Converting PKCS Certificates to OpenSSL Certificates

Today I integrated with a third-party API that required high security — HTTPS mutual TLS authentication. The other party only provided the Java PKCS certificate generation method, with no SDKs for other languages.

This was quite frustrating, so I decided to convert this certificate to the more universal OpenSSL format.

Conversion commands:

openssl pkcs12 -in xxx.jks -out ca.pem -cacerts -nokeys
openssl pkcs12 -in xxx.jks -out client.pem -clcerts -nokeys
openssl pkcs12 -in xxx.jks -out key.pem -nocerts

Here, xxx.jks is the keystore generated by the Java SDK’s keytool utility. Note the Java SDK version — if the generated keystore isn’t in PKCS12 format, you can convert it with the following command:

keytool -importkeystore -srckeystore xxx.jks -destkeystore xxxNewPKCS12.jks -deststoretype pkcs12

This is because the PKCS12 format is much easier for OpenSSL to handle.

Just noting this down here.

OpenSSL Official Site