title: How to add SSH identity file keypair to JKS keystore
body: <p>One of the tasks of a Java application I am building is to connect to a remote SFTP server. In order to do that I have the certificate of the remote machine and a local identity (<code>id_rsa</code> and <code>id_rsa.pub</code> in the <code>.ssh</code> folder). This is working fine.</p>
  
  <p>I'd like to put the certificate and the identity in a password protected java keystore for easier and more secure configuration. I have this working for the certificate, but I am having problems storing the SSH identity in a JKS or PKCS12 keystore (either one would work).</p>
  
  <p>To isolate the problem I have tried the following steps:</p>
  
  <p>I use <code>ssh-keygen -b 2048</code> to create the two identity files <code>id_rsa_demo</code> and <code>id_rsa_demo.pub</code> in te local directory. As I understand these are the private and public keys of the identity, so I try to combine those into an <code>identity.p12</code> file:</p>
  
  <pre><code>openssl pkcs12 -export \
                 -inkey "id_rsa_demo" \
                 -in "id_rsa_demo.pub" \
                 -out "identity.p12" \
                 -password "pass:topsecret" \
                 -name "demoalias"
  </code></pre>
  
  <p>This gives me the error <code>unable to load certificates</code>. I searched around and it seems that openssl expects a certificate with a complete chain for the <code>-in</code> parameter. Since my generated identity does not have that, I tried the <code>-nocerts</code> option, like so:</p>
  
  <pre><code>openssl pkcs12 -export \
                 -inkey "id_rsa_demo" \
                 -in "id_rsa_demo.pub" \
                 -out "identity.p12" \
                 -password "pass:topsecret" \
                 -name "demoalias" \
                 -nocerts
  </code></pre>
  
  <p>I get no errors, but the <code>-nocerts</code> option lives up to its promise and does not add my public key to the pkcs12 file:</p>
  
  <pre><code>openssl pkcs12 -info -in identity.p12 
  
  Enter Import Password:
  MAC Iteration 2048
  MAC verified OK
  PKCS7 Data
  Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
  Bag Attributes
      friendlyName: demoalias
  Key Attributes: &lt;No Attributes&gt;
  Enter PEM pass phrase:
  Verifying - Enter PEM pass phrase:
  -----BEGIN ENCRYPTED PRIVATE KEY-----
  MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIAOXpzckBb28CAggA
  MBQGCCqGSIb3DQMHBAjPq9ibr445xQSCBMi5IlOk5F28kQPB5D97afiUb5d3It46
  ...
  ejwYfHTj6bm+dEOUk68zNrWwKqwuJx5AZv3U8sm1cicVmh9W0HpL5tSmMMpDS1ey
  Uos=
  -----END ENCRYPTED PRIVATE KEY-----
  </code></pre>
  
  <p>Is there a way to store an SSH identity into a PKCS12 or JKS keystore?</p>