# What Is JKS (Java KeyStore)? Definition and Examples

> JKS (Java KeyStore) is Java's original proprietary file format for storing private keys, certificate chains and trusted certificates, managed with keytool.

Source: https://ssl.sh/glossary/jks/
Last updated: 2026-11-10

JKS is the keystore format that Java used by default before Java 9. A keystore holds entries under aliases: private key entries (a key plus its [certificate chain](https://ssl.sh/glossary/certificate-chain/)) and trusted certificate entries. The same file format serves two roles: a keystore holds a server's or client's own identity, while a [truststore](https://ssl.sh/glossary/trust-store/) holds the CA certificates a Java application trusts. Since Java 9 the default keystore type is [PKCS #12](https://ssl.sh/glossary/pkcs12/), and keytool warns that JKS uses a proprietary format and recommends migrating.

## Why it matters
Tomcat, Kafka, Elasticsearch, Spring Boot and many other Java services are configured with keystore and truststore files plus passwords, and plenty of existing deployments still use .jks files. The common "PKIX path building failed" error means the truststore cannot build a chain to a trusted CA. A frequent server-side problem is a key entry that lacks the intermediate certificates, which desktop browsers may tolerate but other clients reject.

## Example
```bash
keytool -importkeystore -srckeystore example.com.p12 -srcstoretype PKCS12 \
  -destkeystore example.com.jks -deststoretype JKS
keytool -list -v -keystore example.com.jks
keytool -importcert -alias internal-root -file root.crt -keystore truststore.jks
```

## Common misconceptions
- **Java requires JKS.** Modern Java reads and writes PKCS #12 natively and uses it by default.
- **Keystore and truststore are the same thing.** They share a format but hold different things: your own key versus the CAs you trust.
- **Importing the leaf certificate alone is enough.** The key entry needs the full chain; import the CA reply into the alias that holds the private key.

## Related terms

- [PKCS#12](https://ssl.sh/zh/glossary/pkcs12/): PKCS#12 是一种用口令保护的二进制容器格式，可以把私钥、证书和证书链打包进一个文件，扩展名通常是 .p12 或 .pfx。
- [信任库](https://ssl.sh/zh/glossary/trust-store/): 信任库是操作系统、浏览器或编程语言运行时内置的一组根 CA 证书，验证证书链时以它们作为信任锚。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [PFX](https://ssl.sh/zh/glossary/pfx/): PFX 是 Windows 和 IIS 用来导入导出证书及其私钥、证书链的 .pfx 文件，格式就是 PKCS#12。
- [客户端证书](https://ssl.sh/zh/glossary/client-certificate/): 客户端证书是 TLS 客户端在握手时出示、用来向服务器证明自身身份的 X.509 证书。