Merge 2 .jks truststore files

Question

I am using a Tomcat that is SSL enabled, using truststores for client authentication.

I have two .jks trustore files.

The first, I use it for the PROD environment and the other for the TEST environment client certificates.

I deploy the web application, on a Tomcat and until now i was setting one of the above files in the configuration (according to the environment).

Is it possible i can merge those files into one .jks truststore that will accept client certificates both for PROD and TEST environments?

I need to mention that i have the passwords for both truststores.

Thanks!

score 48 · Answer 1 · answered Dec 20 '13 at 07:10

48

You can use the -importkeystore option of keytool to import an entry from one keystore/truststore to another:

keytool -importkeystore -srckeystore test.jks -destkeystore common.jks -srcalias myRootCA -destalias myRootCA_TEST -srcstorepass **** -deststorepass ****
keytool -importkeystore -srckeystore prod.jks -destkeystore common.jks -srcalias myRootCA -destalias myRootCA_PROD -srcstorepass **** -deststorepass ****

The common.jks will then contain both CA to validate the client certificates. However, the application may also need to be reconfigured.

answered Dec 20 '13 at 07:10

Jcs

13,279
5
53
70

3

Each keystore will have it's own private key. What will happen to these keys after merging ? – Chaitanya Gudala Oct 27 '14 at 06:57
1

Note to myself: the default keystore password is **changeit** – Matthias Jun 21 '17 at 14:27
@KrsnaChaitanya The destination keystore/truststore password will prevail. You can use that to view contents of that. – c0der512 Jul 20 '20 at 14:38

Merge 2 .jks truststore files

1 Answers1

Linked