Transfer trusted certificate (plus private key / chain) from Java keystore (jks) to Windows Certificate Manager

1
votes

Some quick background on what I'm trying to do: a client is using a third party web service that requires mutual authentication. The service requires the client certificate be signed by a public certificate authority (ie: not self-signed). The client has some software written in Java that connects to the service, hence they used Java keytool to generate the original signing request and the key/certificate are stored in a jks keystore.

Our software that the client is going to be using is written in C#/.NET and will need to connect to the third party web service. As such we will we need to be able to access the client certificate.

I can't seem to find any way to export the certificate (along with private key) to either the Windows Certificate Manager or some other format that can be opened by .NET security libraries.

Exporting to a PKCS12 file does not work because keytool does not support it for trusted certificates (not sure if that is a keytool limitation or a limitation of the format).

I also found some Java code for getting the private keys, but I can't seem to figure out how I can get that into Windows Certificate Manager and associate it with the certificate. (How do I list / export private keys from a keystore?)

As a side note, the client doesn't want to generate a new certificate as there is a whole process involved in sending it to and getting it approved by the third party service they are connecting to.

Ultimately I'm hoping there are some commands I can run with keytool/openssl/etc that will allow the certificate & key to be exported/transferred into the Windows Certificate Manager (or some format that it can import).

(Sorry if my terminology is off or if some of this doesn't make sense. I kind of got stuck supporting this despite not being all that familiar with managing certificates.)

1
javasslssl-certificatex509certificatekeystore
Why do you need the client's private key? Your service should only require the client's public certificate. – Warren Dew
@Warren, I'm not the service in this instance I'm the client (the customer already has a client written in Java, and we are also making a client in .NET). The .NET client needs access to the private key (ideally stored in the Windows Cert Manager along with the certificate) in order to sign requests going out to the service. – Helpy Helperson
Okay, the question makes more sense now. What error do you get when you export to a PKCS12 file? If you could provide both the command you used and the error, that would help. Also you might provide the output when you try the keytool command here, if that command is different: stackoverflow.com/questions/2640691/… – Warren Dew
@Warren, thanks for the suggestion. Using this command seems to successfully export the certificate with private key: "keytool -v -importkeystore -srckeystore keystore -srcalias alias -destkeystore exportedcert.p12 -deststoretype PKCS12" They had previously tried the command without the -srcalias which produced a "java.security.KeyStoreException: TrustedCertEntry not supported" error. Presumably because you cannot export the entire trust chain. Not entirely sure if the cert without the chain will work for the client authentication (I'll have customer try it out and see). – Helpy Helperson

1 Answers

1
votes

This seems to work for exporting the certificate but not the entire chain, the trick is to specify the srcalias: 

keytool -v -importkeystore -srckeystore .keystore -srcalias mykey -destkeystore myp12file.p12 -deststoretype PKCS12

Thanks to Warren for pointing me to this: How to export private key from a keystore of self-signed certificate