How to create PKCS#12 format file with client public certificate and private key using java program

Question

I have client public certificate and private key file in the form of .pem format files.

Can anyone of you help me how to create PKCS#12 format file with those files using java program.

Here i have added my code

Path path = Paths.get(new File("User_privkey.pem").getAbsolutePath());
        Path certPath = Paths.get(new File("User.pem").getAbsolutePath());
        try {
            // Used to read User_privkey.pem file to get private key
            PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(Files.readAllBytes(path));
            KeyFactory keyFactory = KeyFactory.getInstance("RSA");
            PrivateKey privateKey = keyFactory.generatePrivate(spec);

            //  Used to read user certificate 
            CertificateFactory factory = CertificateFactory.getInstance("X.509");
            Certificate cert = factory.generateCertificate(Files.newInputStream(certPath, null));

            KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
            // add it to the keystore
            ks.setKeyEntry("MyPKCSEntry", privateKey, "Temp".toCharArray(), new Certificate[] { cert });

            File file = new File("CERTIFICATE_CUSTOMPATH");
            OutputStream out = new FileOutputStream(file);
            ks.store(out, "Temp".toCharArray());
            out.close();

        } catch (Exception e) {
            System.out.println("Exception got caught" + e.getMessage());
        }

Possible duplicate of [convert certificate from pem into jks](http://stackoverflow.com/questions/22296312/convert-certificate-from-pem-into-jks) — Keith, Feb 16 '17 at 13:09
Hi syed, i am looking to implement the above functionality. Can you help me with code to achieve this requirement. — Vinod Kumar, Feb 16 '17 at 13:14
Hi Vinod, you can use this link http://stackoverflow.com/a/22298627/1345224 — aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa, Feb 16 '17 at 13:16
@pedrofb, In the above question i have posted my code. Can you help me know to resolve this issue. — Vinod Kumar, Feb 17 '17 at 05:59
Why 'using a Java program' when there are existing utilities that already do it? — user207421, Feb 17 '17 at 07:38
I am trying to establish https connection in java with my server. So, i have valid user certificate and private key as a pem file's. Before establishing the communication i have to send this certificate to server. — Vinod Kumar, Feb 17 '17 at 08:45

score 1 · Answer 1 · edited May 23 '17 at 11:53

1

you can use this code, I also recommend this link

    public static byte[] pemToPKCS12(final String keyFile, final String cerFile, final String password) throws Exception {
// Get the private key
FileReader reader = new FileReader(keyFile);

PEMReader pem = new PEMReader(reader, new PasswordFinder() {
    @Override public char[] getPassword() {
        return password.toCharArray();
    }
});

PrivateKey key = ((KeyPair)pem.readObject()).getPrivate();

pem.close();
reader.close();

// Get the certificate      
reader = new FileReader(cerFile);
pem = new PEMReader(reader);

X509Certificate cert = (X509Certificate)pem.readObject();
java.security.cert.Certificate X509Certificate =
        new JcaX509CertificateConverter().setProvider("SC")
            .getCertificate(cert);
pem.close();
reader.close();

// Put them into a PKCS12 keystore and write it to a byte[]
ByteArrayOutputStream bos = new ByteArrayOutputStream();
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(null);
ks.setKeyEntry("alias", (Key)key, password.toCharArray(), new java.security.cert.Certificate[]{cert});
ks.store(bos, password.toCharArray());
bos.close();
return bos.toByteArray();}

edited May 23 '17 at 11:53

Community

1
1

answered Feb 16 '17 at 13:34

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

926
10
34

Hi, i am getting the below exception. Can you help me to resolve this issue java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: invalid key format – Vinod Kumar Feb 16 '17 at 13:45
In the above code if i am not wrong you are using bouncycastle api to read pem file's. Please have a look into the code which i am using now! PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(Files.readAllBytes(path)); PrivateKey privateKey = keyFactory.generatePrivate(spec); – Vinod Kumar Feb 16 '17 at 14:06
KeyFactory keyFactory = KeyFactory.getInstance("RSA"); PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(Files.readAllBytes(path)); PrivateKey privateKey = keyFactory.generatePrivate(spec); CertificateFactory factory = CertificateFactory.getInstance("X.509"); Certificate cert = factory.generateCertificate(Files.newInputStream(certPath, null)); – Vinod Kumar Feb 16 '17 at 14:13
`CertificateFactory` can read PEM files, but `PKCS8EncodedKeySpec` can not. Remove header and footer and decode base64 from PEM private key – pedrofb Feb 16 '17 at 22:01

score 0 · Answer 2 · answered Feb 17 '17 at 10:56

Some fixes are needed on your code. Please try this fully functional code. It does not need additional dependencies. I assumed your key is PKCS#8 (starts with -----BEGIN PRIVATE KEY-----. If not, you will not convert it.

 public static void selfSignedCertificateToP12(String privateKeyFile, String certificateFile,String p12File, String alias, char[] password) 
        throws Exception{
    byte privateKeyData[] = Files.readAllBytes(Paths.get(privateKeyFile));
    byte certificateData[] = Files.readAllBytes(Paths.get(certificateFile));

    //Remove PEM header, footer and \n
    String privateKeyPEM = new String (privateKeyData, StandardCharsets.UTF_8);
    privateKeyPEM = privateKeyPEM.replace(
            "-----BEGIN PRIVATE KEY-----\n", "")
                .replace("-----END PRIVATE KEY-----", "")
                .replaceAll("\n", "");
    byte privateKeyDER[] = Base64.getDecoder().decode(privateKeyPEM);

     // Used to read User_privkey.pem file to get private key
    PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(privateKeyDER);
    KeyFactory keyFactory = KeyFactory.getInstance("RSA");
    PrivateKey privateKey = keyFactory.generatePrivate(spec);

    //  Used to read user certificate 
    CertificateFactory factory = CertificateFactory.getInstance("X.509");
    Certificate cert = factory.generateCertificate(new ByteArrayInputStream(certificateData));

    //Create keystore, add entry with the provided alias and save
    KeyStore ks = KeyStore.getInstance("PKCS12");
    ks.load(null);
    ks.setKeyEntry(alias, privateKey, password, new Certificate[] { cert });
    OutputStream out = new FileOutputStream(p12File);
    ks.store(out, password);
    out.close();
}

How to create PKCS#12 format file with client public certificate and private key using java program

2 Answers2