title: Java keystore failed PKCS12 integrity checking but keytool works
body: <p>I have some PCKS12 certificate that is being served by two environments differently. When we upload it to a DEV environment, java can parse it. But it fails on a PRODuction. The server is Microsoft DotNet solution which is responsible for a certificate manipulation. The generated keystore has empty password. When I open the certificate in Windows I can successfully import it into the operating system - without a password.</p>
  
  <p>I can list <em>DEV</em> certificate with keytool but the representation is strange:</p>
  
  <pre><code>Keystore type: PKCS12
  Keystore provider: SunJSSE
  
  Your keystore contains 1 entry
  
  Alias name: {8c6xx9f-8041-49d2-95f7-3bcffxxxc8bcf}
  Creation date: 15.5.2018
  Entry type: PrivateKeyEntry
  
  *******************************************
  *******************************************
  </code></pre>
  
  <p>But I can open it in java </p>
  
  <pre><code>KeyStore keyStore = KeyStore.getInstance("pkcs12");
  keyStore.load(fis, "".toCharArray());
  </code></pre>
  
  <p>And browse it with Keystore Explorer:
  <a href="https://i.stack.imgur.com/Cjqjc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Cjqjc.png" alt="enter image description here"></a></p>
  
  <p>I can list the <em>PROD</em> certificate correctly with keytool:</p>
  
  <pre><code>Keystore type: PKCS12
  Keystore provider: SunJSSE
  
  Your keystore contains 1 entry
  
  Alias name: {9exx43e-83f8-405d-8f74-8b1xxxeaac37}
  Creation date: 15.5.2018
  Entry type: PrivateKeyEntry
  Certificate chain length: 1
  Certificate[1]:
  Owner: OID.2.5.4.13=YCCere01, CN=CZ7, DC=CZ
  Issuer: CN=EET CA 1, O=Česká Republika ? Generální finanční ředitelství, DC=CZ
  Serial number: 84cxxxc6
  Valid from: Wed May 09 16:11:43 CEST 2018 until: Sun May 09 16:11:43 CEST 2021
  Certificate fingerprints:
           MD5:  21:CB:24:AE:4D:F5:EE:4D:C9:6A:A0:DD:AA:2F:6F:A8
           SHA1: 02:0F:6B:C2:B8:E5:18:16:F9:49:28:4F:9E:F6:63:5C:D0:6E:6B:95
           SHA256: B8:37:57:66:1A:33:31:BD:DB:4E:AB:9C:E5:31:C3:18:2B:96:88:A9:1B:21:85:30:97:D9:BB:F7:84:7B:4A:52
           Signature algorithm name: SHA256withRSA
           Version: 3
  </code></pre>
  
  <p>But both java and Keystore Explorer fails to open it:</p>
  
  <pre><code>Exception in thread "main" java.io.IOException: Integrity check failed: 
  java.lang.SecurityException: Failed PKCS12 integrity checking
  at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2058)
  at java.security.KeyStore.load(KeyStore.java:1445)
  at Main.main(Main.java:17)
  Caused by: java.lang.SecurityException: Failed PKCS12 integrity checking
  at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2054)
  </code></pre>
  
  <p>Any idea where is the problem? The password is really empty because I was able to import the key into Windows without it. Keytool can list its content - so why does java API fail to open it with PKCS12 integrity checking error?</p>