Can we load multiple Certificates & Keys in a Key Store?

Question

Is it always required to load only Pairs (i.e. Certificates & Keys together)?

If a Key Store has multiple Certificates and Keys, which one will get selected when Java SSL tries to establish connection as a Server?

score 24 · Accepted Answer · answered Jun 16 '11 at 11:52

24

Although this depends on the KeyStore type, generally, you can store multiple private keys and certificates in a single store.

Which key and certificate combination is used for a Java-based server will depend on how the application was implemented. A number of applications let you select a given certificate using the alias name. The key and certificate getters in KeyStore take an alias parameter to make this choice. Usually, when this is not specified in the configuration, the application or framework will use the first suitable one it finds based on the KeyStore.aliases() enumeration.

Tomcat, for example, uses the keyAlias attribute in its Connector configuration:

keyAlias: The alias used to for the server certificate in the keystore. If not specified the first key read in the keystore will be used.

Regarding key pairs, some KeyStores (again, depending on the type) can be used to store SecretKeys (e.g. DES), that is shared keys, as well as public-private key pairs.

answered Jun 16 '11 at 11:52

Bruno

119,590
31
270
376

2

Thanks for your answer.So, basically in Java SSL, if want to use certificates, then first I must load them into KeyStore either through Keytool or programmatically and then read the certificate and private key entries from key store and pass them on to SSL? But, which API allows me to specify to SSL Server which Certificate should be used? – Jay Jun 16 '11 at 15:10
4

Unless you're using a framework that does it for you, you'll need to configure a `KeyManager` and initialize and `SSLContext` from it (and then use that context to build your socket factory). Here is an example of [KeyManager to specify an alias](http://code.google.com/p/jsslutils/source/browse/tags/release-1.0.5/jsslutils/src/main/java/org/jsslutils/sslcontext/keymanagers/FixedServerAliasKeyManager.java). – Bruno Jun 16 '11 at 15:17
@Bruno : Are you sure that it looks at the alias for this? because alias is the name given by you for identifying that entry within the keystore. To make the choice as to which certificate it should send to the client, it will look at the domain of the certificate(CN) and will make the decision based on that. If the requested domain in found in the (CN) of any one of the certificates, that certificate will be sent to the client. – Ashwin Apr 19 '12 at 02:17
@Ashwin, yes, the KeyManager uses what you return via chooseServerAlias to select the certificate: that's how the API is built. You're confusing multiple things here. There's no such thing as the "domain of the certificate" in the CN (or SAN), and the behaviour you seem to suggest resembles SNI, which isn't supported in Java (up to 7 at least). – Bruno Apr 19 '12 at 10:31
@Bruno Then how does a server(eg jboss) decide which certificate it has to send to the client. You just give the jboss server your location of the keystore and the password for the keystore in the server.xml file. If there are multiple keys with certificate replies attached to them, how does jboss decide which certificate to be sent to the client for ssl handshake. – Ashwin Apr 19 '12 at 11:15
@Ashwin: it sends the one configured for that alias within its connector. If none is specified, it picks the first one (with a private key) it finds in the keystore (whether or not it's valid for the requested host name). (It might be better not to "hijack" this question to discuss this, btw.) – Bruno Apr 19 '12 at 11:30
I have 2 certs with the same aliases. What now? Now I get two times the same cert (newer). – Krzysztof Szewczyk Feb 19 '15 at 06:54
1

@KrzysztofSzewczyk aliases are meant to be unique identifiers as far as the KeyStore is concerned, so one is likely to have overwritten the other when you imported it. (The cert doesn't have an alias in itself, it's just a slot in the KeyStore.) See: [this question](http://stackoverflow.com/a/27072660/372643). – Bruno Feb 19 '15 at 11:03
1

@Bruno I understand - but explain it to the end-user... He bought new certificate with the same alias one month before expiration date of current certificate. Happily this solution resolved my problem: [link](https://joinup.ec.europa.eu/software/sd-dss/issue/problem-possible-keystore-aliases-collision-when-using-mscapi) – Krzysztof Szewczyk Feb 19 '15 at 14:49
@KrzysztofSzewczyk Ah, in the Windows certificate store, you can rename the "friendly name" as far as I remember (if you dig far enough in the advanced properties): that's what's used for the alias name when using the `WINDOWS-MY`/`WINDOWS-ROOT` keystores. Remember, your user didn't really buy a new cert with the same alias (since certificates don't have the concept of an alias or friendly name as such), it's just that Windows decided to make up that name and use the same again for that new cert. Assuming the new cert was already valid, another solution is to remove the old cert. – Bruno Feb 19 '15 at 14:54
@Bruno Thanks for explain! I didn't know then I can that simply change 'friendly-name' in `Windows-MY`. – Krzysztof Szewczyk Feb 20 '15 at 07:16

score 3 · Answer 2 · answered Jun 16 '11 at 11:39

You can have a keystore with as many certificates and keys as you like.

If there are multiple certificates in a keystore a client uses as its truststore, all certificates are being looked at until one is found that fits. You can look at the preinstalled certificates, they are in /lib/security/cacerts. It's just a big collection of root CAs' certificates.

Regarding the keys I don't know. I'd reckon the client uses a key that is signed by the same CA as the certificate that is provided by the server and if there are multiple, the first is used. But I can't say that for sure.

Can we load multiple Certificates & Keys in a Key Store?

2 Answers2

Linked