# Keytool error: java.io.IOException: Invalid keystore format

**URL:** <https://discuss.elastic.co/t/keytool-error-java-io-ioexception-invalid-keystore-format/328939>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 30, 2023, 12:55pm UTC](https://discuss.elastic.co/t/keytool-error-java-io-ioexception-invalid-keystore-format/328939 "2023-03-30T12:55:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dr01](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dr01/32/8482_2.png) [@dr01](https://discuss.elastic.co/u/dr01)\
**Post date:** [March 30, 2023, 12:55pm UTC](https://discuss.elastic.co/t/keytool-error-java-io-ioexception-invalid-keystore-format/328939/1 "2023-03-30T12:55:10Z")

</div>

I have Elasticsearch 7.17.  
Following the generation of new SSL certificates, I have created a new keystore via the command

> /usr/share/elasticsearch/bin/elasticsearch-keystore create

and I'm trying to add the CA certificate to it:

> keytool -importcert -trustcacerts -noprompt -keystore /etc/elasticsearch/elasticsearch.keystore -file /etc/elasticsearch/certs/ca.crt

However, I get the following error:

**keytool error: java.io.IOException: Invalid keystore format**

I have converted the CA cert into PKCS12 and tried to import it in such format (ca.p12), since the keystore is defined as of type PKCS12 in /etc/elasticsearch/elasticsearch.yml, but I get the same error.

What's wrong? Thanks in advance.

Excerpts of the /etc/elasticsearch/elasticsearch.yml file:

> xpack.security.transport.ssl.keystore.path: elasticsearch.keystore  
> xpack.security.transport.ssl.keystore.type: PKCS12  
> xpack.security.transport.ssl.truststore.path: elasticsearch.keystore  
> xpack.security.transport.ssl.truststore.type: PKCS12  
> xpack.security.transport.ssl.verification\_mode: certificate

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [March 30, 2023, 11:39pm UTC](https://discuss.elastic.co/t/keytool-error-java-io-ioexception-invalid-keystore-format/328939/2 "2023-03-30T23:39:12Z")

</div>

The `elasticsearch-keystore` file is _not_ the a SSL keystore. It is used to store passwords to SSL keystore files. Since keytool is meant to manipulate SSL keystore files, it won't work with `elasticsearch.keystore` file.

I suggest you have a read on the [basic security setup page](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-basic-setup.html) for details.

---

<div class="post-metadata">

**Author:** ![jba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jba/32/118482_2.png) [@jba](https://discuss.elastic.co/u/jba)\
**Post date:** [March 31, 2023, 8:40pm UTC](https://discuss.elastic.co/t/keytool-error-java-io-ioexception-invalid-keystore-format/328939/3 "2023-03-31T20:40:24Z")

</div>

As @Yang_Wang said, the `elasticsearch-keystore` utility is for manipulating a little "database" of mainly usernames and passwords (and maybe something else), while the `keytool` is a standard Java thing for manipulating a different type of database/keystore.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2023, 8:41pm UTC](https://discuss.elastic.co/t/keytool-error-java-io-ioexception-invalid-keystore-format/328939/4 "2023-04-28T20:41:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.