Dumping out JKS private key

This post explains how you could programmatically access a java key store and dump its private key out.

To start with, let's create a key store with java keytool.

C:\>keytool -genkey -keystore wso2.jks -storepass wso2123 -keypass wso2123 -alias wso2

Let's look at the code now. It's self-explanatory with the attached comments.

package org.wso2;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.security.Key;
import java.security.KeyStore;

public class KeyExplorer {

private final static String KEY_STORE_FILE = "c:\\wso2.jks";
private final static String KEY_STORE_PASSWORD = "wso2123";
private final static String PRIVATE_KEY_PASSWORD = "wso2123";
private final static String KEY_ALIAS = "wso2";
private final static String KEY_STORE_TYPE = "jks";
private final static String OUT_PUT_FILE = "c:\\wso2.key";

public static void main(String[] args) {

KeyStore keystore = null;
Key privateKey = null;
FileOutputStream outFile = null;

try {
 keystore = KeyStore.getInstance(KEY_STORE_TYPE);
 keystore.load(new FileInputStream(KEY_STORE_FILE), KEY_STORE_PASSWORD.toCharArray());

 if (keystore.containsAlias(KEY_ALIAS)) {
  privateKey = keystore.getKey(KEY_ALIAS, PRIVATE_KEY_PASSWORD.toCharArray());
 } else {
  return;
 }

 // Returns true if the entry identified by the given alias was
 // created by a call to setKeyEntry, or created by a call to
 // setEntry with a PrivateKeyEntry or a SecretKeyEntry.
 if (keystore.isKeyEntry(KEY_ALIAS)) {
  System.out.println("PrivateKeyEntry");
 }

 // Returns the standard algorithm name for this key. For example,
 // "DSA" would indicate that this key is a DSA key.
 System.out.println("Algorithm: " + privateKey.getAlgorithm());

 // Returns the name of the primary encoding format of this key, or
 // null if this key does not support encoding. The primary encoding
 // format is named in terms of the appropriate ASN.1 data format, if
 // an ASN.1 specification for this key exists. For example, the name
 // of the ASN.1 data format for public keys is SubjectPublicKeyInfo,
 // as defined by the X.509 standard; in this case, the returned
 // format is "X.509". Similarly, the name of the ASN.1 data format
 // for private keys is PrivateKeyInfo, as defined by the PKCS #8
 // standard; in this case, the returned format is "PKCS#8".
 System.out.println("Key format: " + privateKey.getFormat());

 outFile = new FileOutputStream(OUT_PUT_FILE);
 outFile.write(privateKey.getEncoded());
 outFile.flush();

} catch (Exception e) {
 e.printStackTrace();
} finally {
 if (outFile != null) {
  try {
        outFile.close();
  } catch (IOException e) {
       e.printStackTrace();
  }
 }
}
}
}

The above will output the private key in a binary format - let's see how we could convert it to Base64 with OpenSSL.

You can download OpenSSL for Windows from here.

openssl enc -in wso2.key -out wso2-txt.key -a

The "enc" command does various types of encryptions and encodings and "-a" is for Base64 - just type "openssl enc -help" - you'll see all available options.