{"id":68,"date":"2026-01-15T15:21:31","date_gmt":"2026-01-15T15:21:31","guid":{"rendered":"https:\/\/stupidtechblog.com\/?p=68"},"modified":"2026-01-15T15:21:32","modified_gmt":"2026-01-15T15:21:32","slug":"ssl-certificate-quick-reference","status":"publish","type":"post","link":"https:\/\/stupidtechblog.com\/?p=68","title":{"rendered":"SSL Certificate Quick Reference"},"content":{"rendered":"\n

I often find myself needing to take a certificate or keystore and do stuff<\/em> to it. Either turning it into a different format, extracting something, updating something, etc. I decided to make this reference doc to include every command that might be needed to do stuff with an SSL cert.<\/p>\n\n\n\n

Source Format: BASE64<\/h2>\n\n\n\n

For use when you have a base64 pem\/crt\/cer file and\/or a private key, and need to turn it into other stuff.<\/p>\n\n\n\n

Encrypt\/Decrypt Private Key<\/h3>\n\n\n\n
Encrypt with OpenSSL:\nopenssl rsa -aes256 -in <decrypted key> -out <encrypted key>\nDecrypt with OpenSSL:\nopenssl rsa -in <encrypted key> -out <decrypted key><\/pre>\n\n\n\n
Create PFX\/PKCS12 Keystore\/Truststore<\/h3>\n\n\n\n
Create keystore (cert + key) with OpenSSL:\nopenssl pkcs12 -export -out <pfx keystore file>.pfx -inkey <private key file> -in <certificate file>\nCreate truststore (cert only) with OpenSSL:\nopenssl pkcs12 -export -nokeys -in <certificate file> -out <pfx truststore file>.pfx<\/pre>\n\n\n\n
Create JKS Truststore<\/h3>\n\n\n\n
You can’t actually create a Java keystore straight from a key and certificate. Instead you need to go to PFX first, and then from PFX to JKS. Find instructions for that below.<\/p>\n\n\n\n
Create truststore(cert only) with Java keytool:\nkeytool -importkeystore -srckeystore <certificate FQDN>.pfx -srcstoretype pkcs12 -destkeystore <certificate FQDN>.jks -deststoretype JKS<\/pre>\n\n\n\n
Source Format: DER<\/h2>\n\n\n\n
There’s really only one thing you should do with a DER encoded certificate. Turn it into base64 instead.<\/p>\n\n\n\n
Windows:\ncertutil -encode <der file> <base64 file>\nLinux(openssl):\nopenssl x509 -inform der -in <der file> -out <base64 file><\/pre>\n\n\n\n
Source Format: PKCS12<\/h2>\n\n\n\n
For when you have a pfx\/p12 file and need to do stuff with its contents.<\/p>\n\n\n\n
Extract Certificate And Key To Base64<\/h3>\n\n\n\n
# Extract an encrypted private key\nopenssl pkcs12 -in [yourfile.pfx] -nocerts -nodes -out [privatekey.key]\n\n# Extract the certificate\nopenssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [publiccert.crt]<\/pre>\n\n\n\n
Convert to JKS<\/h3>\n\n\n\n
keytool -importkeystore -srckeystore <certificate FQDN>.pfx -srcstoretype pkcs12 -destkeystore <certificate FQDN>.jks -deststoretype JKS\n\n#List the certificates contained in that JKS file:\nkeytool -list -keystore <certificate FQDN>.jks\n\n#Change the key password:\nkeytool -keypasswd -keystore <certificate FQDN>.jks -alias <certificate alias>\n\n#Change the store password:\nkeytool -storepasswd -keystore <certificate FQDN>.jks\n\n#Change the alias of a certificate:\nkeytool -changealias -keystore <certificate FQDN>.jks -alias <old alias> -destalias <new alias><\/pre>\n\n\n\n
Source Format: JKS<\/h2>\n\n\n\n
Java keystore files are not ideal but some environment still use them. Hopefully these commands help.<\/p>\n\n\n\n
View Keystore Details<\/h3>\n\n\n\n
keytool -list -keystore <keystore file>\n\nYou can just ignore the password prompt for this command.<\/pre>\n\n\n\n
Change Keystore Password<\/h3>\n\n\n\n
keytool -storepasswd -keystore <keystore file><\/pre>\n\n\n\n
Change Key Password<\/h3>\n\n\n\n
keytool -keypasswd  -alias <alias for key you want to modify>  -keystore <keystore file><\/pre>\n\n\n\n
Convert to PFX\/PKCS12<\/h3>\n\n\n\n
There’s not a whole lot you can do with JKS files when it comes to exporting certificates or keys. For that, you’ll need to turn them into PFX\/PKCS12 files first.<\/p>\n\n\n\n
keytool -importkeystore -srckeystore [MY_KEYSTORE.jks] -destkeystore [MY_FILE.p12] -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD_PKCS12]\n<\/pre>\n\n\n\n
Export Certificate<\/h3>\n\n\n\n
keytool -export -keystore examplestore -alias signFiles -file Example.cer<\/pre>\n\n\n\n
<\/p>\n\n\n\n
Change Alias<\/h3>\n\n\n\n
keytool -changealias -alias <old alias> -destalias <new alias> -keystore <keystore.jks><\/pre>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
I often find myself needing to take a certificate or keystore and do stuff to it. Either turning it into a different format, extracting something, updating something, etc. I decided to make this reference doc to include every command that might be needed to do stuff with an SSL cert. Source Format: BASE64 For use […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[17],"tags":[20,19,13,18,8],"class_list":["post-68","post","type-post","status-publish","format-standard","hentry","category-quick-reference","tag-certificates","tag-java-keytool","tag-linux","tag-openssl","tag-windows"],"_links":{"self":[{"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=\/wp\/v2\/posts\/68","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=68"}],"version-history":[{"count":11,"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=\/wp\/v2\/posts\/68\/revisions"}],"predecessor-version":[{"id":165,"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=\/wp\/v2\/posts\/68\/revisions\/165"}],"wp:attachment":[{"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=68"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=68"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stupidtechblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=68"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}