Hello, I've always thought that the keystore password and the key password itself had to be the same in a PKCS12 keystore, due to constraints in the PKCS#12 format. It appears this is not quite the case with the Java implementation, especially with a PKCS#12 store generated with keytool.
When importing a PKCS#12 store into another PKCS#12 store, keytool changes the store password, but doesn't change the actual key password. However, keytool -keypasswd doesn't allow to change the key password itself on a PKCS#12 store. To test this, generate a PKCS#12 keystore (keystore1.p12): keytool -genkeypair -dname "CN=test" -storetype PKCS12 -keystore keystore1.p12 -storepass testabcd Import/export this store into another PKCS#12 keystore (keystore2.p12): keytool -importkeystore -srckeystore keystore1.p12 -srcstoretype PKCS12 -srcstorepass testabcd -destkeystore keystore2.p12 -deststoretype PKCS12 -deststorepass test1234 This will change the store password from testabcd to test1234, but the key password will still be testabcd. This can be tested with the following code: KeyStore ks = KeyStore.getInstance("PKCS12"); InputStream ksis = new FileInputStream("keystore2.p12"); try { ks.load(ksis, "test1234".toCharArray()); // New password } finally { if (ksis != null) { ksis.close(); } } KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory .getDefaultAlgorithm()); // New password, fails: kmf.init(ks, "test1234".toCharArray()); // Old password, works: // kmf.init(ks, "testabcd".toCharArray()); I must admit I'm not familiar with the details of the PKCS#12 specifications, but I think all the other tools I've seen that use the PKCS#12 format only have a password for the store, not for the individual keys. In fact, it seems that Firefox is capable of importing and using keystore2.p12 from the example above using only the store password, despite producing an error message. Shouldn't keytool -importkeystore also change the key passwords (or at least there seems to be a padding issue)? Here is the error message: Caused by: javax.crypto.BadPaddingException: Given final block not properly padded at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:811) at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:676) at com.sun.crypto.provider.PKCS12PBECipherCore.implDoFinal(PKCS12PBECipherCore.java:355) at com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede.engineDoFinal(PKCS12PBECipherCore.java:387) at javax.crypto.Cipher.doFinal(Cipher.java:2087) ... 6 more Best wishes, Bruno.