JKS (Java KeyStore)

JKS is the keystore format that Java used by default before Java 9. A keystore holds entries under aliases: private key entries (a key plus its certificate chain) and trusted certificate entries. The same file format serves two roles: a keystore holds a server's or client's own identity, while a truststore holds the CA certificates a Java application trusts. Since Java 9 the default keystore type is PKCS #12, and keytool warns that JKS uses a proprietary format and recommends migrating.

Why it matters

Tomcat, Kafka, Elasticsearch, Spring Boot and many other Java services are configured with keystore and truststore files plus passwords, and plenty of existing deployments still use .jks files. The common "PKIX path building failed" error means the truststore cannot build a chain to a trusted CA. A frequent server-side problem is a key entry that lacks the intermediate certificates, which desktop browsers may tolerate but other clients reject.

Example

keytool -importkeystore -srckeystore example.com.p12 -srcstoretype PKCS12 \
  -destkeystore example.com.jks -deststoretype JKS
keytool -list -v -keystore example.com.jks
keytool -importcert -alias internal-root -file root.crt -keystore truststore.jks

Common misconceptions

• Java requires JKS. Modern Java reads and writes PKCS #12 natively and uses it by default.
• Keystore and truststore are the same thing. They share a format but hold different things: your own key versus the CAs you trust.
• Importing the leaf certificate alone is enough. The key entry needs the full chain; import the CA reply into the alias that holds the private key.