JKS Converter

The JKS Converter turns a certificate file (PEM, CRT, DER) or a PKCS12 file (.p12, .pfx) into a Java keystore file with a password of your choice. KafkIO itself doesn't need it: use it when another Java tool insists on a JKS file.

When you need a JKS

For KafkIO's own connections you don't need to convert anything. The SSL settings of a cluster read JKS, PKCS12 and PEM files directly: pick the matching Truststore type or Keystore type (see Supported certificate and key formats).

The converter is for everything else that talks to the same cluster: the Kafka command-line tools, Kafka Connect workers, your own Java applications and other JVM-based tools whose settings only offer a JKS truststore or keystore. Typical cases:

• your organisation hands out its CA certificate as a .pem or .crt file, and a tool needs it as a truststore;
• you have a client certificate and private key as a .p12 or .pfx file (exported from a certificate manager or a browser, for example), and a tool needs it as a keystore for mutual TLS.

Many current Java tools, including Kafka's own clients, also accept PKCS12 directly (for Kafka, ssl.truststore.type=PKCS12), so check the tool's settings before converting.

Opening the converter

Open it from Tools ▸ JKS Converter 1:

1

1. JKS Converter opens the converter in its own window.

The Want to create a JKS? link above the truststore fields of the cluster dialog (on the Kafka Security and Schema Registry tabs, for example) opens the same window, so you can convert a file in the middle of setting up a cluster.

The converter doesn't block the rest of KafkIO, and it starts empty each time you open it. If the menu item seems to do nothing, the converter it opened earlier is still open, behind another window.

Converting a file

Here a client certificate and its key, in storefront-app.p12, are about to be converted:

1 2 3 4 5

1. File location: the file to convert. Type or paste its path, or pick it with the folder button. Convert to JKS stays disabled until the field points at a file that exists.
2. File type: what the file is (see the table below). It starts at CRT / PEM / X.509.
3. Existing key password: the PKCS12 file's password. Only shown for P12 / PFX / PKCS12.
4. New store password: the password for the file you're about to create.
5. Convert to JKS reads the file, then asks where to save the new one. Your existing file isn't changed.

1. Choose the file and its type

   Fill in 1 File location and pick the 2 File type. The type goes by what's inside the file, not its name: a .crt or .cer file is usually a certificate, a .pfx is PKCS12.

2. Enter the passwords

   For a PKCS12 file, its current password in 3; then a password for the new file in 4. See Passwords.

3. Convert and save

   Click 5 Convert to JKS. If the file can be read, a save dialog opens in the folder you last used for a file in KafkIO, suggesting the name jksstore.jks. KafkIO adds .jks to the name if you leave it out, and asks before overwriting a file of that name. When it's written, a JKS saved. notification appears. If the file can't be read, nothing is saved and an error explains why (see When conversion fails).

What each file type converts

Passwords

Existing key password

The password the PKCS12 file was exported with. KafkIO uses it both to open the file and to read the private keys inside, which is how PKCS12 files are normally made (one password for both). Leave it blank if the file has no password. A wrong password stops the conversion with keystore password was incorrect.

New store password

Protects the new file; the tool that uses it needs this password (for Kafka clients, ssl.truststore.password or ssl.keystore.password). Private keys copied from a PKCS12 file get the same password, so where a tool also asks for a key password (ssl.key.password), it's this one too. Certificates aren't secret, so a truststore converted from a certificate works without a password if your tool allows that; for a keystore with a private key, always set one.

The saved file

The file is saved with a .jks name in Java's standard keystore format. In the Java version KafkIO ships with, that format is PKCS12 inside, not the older proprietary JKS format. In practice this rarely matters: Java reads both formats when it's asked for a JKS file, so tools configured with a JKS type open it. You'll notice it in two places:

• keytool -list -keystore jksstore.jks reports Keystore type: PKCS12;
• a tool that checks for the legacy JKS format itself, rather than going through Java's keystore support, may reject the file. Convert it with keytool -importkeystore -srckeystore jksstore.jks -destkeystore legacy.jks -deststoretype JKS if you meet one.

Using the result

Point the tool at the file and give it the new store password. For the Kafka command-line tools and Java clients, a truststore converted from a CA certificate goes in the client properties like this:

security.protocol=SSL
ssl.truststore.location=/path/to/jksstore.jks
ssl.truststore.password=the-new-store-password
ssl.truststore.type=JKS

and a keystore converted from a client certificate's PKCS12 file adds:

ssl.keystore.location=/path/to/storefront-app.jks
ssl.keystore.password=the-new-store-password
ssl.key.password=the-new-store-password
ssl.keystore.type=JKS

In KafkIO you can use the file too, with type Java KeyStore (JKS), although the original PEM or PKCS12 file works just as well there. See SSL / TLS for where truststores and keystores go in a cluster's settings.

When conversion fails

If KafkIO can't read the file, it shows an error and saves nothing:

The message under Could not convert to JKS file comes from Java. The common ones:

A problem writing the file (no permission for the folder, say) shows Could not save JKS file with the file name instead. Show Details has the full error, and View Logs opens KafkIO's logs.

Related

• SSL / TLS: truststores, keystores and the formats KafkIO reads
• Need a JKS?
• Network Tool