How to add key pair of SSH ID file to JKS keystore

Question

One of the tasks of the Java application that I create is to connect to a remote SFTP server. For this, I have the certificate of the remote machine and the local identifier ( id_rsaand id_rsa.pubin the folder .ssh). This works fine.

I would like to put the certificate and identity in a password protected java keystore for simplification and more secure configuration. This works for me for a certificate, but I'm having problems storing SSH authentication in a JKS or PKCS12 key store (any of them will work).

To isolate the problem, I tried the following steps:

I use ssh-keygen -b 2048to create two identification files id_rsa_demoand id_rsa_demo.pubin a local directory. As far as I understand, these are private and public identifier keys, so I'm trying to combine them into a file identity.p12:

openssl pkcs12 -export \
               -inkey "id_rsa_demo" \
               -in "id_rsa_demo.pub" \
               -out "identity.p12" \
               -password "pass:topsecret" \
               -name "demoalias"

This gives me an error unable to load certificates. I searched around and it seems that openssl is expecting a certificate with a full chain for the parameter -in. Since my generated identifier does not have this, I tried a parameter -nocerts, for example:

openssl pkcs12 -export \
               -inkey "id_rsa_demo" \
               -in "id_rsa_demo.pub" \
               -out "identity.p12" \
               -password "pass:topsecret" \
               -name "demoalias" \
               -nocerts

I get no errors, but the option is -nocertsas promised and does not add my public key to the pkcs12 file:

openssl pkcs12 -info -in identity.p12 

Enter Import Password:
MAC Iteration 2048
MAC verified OK
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
Bag Attributes
    friendlyName: demoalias
Key Attributes: <No Attributes>
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIAOXpzckBb28CAggA
MBQGCCqGSIb3DQMHBAjPq9ibr445xQSCBMi5IlOk5F28kQPB5D97afiUb5d3It46
...
ejwYfHTj6bm+dEOUk68zNrWwKqwuJx5AZv3U8sm1cicVmh9W0HpL5tSmMMpDS1ey
Uos=
-----END ENCRYPTED PRIVATE KEY-----

Is there a way to store the SSH identifier in a PKCS12 or JKS key store?

Answer 1

Suppose you have a private key that looks like this:

id_rsa

-----BEGIN RSA PRIVATE KEY-----
MIICWgIBAAKBgQCh3czej+KeEraesxts3xP6kx+cO/Fu8ROc/k4hSl7fO9jFZ6Lm
OsGlzsRsi8VDg9n/fh6iFng/Umgnfd4J0IiLQihSRYnvyOsqqXbIJ8mBtydqO4s+
CjZLLDRSEMx3dw6GhFOcQ7xYYOeUMNY8QFidPn2LjURfMxG9XWOrCww8rwIBJQKB
gGA+sSpjZCajV9P7yx4jxrCqgX99lnlREpSy4lj7ybUqgOQUG6t84dg1wOaYS8dH
erOXGSIbMr3d+L2JHD0v4ntcKqzJm6Nf1FE27V0hvpzZl3fNax4NI/cIXM78zBx4
lBblr5QMYnTSd5eADIcDy7TZHuScRPkPViQ2x9QPayQ9AkEA67lfOXFEJ8iTYHdu
ykvj0Xqcs/peDX5nYXCEJ2XECxgxfKYVbQPazO5ACgp1VsgFMCsd4rDSwahOAgkE
rGfgCwJBAK/KFkSqMCLga8m19uqOftTQ+GhFc0O1lchWQ0A99+b9Rcs0yAe10GCN
SbgrEmMuXEQS1emT6ZHM7KIh2P7kiG0CQQDSPYxH/TzJiWDZf0cjIRdMIT+ncJkS
9DKw2flTkh2NWsRaap1858MleowkoYs/j81Gov76nbUNlhwPpy2uhiivAkByBor8
G11+aA6QrWHkQMD4vuZReSgr62gTPt+DndE74o4i8c3bfNowyllU3asP5rhjgdbc
svheksMBYhA2ohNNAkAiKQdv08UAG77piJi09OFIEcetTiq/wy9Zeb6fmEuMFzsT
2aR6x0d43OXqAgcKFgFuzqdXgxqhP/n9/eIqXdVA
-----END RSA PRIVATE KEY-----

:

1) , , keytool .

openssl x509 -signkey id_rsa -req -in example.req

2) .

openssl x509 -signkey id_rsa -req -in example.req -out example.cer

keytool.

cat example.cer id_rsa > example.full
keytool -import -keystore example.jks -file example.full

. SSH/SFTP .