Can not get key from KeyStore

Question

I try to get Key from KeyStore. I created a keystore by Keytool:

keytool -genkeypair -dname "cn=Mark Jones, ou=JavaSoft, o=Sun, c=US" -alias business2 -keypass abcdtest -keystore C:\workspace\XMLSample\keystore\mykeystore.jks -storepass 123456

And the following is GenerateXML.java

import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import javax.xml.crypto.dsig.XMLSignContext;
import javax.xml.crypto.dsig.XMLSignatureFactory;
import javax.xml.crypto.dsig.dom.DOMSignContext;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;

public class GenerateXML {

    public static void main(String[] args) throws Exception {

        try {
            char[] passwd = "123456".toCharArray();

            //Load the KeyStore and get the signing key and certificate
            KeyStore ks = KeyStore.getInstance("JKS");
            ks.load(new FileInputStream("C:\\workspace\\XMLSample\\keystore\\mykeystore.jks"), passwd);
            KeyStore.PrivateKeyEntry keyEnt = (KeyStore.PrivateKeyEntry)ks.getEntry("business2", new KeyStore.PasswordProtection(passwd));   // -> ERROR IN THIS ROW

            X509Certificate cert = (X509Certificate)keyEnt.getCertificate();

            //Create a DOMSignContext
            XMLSignContext context = new DOMSignContext(keyEnt.getPrivateKey(), doc.getDocumentElement()) ;

            //Create a DOM XMLSignatureFactory
            XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");

        } catch(Exception e) {
            e.printStackTrace();
            throw new Exception(e.toString());
        }
    }
}

I run on Java 1.6

But have error:

java.security.UnrecoverableKeyException: Cannot recover key
at sun.security.provider.KeyProtector.recover(KeyProtector.java:311)
at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:121)
at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:38)
at java.security.KeyStoreSpi.engineGetEntry(KeyStoreSpi.java:456)
at java.security.KeyStore.getEntry(KeyStore.java:1261)
at xml.generate.GenerateXML.main(GenerateXML.java:31)

score 27 · Answer 1 · answered Jun 23 '11 at 20:17

I've run accross the similar issue. The root of the problem was that I used a different password for the key than for the whole keystore. The code is similar to the one in the JSSE article. It looks like this:

serverKeyStore.load(new FileInputStream("resource/server.jks"), passphrase.toCharArray());
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
tmf.init(serverKeyStore);
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(serverKeyStore, keyphrase.toCharArray());

I use the keystore pass in the first line and the key pass in the last.

You can also change the password in for the key http://stackoverflow.com/a/2889605/2685402 — Wojtek, Sep 28 '14 at 10:48

score 20 · Accepted Answer · answered Aug 24 '09 at 10:54

20

This basically means 2 things,

You had a bad password.
Your keystore is corrupted somehow.

I suspect it's #1. Double check your password. Try if you can list the key in keytool with the same password.

answered Aug 24 '09 at 10:54

ZZ Coder

74,484
29
137
169

I am having the same problem. I am giving the keystore password but it says: "trusted certificate entries are not password-protected". If I did not give password it says: "java.security.KeyStore$TrustedCertificateEntry incompatible with java.security.KeyStore$PrivateKeyEntry" – Muhammad Imran Tariq May 17 '11 at 09:57
Hi Coder, I have a issue mentioned in below link. Kindly provide me a solution. http://stackoverflow.com/questions/33369965/trusted-certificate-entries-are-not-password-protected-java – praneeth Oct 28 '15 at 12:55

score 9 · Answer 3 · edited Apr 04 '14 at 12:28

9

In the ks.getEntry line, you're giving it the store password. Should be the key password instead. Replace the line with this and it will work:

char[] keypwd = "abcdtest".toCharArray();
KeyStore.PrivateKeyEntry keyEnt = (KeyStore.PrivateKeyEntry) ks.getEntry("business2", new KeyStore.PasswordProtection(keypwd));

edited Apr 04 '14 at 12:28

Ashish Aggarwal

3,018
2
23
46

answered Aug 26 '09 at 02:51

G__

7,003
5
36
54

I am having the same problem. I am giving the keystore password but it says: "trusted certificate entries are not password-protected". If I did not give password it says: "java.security.KeyStore$TrustedCertificateEntry incompatible with java.security.KeyStore$PrivateKeyEntry" – Muhammad Imran Tariq May 17 '11 at 09:58

Can not get key from KeyStore

3 Answers3

Linked