321

I have tried to find the difference between .keystore files and .jks files, yet I could not find it. I know jks is for "Java keystore" and both are a way to store key/value pairs.

Is there any difference or a preference to use one over another?

juveria
  • 3,221
  • 2
  • 14
  • 5

3 Answers3

258

Ultimately, .keystore and .jks are just file extensions: it's up to you to name your files sensibly. Some application use a keystore file stored in $HOME/.keystore: it's usually implied that it's a JKS file, since JKS is the default keystore type in the Sun/Oracle Java security provider. Not everyone uses the .jks extension for JKS files, because it's implied as the default. I'd recommend using the extension, just to remember which type to specify (if you need).

In Java, the word keystore can have either of the following meanings, depending on the context:

When talking about the file and storage, this is not really a storage facility for key/value pairs (there are plenty or other formats for this). Rather, it's a container to store cryptographic keys and certificates (I believe some of them can also store passwords). Generally, these files are encrypted and password-protected so as not to let this data available to unauthorized parties.

Java uses its KeyStore class and related API to make use of a keystore (whether it's file based or not). JKS is a Java-specific file format, but the API can also be used with other file types, typically PKCS#12. When you want to load a keystore, you must specify its keystore type. The conventional extensions would be:

  • .jks for type "JKS",
  • .p12 or .pfx for type "PKCS12" (the specification name is PKCS#12, but the # is not used in the Java keystore type name).

In addition, BouncyCastle also provides its implementations, in particular BKS (typically using the .bks extension), which is frequently used for Android applications.

Community
  • 1
  • 1
Bruno
  • 119,590
  • 31
  • 270
  • 376
  • I can confirm than changing the extension from .jks to .keystore will work. Please backup before doing it !! – BMaximus Sep 04 '19 at 19:24
  • sorry, still don't quite understand `.keystore` vs `.jks`. – frank Jan 18 '21 at 03:09
  • 1
    @frank It depends on the context, they are just file name extensions. Often, they'll be the same actual type of file (a JKS file), but of course, file extensions are just an indication. – Bruno Jan 18 '21 at 10:40
  • @Bruno `Keystore` has three meanings depends on the context(as described in answer). but for `.keystore` file and `.jks` file, they are the same(just file extension differents), both them contains public/private certificate and password, right? – frank Jan 19 '21 at 02:29
  • Hi, Bruno we take your answer for the spanish version of SO, https://es.stackoverflow.com/questions/162455/diferencias-entre-jks-y-keystore – Jorgesys Feb 23 '22 at 00:03
108

You are confused on this.

A keystore is a container of certificates, private keys etc.

There are specifications of what should be the format of this keystore and the predominant is the #PKCS12

JKS is Java's keystore implementation. There is also BKS etc.

These are all keystore types.

So to answer your question:

difference between .keystore files and .jks files

There is none. JKS are keystore files. There is difference though between keystore types. E.g. JKS vs #PKCS12

Cratylus
  • 52,998
  • 69
  • 209
  • 339
  • 4
    I'd say the predominant *keystore* type is JKS, not PKCS#12, only because the word "keystore" is part of the Java terminology, only rarely used outside the context of Java. This being said, PKCS#12 files are quite common indeed (typically `.pfx` or `.p12`). – Bruno Jan 27 '12 at 22:19
  • @Bruno:You mean the predominant type in Java applications. – Cratylus Jan 28 '12 at 07:52
  • 13
    No, I mean that the word "keystore" is mostly a Java word. Other applications/platforms rarely call the place/file where keys and certificates are store a "keystore". MS calls PKCS#12 files "Personal Information Exchange" files, for example. Others have names like "key chain" (OSX), "certificate database" (NSS), "certificate store", "key rings", ..., for the places where they store keys and certificates, not really "keystore". – Bruno Jan 28 '12 at 16:21
  • 4
    @Bruno:I see what you mean.Good point.I hadn't thought of it like this before.Thanks – Cratylus Jan 28 '12 at 19:17
7

One reason to choose .keystore over .jks is that Unity recognizes the former but not the latter when you're navigating to select your keystore file (Unity 2017.3, macOS).

AbePralle
  • 942
  • 1
  • 11
  • 13