How to create private key from pkcs12 in java

Question

I need to create PrivateKey from privateKeyContent which is in pkcs12 format. Below code doesn't work for it.

   KeyFactory kf = KeyFactory.getInstance("RSA");
   PKCS8EncodedKeySpec keySpecPKCS8 = new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKeyContent));
   PrivateKey privateRsaKey = kf.generatePrivate(keySpecPKCS8);

It gives me this error.

java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException : version mismatch: (supported:     00, parsed:     03
    at java.base/sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:251)
    at java.base/java.security.KeyFactory.generatePrivate(KeyFactory.java:390)

How to do it correctly in java?

Dmitry Spikhalskiy · Accepted Answer · 2023-02-25T23:47:03.893

PKCS12 format is a container that may have multiple keys and certificates. PKCS8 file always has one key. In your code sample, you apply PKCS8EncodedKeySpec to PKCS12 input, this is obviously not going to work because of this. You need to switch from Key-level APIs to KeyStore APIs.

You can read PKCS12 container like this:

InputStream keyFile = ...; //input stream to key file
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(keyFile, "<filePassword>".toCharArray());

and extract a specific key from the loaded storage:

String keyAlias = "1"; // all existing aliases can be obtained by ks.aliases()
Key key = ks.getKey(keyAlias, "<keyPassword>".toCharArray());

This is how you can read a key from this specific demo .p12 file:

InputStream keyFile = ...; // load file as an IS
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(keyFile, null);
Key key = ks.getKey("1", "test".toCharArray());

score 0 · Answer 2 · answered Feb 25 '23 at 22:45

It does not seem like your key is an RSA Key.

You probably need to convert your key first before using it. For example:

openssl pkcs8 -topk8 -nocrypt -in key.pem -out new-key.pem

You can refer to JAVA 11 - elliptic curve private key - Caused by: java.security.InvalidKeyException: IOException : version mismatch: (supported: 00, parsed: 01 for more details

How to create private key from pkcs12 in java

2 Answers2