How to Inspect a JKS Keystore with keytool

Your Java application is configured to use the alias server. The alias exists, but does it contain the private key the application needs for TLS?

Start by inspecting that specific entry with the keytool from your application’s JDK:

keytool -list -v -storetype JKS -keystore app.jks -alias server

Enter the store password when prompted. Replace server with the alias in your application configuration. If you’re unsure which alias to check, omit -alias server to list all entries.

Read the entry type first

• PrivateKeyEntry contains a private key and its certificate chain. A TLS server or mTLS client uses this kind of entry for its own identity.
• trustedCertEntry contains a certificate trusted by the application. You’ll commonly find these entries in a truststore.

For a PrivateKeyEntry, check the certificate fingerprint, expiry date, and chain length. A chain length of 1 is expected for a self-signed identity. For a CA-issued certificate, check whether the required intermediates are present.

The store password and the private-key password can differ in JKS. A successful listing confirms you can read the store. If the application throws UnrecoverableKeyException, check the password configured for the key entry separately.

Verify the alias after converting to PKCS#12

If you migrate the entry with keytool -importkeystore, inspect the destination before switching the application over:

keytool -list -v -storetype PKCS12 -keystore app.p12 -alias server

Compare the entry type, chain length, and certificate fingerprints with the source. Then test the new keystore in the target Java runtime.

The full PKIScope walkthrough includes the commands to export the public certificate and convert a single JKS alias to PKCS#12.

AI was used to draft this post. The inspection and conversion workflow was tested with JDK 21.