Importing Keystore

The command "importkeystore" is used to import an entire keystore into another keystore, which means all entries from the source keystore, including keys and certificates, are all imported to the destination keystore within a single command. You can use this command to import entries from a different type of keystore. During the import, all new entries in the destination keystore will have the same alias names and protection passwords (for secret keys and private keys). If keytool has difficulties recover the private keys or secret keys from the source keystore, it will prompt you for a password. If it detects alias duplication, it will ask you for a new one, you can specify a new alias or simply allow keytool to overwrite the existing one.

For example, to import entries from a normal JKS type keystore key.jks into a PKCS #11 type hardware based keystore, you can use the command:

keytool -importkeystore
 -srckeystore key.jks -destkeystore NONE
 -srcstoretype JKS -deststoretype PKCS11
 -srcstorepass changeit -deststorepass topsecret

Note: keytool does not support PKCS #11 type keystores on the z/OS® operating system.

The importkeystore command can also be used to import a single entry from a source keystore to a destination keystore. In this case, besides the options you see in the previous example, you need to specify the alias you want to import. With the srcalias option given, you can also specify the desination alias name in the command line, as well as protection password for a secret/private key and the destination protection password you want. In this way, you can issue a keytool command that will never ask you a question. This makes it very convenient to include a keytool command into a script file, like this:

keytool -importkeystore
 -srckeystore key.jks -destkeystore NONE
 -srcstoretype JKS -deststoretype PKCS11
 -srcstorepass changeit -deststorepass topsecret
 -srcalias myprivatekey -destalias myoldprivatekey
 -srckeypass oldkeypass -destkeypass mynewkeypass
 -noprompt

Note: keytool does not support PKCS #11 type keystores on the z/OS operating system.