.JKS

Introduction

A JKS file is a keystore for Java: a file holding private keys with their certificate chains, and trusted certificates, each under a name called an alias. Java servers such as Tomcat have long read their TLS keys from JKS files, and Android apps used to be signed with keys kept in one.

JKS was Java’s default keystore type until Java 9, when the default became PKCS #12. The JDK’s keytool converts between the two.

Structure

All values are big-endian. The file starts with the magic number FE ED FE ED, a version number and the number of entries. Each entry starts with a tag, 1 for a private key and 2 for a trusted certificate, then the alias and the time the entry was made. A private key entry holds the key, encrypted with a password using a weak Sun-specific scheme, and its certificate chain. A certificate entry holds one certificate, with its type name, such as X.509, and its DER bytes.

The file ends with a 20-byte SHA-1 hash computed from the keystore password and all the bytes before it, which detects changes and wrong passwords. The related JCEKS format starts with CE CE CE CE and uses stronger key encryption.

Links