What causes keytool error "Failed to decrypt safe contents entry"?

Question

I am trying to convert a standard PKCS #12 (.p12) key store into a Java JKS key store with this command:

keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore keystore.jks

It is failing with:

keytool error: java.io.IOException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded

Do you have any idea how to solve this problem?

It looks like your PCKS#12 keystore is corrupt. Can you verify it with `openssl pkcs12 ...`? — user207421, Apr 27 '12 at 00:18

score 49 · Answer 1 · answered Dec 04 '13 at 18:45

49

Sometimes this error is symptomatic of using an incorrect password for the p12 key.

answered Dec 04 '13 at 18:45

William Grand

1,033
2
12
24

1

The pkcs12 keystore type doesn't differentiate between keypass and storepass. So in my case I just had to use the storepass (and not the keypass) when retrieving the key... – Lonzak Oct 13 '16 at 08:23
I used the wrong password because WebSphere is using a different default password than most Java trust stores. – Ryan D Aug 23 '18 at 18:10
That's what it was for me. Jesus, took me a while to get this to work. – amorimluc Dec 11 '19 at 02:50

score 15 · Accepted Answer · answered Apr 27 '12 at 10:03

15

The pkcs12 keystore was corrupt indeed.

answered Apr 27 '12 at 10:03

Pedro Rolo

28,273
12
60
94

score 8 · Answer 3 · edited May 23 '17 at 12:34

I've never attempted to do this before, but I did find instructions on google here.

This thread asks a similar question.

EDIT (Based on comment)

Here is the full content of the linked reference:

PFX/P12 to JKS (Java KeyStore)

Question: How do I move a certificate from IIS / PFX (.p12 file) to a JKS (Java KeyStore)?

Answer: keytool -importkeystore -srckeystore PFX_P12_FILE_NAME -srcstoretype pkcs12 -srcstorepass PFX_P12_FILE -srcalias SOURCE_ALIAS -destkeystore KEYSTORE_FILE -deststoretype jks -deststorepass PASSWORD -destalias ALIAS_NAME

Note: To find the srcalias, list the contents of the PFX/P12 file:

keytool -v -list -storetype pkcs12 -keystore PFX_P12_FILE > FILENAME.TXT As this writes the output of the command to a file with the name of FILENAME.TXT.

score 7 · Answer 4 · answered Jun 12 '21 at 00:24

7

I had the same problem i entered the password manually and problem got resolved

answered Jun 12 '21 at 00:24

Mohd. Shaizad

91
1
4

score 4 · Answer 5 · answered Apr 24 '18 at 14:33

I had a similar issue when i was trying to export certs as pfx from JKS.It worked when i excluded deststorepass attribute in keytool command & gave the destination store password at runtime.

keytool -importkeystore -srckeystore Keystore.jks -destkeystore dv163.pfx -srcstoretype JKS -deststoretype PKCS12 -srcalias alias1-destalias alias1

Enter destination keystore password:

Re-enter new password:

Enter source keystore password:

score 3 · Answer 6 · answered Oct 21 '15 at 09:54

I had the same issue today(BadPaddingException). It seems keytool had a problem with certain characters in the password. I solved it by adding double-quotes around the password.

keytool -importkeystore -srckeystore PFX_P12_FILE_NAME -srcstoretype pkcs12 -srcstorepass "PFX_P12_FILE" -srcalias SOURCE_ALIAS -destkeystore KEYSTORE_FILE -deststoretype jks -deststorepass "PASSWORD" -destalias ALIAS_NAME

score 2 · Answer 7 · answered Jan 02 '14 at 00:47

I did this command (opposite to yours) to export a private key to PKCS12 from a JKS:

keytool -importkeystore -srckeystore DemoIdentity.jks -srcstoretype JKS -destkeystore demoidentity.p12 -deststoretype PKCS12

If I left off the seemingly redundant "-srcstoretype JKS", the generated demoidentity.p12 file gave me the same error when I tried to list the details in keytool even though the above command accepted the passwords and generated a file seemingly correctly!

For your issue, perhaps you did something similar when generating keystore.p12.

I think you're on to something. Probably keytool assume the original key is something else. — not2qubit, Apr 02 '19 at 13:07

Slava Vasylenko · Answer 8 · 2020-12-02T07:27:00.030

0

From my side I forget to check language when you type password :)

edited Dec 02 '20 at 07:27

answered Dec 01 '20 at 15:50

Slava Vasylenko

838
1
9
14

Miguel Tomás · Answer 9 · 2021-07-07T15:37:15.500

0

simply type the correct password on the build signed APK wizard form. ( it worked with me on android studio 4.2 canary 15++)

As I came to find out, when you change app on said wizard, spite the password remains, somehow it does not sign correctly, so you need to clear the password and type it again.

edited Jul 07 '21 at 15:37

answered Jul 06 '21 at 12:36

Miguel Tomás

1,714
1
13
23

What causes keytool error "Failed to decrypt safe contents entry"?

9 Answers9

Linked