KeyStore

A keystore is a secure storage facility for cryptographic keys and certificates used by software to establish trust and enable cryptographic operations. It typically stores private keys along with their public key certificates in a chain of trust, or it may function as a repository of trusted certificates without private keys.

Keystores are commonly implemented as files, sometimes backed by hardware devices. Common formats include Java KeyStore (JKS), PKCS#12 (.p12, .pfx), Java's JCEKS, and Android's BKS. A keystore requires a password to access and, in many formats, individual keys can have their own passwords.

They are used in TLS/SSL to present a server or client certificate, in code signing to sign software, and in S/MIME for email, among others. Typical operations include creating a key pair, generating a certificate signing request, importing certificates, and exporting certificates. A truststore is a related concept that stores certificates you trust but do not own.

Security considerations include protecting keystore files with strong passwords, restricting access, backing up securely, rotating keys, and considering hardware-backed storage such as a hardware security module (HSM) or secure enclaves. When migrating between formats, verify compatibility and preserve the integrity of the key material.

Differences: a keystore often contains private keys and their certificate chains; a truststore contains only trusted certificates. Some ecosystems use the same file type for both but configure them differently within applications.