Convert the Java JKS key-store to Microsoft PFX format

Copyright © 2004, 2005 TJ

The GNU General Public License version 2 or later applies to my ExportPrvKey.class. See http://www.gnu.org/licenses/gpl.html

Here's how to get and use a code-signing Thawte digital certificate to sign your Java JAR and Microsoft CAB, EXE, DLL, VBscript, etc. code, to create trusted applets for downloading over the Internet, and to convert the Java JKS key-store to P12/Microsoft PFX (Personal Information Exchange) format to share the same certificate with Java JAR files and Microsoft CAB files.

This allows software authors to increase the range of activities the Java Security Manager will permit.

Contents

• Overview
• Download and Install Tools
• Personal Freemail account at Thawte
• Request a Free Test Certificate
• Create a New Java Key/Certificate Pair
• Generate a Certificate Signing Request
• Import Thawte Certificate to Sun Java JKS Key-store
• Convert Sun Java JKS Keystore to Microsoft PFX format
• Import Key & Certificate to Microsoft Key-store
• Sign a Java JAR File
• Sign a Microsoft CAB file
• Observations

Import Key & Certificate to Microsoft Key-store

Double-click the certificate.pfx file in the CodeSigning folder. The Windows Certificate Import Wizard will start.

Select the CodeSigning\certificate.pfx file.

Type the password, and select Mark this key as exportable. This will allow you to export the key (for safe keeping or other uses) in the future.

Let Windows decide where to store the certificate.

Confirm the details are correct.

If all goes well, the key and certificate will have been imported successfully.

Check the certificate is listed correctly. Start Internet Explorer and choose Tools menu, Internet Options...

Choose the Content tab and press the Certificates... button.

You'll see a list of certificates. Here you can see I have two. The first is my regular email certificate, the second is the new code-signing certificate. Press the View button to check it.

Choose the Details tab, and select the Subject field. You will see your email address in the Value column.

You're now ready to sign code with your key.

If you have any comments or simply find this guide a useful time-saver I'd welcome hearing from you. You can email me at codesigning@tjworld.net.

© Copyright 2004, 2005 TJ. You are welcome to link directly to this article and make a non-public personal copy (not redistributed or republished). The article must remain in XHTML form (mustn't be converted to proprietary formats such as PDF or DOC). If you would like to include it in a commercial service (e.g. a subscription or advertiser-supported web site) please ask.