KeyStore Type using the radio buttons:
Press the OK button.
The new KeyStore will appear as an additional Untitled tab.

How do I add a key pair to my KeyStore? ›

To import an existing key pair:

Build the certificate chain and convert the private key and certificate files into a PKCS12 file. ...
Import the PKCS12 file into Java keystore: keytool -importkeystore -srckeystore server.p12 -destkeystore store.keys -srcstoretype pkcs12 -alias shared.

More items...

See Details ›

How do I extract a private key? ›

Information

Download and extract the Win32 OpenSSL package to C:\ ...
Open a command prompt, and move to the OpenSSL-Win32\bin directory, using: cd C:\OpenSSL\bin.
Execute the following command to export Private Key file: openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]

More items...

Find Out More ›

What is the difference between keystore and private key? ›

Private keys: Keystores store private keys that perform cryptographic operations, such as creating digital signs, decrypting information, and establishing secure connections. Digital Certificates: Certificates, including public keys and information about the certificate holder, are stored in keystores.

Tell Me More ›

What is the difference between a secret key and a private key? ›

A private key, also known as a secret key, is a variable in cryptography that is used with an algorithm to encrypt and decrypt data. Secret keys should only be shared with the key's generator or parties authorized to decrypt the data.

Show Me More ›

What is the difference between access key and secret key? ›

AWS access key ID is a form of unique user/account identifier. AWS secret key is like private key. When AWS CLI sends a API request, the payload is signed by generating an HMAC with the secret key as the key.

Explore More ›

What is the difference between secret key and shared key? ›

Secret Key Agreement via Public Key

By adding both random numbers together, each party will have an agreed-upon shared secret key, which can then be used for secure communication even though the secret key was first obtained through a nonsecure communication channel.

How do I open a keystore without a password? ›

The keystore can be manipulated using the keytool in the Java sdk. Try executing the keytool on your keystore, and extract the certificates with the empty password. After that, import it into a new keystore.

Show Me More ›

What is the difference between keystore and TrustStore? ›

The KeyStore is used by the adapter for client authentication, while the TrustStore is used to authenticate a server in SSL authentication. A KeyStore consists of a database containing a private key and an associated certificate, or an associated certificate chain.

Read The Full Story ›

How do I generate my upload key keystore? ›

Create an upload key and update keystores

Follow the instructions on the Android Developers site. Store your key in a safe place.
Export the certificate for the upload key to PEM format. ...
When prompted during the release process, upload the certificate to register it with Google.

See Details ›

How do I create a new key pair? ›

To create a key pair

In the navigation pane, under Network & Security, choose Key Pairs. On the Key Pairs page, choose Create Key Pair. For Key pair name, type a name that is easy for you to remember, and then choose Create. When the console prompts you to save the private key file, save it in a safe place.

Get More Info Here ›

How to generate key file from keystore? ›

Use private key to generate a p12 keystore then convert it to jks keystore:

openssl pkcs12 -export -in user. pem -inkey user. key -certfile user. pem -out testkeystore. p12.
keytool -importkeystore -srckeystore testkeystore. p12 -srcstoretype pkcs12 -destkeystore wso2carbon. jks -deststoretype JKS.

Dec 20, 2018

What is my key alias in keystore? ›

A key alias is a label for specific key within a keystore. Key aliases are created using your third-party certificate management tool.

How do I find my private certificate key? ›

Locating a private key in Windows

Open Microsoft Management Console.
In the Console Root, expand Certificates (Local Computer)
Locate the certificate in the Personal or Web Server folder.
Right click the certificate.
Select Export.
Follow the guided wizard.

Aug 19, 2022

View Details ›

How do I get my private key? ›

Your private key is generated by your wallet and is used to create your public key (your wallet address) using encryption. You can view your private key using your wallet.

Does JKS contain a private key? ›

Generally, a JKS type of key store can have only one private key entry in a key store file. Some key store types, allow having multiple private key entries in a single key store. Along with the private key entry, a certificate chain for the corresponding public key entry also will be there.

Learn More ›

How do I get a private key from certificate keychain? ›

Using a Mac with the distribution certificate installed:

Open Keychain Access (Application -> Utilities)
Click on My Certificates.
Find the certificate, it'll be named iPhone Distribution: Your Company Name.
Expand the certificate using the Reveal More arrow.
Select both the certificate and the private key.

More items...

Discover More Details ›