Features
KeyStore Explorer currently supports the following features. Note that the application is being continuously developed and future versions will contain additional features to those listed below.
Full specifications are available for KeyStore Explorer, including supported algorithms, key sizes and file formats.
KeyStore Management Features
- Create, load and save various KeyStore types:
- PKCS #12
- JKS
- JCEKS
- BKS
- UBER
- BCFKS
- PEM
- KDB (IBM CMS)
- Conversion between these KeyStore types.
- Access the Windows Certificate Store and Apple Keychain as KeyStores.
- Change KeyStore passwords.
- Store and manage KeyStore passwords with the built-in password manager.
- Store arbitrary passwords/passphrases as secret key entries.
- Delete or rename KeyStore entries.
- Cut/copy/paste KeyStore entries.
- Search for KeyStore entries.
- Export the KeyStore entry table as CSV.
- Reload KeyStores when they change on disk.
- Configure a CA Certs KeyStore for use with KeyStore operations.
Key Pair Features
- Generate RSA, DSA and EC (incl. Ed25519/Ed448, SM2 and ECGOST) key pairs with self-signed X.509 certificates.
- Generate post-quantum ML-DSA, ML-KEM and SLH-DSA key pairs.
- Apply X.509 certificate extensions to generated key pairs and Certificate Signing Requests (CSRs).
- Import key pairs from PKCS #12 files.
- Import key pairs from PKCS #8 private key/certificate combination files.
- Import key pairs from Microsoft PVK private key/certificate combination files.
- Import key pairs from OpenSSL private key/certificate combination files.
- Import key pairs from JWK (JSON Web Key) files.
- Generate CSRs in PKCS #10 and SPKAC formats.
- Import Certificate Authority (CA) replies.
- Export key pairs as PKCS #12.
- Export private keys as PKCS #8.
- Export private keys as Microsoft PVK.
- Export private keys as OpenSSL.
- Export public and private keys as JWK, incl. as encrypted JWE.
- Change the password of key pair entries.
- Append certificates to key pair certificate chains.
Certificate Features
- Import X.509 certificate files as trusted certificates.
- View the details of certificates contained within KeyStore entries, certificate files and TLS/SSL web sites.
- Export certificates in a variety of formats (X.509, PKCS #7, PKI Path, SPC).
- Export certificate public keys in OpenSSL (SubjectPublicKeyInfo) format.
- View the details of Certificate Revocation List (CRL) files.
- View X.509 Certificate, CRL and CRL entry X.509 V3 extensions.
- Validation of certificates (signature verification, path validation, revocation status checks).
Digital Signature Features
- Sign CSRs in PKCS #10 and SPKAC formats.
- Create and sign key pairs with a CA certificate in one step.
- Sign CRLs (Certificate Revocation Lists)
- Sign and Verify Java Archive (JAR) files.
- Add a timestamp to jar signatures.
- Sign J2ME MIDlet Applications files.
- Sign and Verify JWT (JSON Web Token) files.
- Sign and Verify PKCS#7/CMS files.