APIdia Launch Partner
Top Description Inners Fields Constructors Methods
sun.security.provider

public abstract sealed Class JavaKeyStore

extends KeyStoreSpi
permits JKS, CaseExactJKS
Class Inheritance
Known Direct Subclasses
sun.security.provider.JavaKeyStore.JKS, sun.security.provider.JavaKeyStore.CaseExactJKS
Imports
java.io.*, java.security.*, java.security.cert.Certificate, .CertificateFactory, .CertificateException, java.time.Instant, java.time.temporal.ChronoUnit, java.util.*, sun.security.pkcs.EncryptedPrivateKeyInfo, sun.security.pkcs12.PKCS12KeyStore, sun.security.util.Debug, .IOUtils, .KeyStoreDelegator
This class provides the keystore implementation referred to as "JKS".
Authors
Jan Luehe, David Brownell
Since
1.2
See Also
KeyProtector, java.security.KeyStoreSpi, KeyTool

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static class
JavaKeyStore.CaseExactJKS

public static class
JavaKeyStore.DualFormatJKS

public static class
JavaKeyStore.JKS

private static class
JavaKeyStore.KeyEntry

private static class
JavaKeyStore.TrustedCertEntry

Field Summary

Modifier and TypeField and Description
private static final Debug
debug

private final Hashtable<String, Object>
entries

Private keys and certificates are stored in a hashtable.

private static final int
MAGIC

private static final int
VERSION_1

private static final int
VERSION_2

Constructor Summary

AccessConstructor and Description
pack-priv
JavaKeyStore()

Method Summary

Modifier and TypeMethod and Description
pack-priv abstract String
convertAlias(String alias)

private byte[]
convertToBytes(char[] password)

Helper method to convert char[] to byte[]

private void
emitWeakKeyStoreWarning()

public Enumeration<String>

Returns:

enumeration of the alias names
engineAliases()

Implements abstract java.security.KeyStoreSpi.engineAliases.

Lists all the alias names of this keystore.

public boolean

Returns:

true if the alias exists, false otherwise
engineContainsAlias(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineContainsAlias.

Checks if the given alias exists in this keystore.

public void
engineDeleteEntry(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineDeleteEntry.

Deletes the entry identified by the given alias from this keystore.

public Certificate

Returns:

the certificate, or null if the given alias does not exist or does not contain a certificate.
engineGetCertificate(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificate.

Returns the certificate associated with the given alias.

public String

Returns:

the (alias) name of the first entry with matching certificate, or null if no such entry exists in this keystore.
engineGetCertificateAlias(Certificate
the certificate to match with.
cert)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateAlias.

Returns the (alias) name of the first keystore entry whose certificate matches the given certificate.

public Certificate[]

Returns:

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the given alias does not exist or does not contain a certificate chain (i.e., the given alias identifies either a trusted certificate entry or a key entry without a certificate chain).
engineGetCertificateChain(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateChain.

Returns the certificate chain associated with the given alias.

public Date

Returns:

the creation date of this entry, or null if the given alias does not exist
engineGetCreationDate(String
the alias name
alias)

Implements abstract java.security.KeyStoreSpi.engineGetCreationDate.

Returns the creation date of the entry identified by the given alias.

public Instant

Returns:

the instant that the entry identified by the given alias was created, or null if the given alias does not exist
engineGetCreationInstant(String
the alias name
alias)

Overrides java.security.KeyStoreSpi.engineGetCreationInstant.

Returns the instant that the entry identified by the given alias was created.

public Key

Returns:

the requested key, or null if the given alias does not exist or does not identify a key entry.
engineGetKey(String
the alias name
alias, char[]
the password for recovering the key
password)

Implements abstract java.security.KeyStoreSpi.engineGetKey.

Returns the key associated with the given alias, using the given password to recover it.

public boolean

Returns:

true if the entry identified by the given alias is a trusted certificate entry, false otherwise.
engineIsCertificateEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsCertificateEntry.

Returns true if the entry identified by the given alias is a trusted certificate entry, and false otherwise.

public boolean

Returns:

true if the entry identified by the given alias is a key entry, false otherwise.
engineIsKeyEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsKeyEntry.

Returns true if the entry identified by the given alias is a key entry, and false otherwise.

public void
engineLoad(InputStream
the input stream from which the keystore is loaded
stream, char[]
the (optional) password used to check the integrity of the keystore.
password)

Implements abstract java.security.KeyStoreSpi.engineLoad.

Loads the keystore from the given input stream.

public void
engineSetCertificateEntry(String
the alias name
alias, Certificate
the certificate
cert)

Implements abstract java.security.KeyStoreSpi.engineSetCertificateEntry.

Assigns the given certificate to the given alias.

public void
engineSetKeyEntry(String
the alias name
alias, Key
the private key to be associated with the alias
key, char[]
the password to protect the key
password, Certificate[]
the certificate chain for the corresponding public key (only required if the given key is of type java.security.PrivateKey).
chain)

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given private key to the given alias, protecting it with the given password as defined in PKCS8.

public void
engineSetKeyEntry(String
the alias name
alias, byte[]
the key (in protected format) to be associated with the alias
key, Certificate[]
the certificate chain for the corresponding public key (only useful if the protected key is of type java.security.PrivateKey).
chain)

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key (that has already been protected) to the given alias.

public int

Returns:

the number of entries in this keystore
engineSize()

Implements abstract java.security.KeyStoreSpi.engineSize.

Retrieves the number of entries in this keystore.

public void
engineStore(OutputStream
the output stream to which this keystore is written.
stream, char[]
the password to generate the keystore integrity check
password)

Implements abstract java.security.KeyStoreSpi.engineStore.

Stores this keystore to the given output stream, and protects its integrity with the given password.

private MessageDigest
getPreKeyedHash(char[] password)

To guard against tampering with the keystore, we append a keyed hash with a bit of extra data.

Inherited from java.security.KeyStoreSpi:
engineEntryInstanceOfengineGetAttributesengineGetEntryengineLoadengineProbeengineSetEntryengineStore

Field Detail

debugback to summary
private static final Debug debug
entriesback to summary
private final Hashtable<String, Object> entries

Private keys and certificates are stored in a hashtable. Hash entries are keyed by alias names.

MAGICback to summary
private static final int MAGIC
VERSION_1back to summary
private static final int VERSION_1
VERSION_2back to summary
private static final int VERSION_2

Constructor Detail

JavaKeyStoreback to summary
pack-priv JavaKeyStore()

Method Detail

convertAliasback to summary
pack-priv abstract String convertAlias(String alias)
convertToBytesback to summary
private byte[] convertToBytes(char[] password)

Helper method to convert char[] to byte[]

emitWeakKeyStoreWarningback to summary
private void emitWeakKeyStoreWarning()
engineAliasesback to summary
public Enumeration<String> engineAliases()

Implements abstract java.security.KeyStoreSpi.engineAliases.

Lists all the alias names of this keystore.

Returns:Enumeration<String>

enumeration of the alias names

engineContainsAliasback to summary
public boolean engineContainsAlias(String alias)

Implements abstract java.security.KeyStoreSpi.engineContainsAlias.

Checks if the given alias exists in this keystore.

Parameters
alias:String

the alias name

Returns:boolean

true if the alias exists, false otherwise

engineDeleteEntryback to summary
public void engineDeleteEntry(String alias) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineDeleteEntry.

Deletes the entry identified by the given alias from this keystore.

Parameters
alias:String

the alias name

Exceptions
KeyStoreException:
if the entry cannot be removed.
engineGetCertificateback to summary
public Certificate engineGetCertificate(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificate.

Returns the certificate associated with the given alias.

If the given alias name identifies a trusted certificate entry, the certificate associated with that entry is returned. If the given alias name identifies a key entry, the first element of the certificate chain of that entry is returned, or null if that entry does not have a certificate chain.

Parameters
alias:String

the alias name

Returns:Certificate

the certificate, or null if the given alias does not exist or does not contain a certificate.

engineGetCertificateAliasback to summary
public String engineGetCertificateAlias(Certificate cert)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateAlias.

Returns the (alias) name of the first keystore entry whose certificate matches the given certificate.

This method attempts to match the given certificate with each keystore entry. If the entry being considered is a trusted certificate entry, the given certificate is compared to that entry's certificate. If the entry being considered is a key entry, the given certificate is compared to the first element of that entry's certificate chain (if a chain exists).

Parameters
cert:Certificate

the certificate to match with.

Returns:String

the (alias) name of the first entry with matching certificate, or null if no such entry exists in this keystore.

engineGetCertificateChainback to summary
public Certificate[] engineGetCertificateChain(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCertificateChain.

Returns the certificate chain associated with the given alias.

Parameters
alias:String

the alias name

Returns:Certificate[]

the certificate chain (ordered with the user's certificate first and the root certificate authority last), or null if the given alias does not exist or does not contain a certificate chain (i.e., the given alias identifies either a trusted certificate entry or a key entry without a certificate chain).

engineGetCreationDateback to summary
public Date engineGetCreationDate(String alias)

Implements abstract java.security.KeyStoreSpi.engineGetCreationDate.

Returns the creation date of the entry identified by the given alias.

Parameters
alias:String

the alias name

Returns:Date

the creation date of this entry, or null if the given alias does not exist

engineGetCreationInstantback to summary
public Instant engineGetCreationInstant(String alias)

Overrides java.security.KeyStoreSpi.engineGetCreationInstant.

Returns the instant that the entry identified by the given alias was created.

Parameters
alias:String

the alias name

Returns:Instant

the instant that the entry identified by the given alias was created, or null if the given alias does not exist

Since
27
engineGetKeyback to summary
public Key engineGetKey(String alias, char[] password) throws NoSuchAlgorithmException, UnrecoverableKeyException

Implements abstract java.security.KeyStoreSpi.engineGetKey.

Returns the key associated with the given alias, using the given password to recover it.

Parameters
alias:String

the alias name

password:char[]

the password for recovering the key

Returns:Key

the requested key, or null if the given alias does not exist or does not identify a key entry.

Exceptions
NoSuchAlgorithmException:
if the algorithm for recovering the key cannot be found
UnrecoverableKeyException:
if the key cannot be recovered (e.g., the given password is wrong).
engineIsCertificateEntryback to summary
public boolean engineIsCertificateEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsCertificateEntry.

Returns true if the entry identified by the given alias is a trusted certificate entry, and false otherwise.

Returns:boolean

true if the entry identified by the given alias is a trusted certificate entry, false otherwise.

engineIsKeyEntryback to summary
public boolean engineIsKeyEntry(String alias)

Implements abstract java.security.KeyStoreSpi.engineIsKeyEntry.

Returns true if the entry identified by the given alias is a key entry, and false otherwise.

Returns:boolean

true if the entry identified by the given alias is a key entry, false otherwise.

engineLoadback to summary
public void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException

Implements abstract java.security.KeyStoreSpi.engineLoad.

Loads the keystore from the given input stream.

If a password is given, it is used to check the integrity of the keystore data. Otherwise, the integrity of the keystore is not checked.

Parameters
stream:InputStream

the input stream from which the keystore is loaded

password:char[]

the (optional) password used to check the integrity of the keystore.

Exceptions
IOException:
if there is an I/O or format problem with the keystore data
NoSuchAlgorithmException:
if the algorithm used to check the integrity of the keystore cannot be found
CertificateException:
if any of the certificates in the keystore could not be loaded
engineSetCertificateEntryback to summary
public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetCertificateEntry.

Assigns the given certificate to the given alias.

If the given alias already exists in this keystore and identifies a trusted certificate entry, the certificate associated with it is overridden by the given certificate.

Parameters
alias:String

the alias name

cert:Certificate

the certificate

Exceptions
KeyStoreException:
if the given alias already exists and does not identify a trusted certificate entry, or this operation fails for some other reason.
engineSetKeyEntryback to summary
public void engineSetKeyEntry(String alias, Key key, char[] password, Certificate[] chain) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given private key to the given alias, protecting it with the given password as defined in PKCS8.

The given java.security.PrivateKey key must be accompanied by a certificate chain certifying the corresponding public key.

If the given alias already exists, the keystore information associated with it is overridden by the given key and certificate chain.

Parameters
alias:String

the alias name

key:Key

the private key to be associated with the alias

password:char[]

the password to protect the key

chain:Certificate[]

the certificate chain for the corresponding public key (only required if the given key is of type java.security.PrivateKey).

Exceptions
KeyStoreException:
if the given key is not a private key, cannot be protected, or this operation fails for some other reason
engineSetKeyEntryback to summary
public void engineSetKeyEntry(String alias, byte[] key, Certificate[] chain) throws KeyStoreException

Implements abstract java.security.KeyStoreSpi.engineSetKeyEntry.

Assigns the given key (that has already been protected) to the given alias.

If the protected key is of type java.security.PrivateKey, it must be accompanied by a certificate chain certifying the corresponding public key. If the underlying keystore implementation is of type jks, key must be encoded as an EncryptedPrivateKeyInfo as defined in the PKCS #8 standard.

If the given alias already exists, the keystore information associated with it is overridden by the given key (and possibly certificate chain).

Parameters
alias:String

the alias name

key:byte[]

the key (in protected format) to be associated with the alias

chain:Certificate[]

the certificate chain for the corresponding public key (only useful if the protected key is of type java.security.PrivateKey).

Exceptions
KeyStoreException:
if this operation fails.
engineSizeback to summary
public int engineSize()

Implements abstract java.security.KeyStoreSpi.engineSize.

Retrieves the number of entries in this keystore.

Returns:int

the number of entries in this keystore

engineStoreback to summary
public void engineStore(OutputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException

Implements abstract java.security.KeyStoreSpi.engineStore.

Stores this keystore to the given output stream, and protects its integrity with the given password.

Parameters
stream:OutputStream

the output stream to which this keystore is written.

password:char[]

the password to generate the keystore integrity check

Exceptions
IOException:
if there was an I/O problem with data
NoSuchAlgorithmException:
if the appropriate data integrity algorithm could not be found
CertificateException:
if any of the certificates included in the keystore data could not be stored
getPreKeyedHashback to summary
private MessageDigest getPreKeyedHash(char[] password) throws NoSuchAlgorithmException

To guard against tampering with the keystore, we append a keyed hash with a bit of extra data.

sun.security.provider back to summary

public final Class JavaKeyStore.CaseExactJKS

extends JavaKeyStore
Class Inheritance

Constructor Summary

AccessConstructor and Description
public
CaseExactJKS()

Method Summary

Modifier and TypeMethod and Description
pack-priv String
convertAlias(String alias)

Implements abstract sun.security.provider.JavaKeyStore.convertAlias.

Inherited from sun.security.provider.JavaKeyStore:
engineAliasesengineContainsAliasengineDeleteEntryengineGetCertificateengineGetCertificateAliasengineGetCertificateChainengineGetCreationDateengineGetCreationInstantengineGetKeyengineIsCertificateEntryengineIsKeyEntryengineLoadengineSetCertificateEntryengineSetKeyEntryengineSetKeyEntryengineSizeengineStore

Constructor Detail

CaseExactJKSback to summary
public CaseExactJKS()

Method Detail

convertAliasback to summary
pack-priv String convertAlias(String alias)

Implements abstract sun.security.provider.JavaKeyStore.convertAlias.

sun.security.provider back to summary

public final Class JavaKeyStore.DualFormatJKS

extends KeyStoreDelegator
Class Inheritance

Constructor Summary

AccessConstructor and Description
public
DualFormatJKS()

Method Summary

Modifier and TypeMethod and Description
public boolean
engineProbe(InputStream stream)

Overrides sun.security.util.KeyStoreDelegator.engineProbe.

Probe the first few bytes of the keystore data stream for a valid JKS keystore encoding.

Inherited from sun.security.util.KeyStoreDelegator:
engineAliasesengineContainsAliasengineDeleteEntryengineEntryInstanceOfengineGetAttributesengineGetCertificateengineGetCertificateAliasengineGetCertificateChainengineGetCreationDateengineGetEntryengineGetKeyengineIsCertificateEntryengineIsKeyEntryengineLoadengineSetCertificateEntryengineSetEntryengineSetKeyEntryengineSetKeyEntryengineSizeengineStore

Constructor Detail

DualFormatJKSback to summary
public DualFormatJKS()

Method Detail

engineProbeback to summary
public boolean engineProbe(InputStream stream) throws IOException

Overrides sun.security.util.KeyStoreDelegator.engineProbe.

Probe the first few bytes of the keystore data stream for a valid JKS keystore encoding.

Annotations
@Override
Exceptions
IOException:

Doc from java.security.KeyStoreSpi.engineProbe.

if there is an I/O problem with the keystore data.

sun.security.provider back to summary

public final Class JavaKeyStore.JKS

extends JavaKeyStore
Class Inheritance

Constructor Summary

AccessConstructor and Description
public
JKS()

Method Summary

Modifier and TypeMethod and Description
pack-priv String
convertAlias(String alias)

Implements abstract sun.security.provider.JavaKeyStore.convertAlias.

Inherited from sun.security.provider.JavaKeyStore:
engineAliasesengineContainsAliasengineDeleteEntryengineGetCertificateengineGetCertificateAliasengineGetCertificateChainengineGetCreationDateengineGetCreationInstantengineGetKeyengineIsCertificateEntryengineIsKeyEntryengineLoadengineSetCertificateEntryengineSetKeyEntryengineSetKeyEntryengineSizeengineStore

Constructor Detail

JKSback to summary
public JKS()

Method Detail

convertAliasback to summary
pack-priv String convertAlias(String alias)

Implements abstract sun.security.provider.JavaKeyStore.convertAlias.

sun.security.provider back to summary

private Class JavaKeyStore.KeyEntry

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv Certificate[]
chain

pack-priv Instant
date

pack-priv byte[]
protectedPrivKey

Constructor Summary

AccessConstructor and Description
private
KeyEntry()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

chainback to summary
pack-priv Certificate[] chain
dateback to summary
pack-priv Instant date
protectedPrivKeyback to summary
pack-priv byte[] protectedPrivKey

Constructor Detail

KeyEntryback to summary
private KeyEntry()
sun.security.provider back to summary

private Class JavaKeyStore.TrustedCertEntry

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
pack-priv Certificate
cert

pack-priv Instant
date

Constructor Summary

AccessConstructor and Description
private
TrustedCertEntry()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

certback to summary
pack-priv Certificate cert
dateback to summary
pack-priv Instant date

Constructor Detail

TrustedCertEntryback to summary
private TrustedCertEntry()