KeyStore Explorer: A GUI for Java KeyStore and PFX Files

What is KeyStore Explorer?

KeyStore Explorer is a free, open-source GUI utility that replaces the standard Java keytool command-line tool. Instead of memorising long, complex strings of keytool commands, you can open, edit, and convert keystores through an intuitive visual interface.

The application supports all common keystore formats: JKS, JCEKS, PKCS#12 (PFX/P12), BKS, and UBER. You can import certificates, export private keys, generate CSRs, and inspect certificate chains – all within a clean user interface.

Installation

Download KeyStore Explorer from keystore-explorer.org/downloads.html. There are two primary options for Windows:

• Windows installer (.exe) – standard installation including a Start menu shortcut.
• Portable ZIP – simply extract and run, no installation required.

KeyStore Explorer requires Java 8 or later. If you do not have Java installed on your system, you can download the version with a bundled Java runtime to avoid separate installation.

Versions for macOS and Linux are also available.

Opening a PFX File

A PFX file (PKCS#12) contains both the certificate and the private key in a single encrypted file. To open it in KeyStore Explorer:

1. Launch KeyStore Explorer.
2. Select File → Open Keystore (or press Ctrl+O).
3. Select your .pfx or .p12 file.
4. Enter the PFX file password and click OK.

KeyStore Explorer will now display the contents: the certificate, the private key, and any intermediate certificates. You can double-click any entry to view certificate details such as issuer, expiry date, and key size.

Converting PFX to Java KeyStore (JKS)

Java applications like Tomcat, WildFly, and Spring Boot typically require the JKS format. To convert your file:

1. Open the PFX file as described above.
2. Select File → Save As (or press Ctrl+Shift+S).
3. Select JKS as the format in the file type dropdown.
4. Provide a password for the new JKS file (keystore password).
5. You will then be prompted for a password for the private key (key password) – see the section below for details.
6. Save the file with a .jks extension.

JKS Password Management

A critical difference between PFX and JKS, and a frequent cause of configuration errors, is that JKS uses two distinct passwords:

• Keystore password – protects the JKS file itself. Required to open the file.
• Key password – protects the private key inside the keystore. Required to use the certificate for SSL/TLS.

While a PFX file uses a single password for everything, KeyStore Explorer will ask you to set these separately during JKS conversion.

Tomcat and Java Servers

Most Java applications – including Apache Tomcat – require the keystore password and the key password to be identical. If they differ, you will likely encounter the following error:

java.security.UnrecoverableKeyException: Cannot recover key

Ensure both passwords are set to the same value during conversion. In a Tomcat server.xml configuration, the passwords are defined as follows:

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           SSLEnabled="true"
           keystoreFile="/path/to/keystore.jks"
           keystorePass="yourPassword"
           keyPass="yourPassword" />

If keyPass is omitted, Tomcat assumes it is the same as the keystorePass.

Exporting Certificates from JKS

To export a certificate (without the private key) from a JKS file:

1. Open the JKS file in KeyStore Explorer.
2. Right-click on the desired entry.
3. Select Export → Export Certificate Chain.
4. Choose the format: X.509 (PEM) is standard for most systems, or DER if specifically required.
5. Save the file.

You can also export the private key separately via Export → Export Private Key, though private keys should never be shared unless absolutely necessary.

Additional Features

• Generate CSR – Right-click a keypair → Generate CSR. Useful when ordering a new certificate for an existing key.
• Import CA Reply – Right-click a keypair → Import CA Reply. Use this to import the issued certificate after your CSR has been processed.
• Import Trusted Certificate – Right-click within the keystore → Import Trusted Certificate. Use this to add root or intermediate certificates to your truststore.
• Inspect Certificate Details – Double-click to view the Subject, Issuer, Serial Number, SAN fields, key size, and validity period.