NUHMAN.com

When you're managing a JBoss server and need to extract or download an SSL key pair (public + private key), the process typically involves working with a Java keystore (JKS). Whether for migration, backup, or integration, this guide walks you through safely exporting the SSL key pair used by JBoss.

🔎 Step 1: Locate the Keystore Used by JBoss

Open your standalone.xml or domain.xml file and look for the HTTPS connector configuration, typically under the <subsystem> tag.

It might look like this:

xml

<ssl name="ssl" 
     key-alias="server" 
     password="keystore-password" 
     certificate-key-file="/path/to/keystore.jks" />

Take note of:

• 🔑 key-alias
• 🔐 password
• 📂 certificate-key-file → This is your keystore path.

📤 Step 2: Export the Public Key (Certificate)

You can export the public certificate (which contains the public key) from the keystore using the keytool:

bash

keytool -export \
  -alias server \
  -file publickey.cer \
  -keystore /path/to/keystore.jks

Replace server and the keystore path with your actual values.

This will create a publickey.cer file containing the X.509 certificate (including the public key).

🔓 Step 3: Export the Private Key (Using OpenSSL)

Since keytool doesn’t allow direct extraction of private keys, you'll need to convert the keystore to PKCS12 format, then use OpenSSL to extract the private key.

3.1 Convert JKS to PKCS12:

bash

keytool -importkeystore \
  -srckeystore /path/to/keystore.jks \
  -destkeystore keystore.p12 \
  -srcstoretype JKS \
  -deststoretype PKCS12 \
  -srcalias server \
  -destalias server \
  -deststorepass destination-pass \
  -srcstorepass source-pass

Replace:

• server with your alias
• source-pass and destination-pass with the keystore passwords

3.2 Extract Private Key Using OpenSSL:

bash

openssl pkcs12 -in keystore.p12 -nocerts -out privatekey.pem -nodes

✅ This will give you privatekey.pem — your private key in PEM format.

📁 Final Result

FileDescriptionpublickey.cerX.509 Certificate (Public Key)privatekey.pemPEM-formatted Private Keykeystore.p12PKCS12 version of the JBoss keystore (intermediate step)

You now have the full SSL key pair extracted from your JBoss server.

🛡 Security Tips

• NEVER expose your private key in public or insecure environments.
• Store your privatekey.pem in a secure location (e.g., an encrypted vault).
• Rotate keys regularly in production environments.