Difference between trustStore and keyStore in Java - SSL

trustStore vs keyStore in Java

trustStore and keyStore are used in context of setting up SSL connection in Java application between client and server. TrustStore and keyStore are very much similar in terms of construct and structure as both are managed by keytoolcommand and represented by KeyStore programatically but they often confused Java programmer both beginners and intermediate alike. Only difference between trustStore and keyStore is what they store and there purpose. In SSL handshake purpose of trustStore is to verify credentials and purpose of keyStore is to provide credential. keyStore in Java stores private key and certificates corresponding to there public keys and require if you are SSL Server or SSL requires client authentication. TrustStore stores certificates from third party, your Java application communicate or certificates signed by CA(certificate authorities like Verisign, Thawte, Geotrust or GoDaddy) which can be used to identify third party. This is second article on setting up SSL on Java program, In last post we have seen How to import SSL certificates into trustStore and keyStore and In this Java article we will some differences between keystore and truststore in Java, which will help to understand this concept better.

Difference between trustStore and keyStore in Java

Here is the list of most common difference between keyStore and trustStore. I have already mentioned key difference in first paragraph which is related to purpose of keyStore and trustStore, which we will see here is little more detail.

1)First and major difference between trustStore and keyStore is that trustStore is used by TrustManager and keyStore is used by KeyManager class in Java. KeyManager and TrustManager performs different job in Java, TrustManager determines whether remote connection should be trusted or not i.e. whether remote party is who it claims to and KeyManager decides which authentication credentials should be sent to the remote host for authentication during SSL handshake. if you are an SSL Server you will use private key during key exchange algorithm and send certificates corresponding to your public keys to client, this certificate is acquired from keyStore. On SSL client side, if its written in Java, it will use certificates stored in trustStore to verify identity of Server. SSL certificates are most commonly comes as .cer file which is added into keyStore or trustStore by using any key management utility e.g. keytool. See my post How to add certificates into trustStore for step by step guide on adding certificates into keyStore or trustStore in Java.

2) Another difference between trustStore and keyStore in rather simple terms is that keyStore contains private keys and required only if you are running a Server in SSL connection or you have enabled client authentication on server side. On the other hand trustStore stores public key or certificates from CA (Certificate Authorities) which is used to trust remote party or SSL connection.

3)One more difference between trustStore vs KeyStore is that we use -Djavax.net.ssl.keyStore to specify path for keyStore and -Djavax.net.ssl.trustStore to specify path for trustStore in Java.

4) Another difference between trustStore and keyStore is that, If you store your personal certificate along with signer certificate in trustStore, you can use same file as both trustStore and keyStore. By the way its good idea to separate personal certificate and signer certificates in keyStore and trustStore for better management.

5) One more API level difference between keyStore and trustStore is that password of keyStore is provided using -Djavax.net.ssl.keyStorePassword and password of trustStore is provided using -Djavax.net.ssl.trustStorePassword.

That’s all on difference between trustStore and keyStore in Java. You can still use same file as trustStore and keyStore in Java to avoid maintaining two separate files, but its good idea to segregate public keys and private keys in two different files, its more verbose and self explanatory that which one holds CA certificates to trust server and which contains client's private keys.

总之，keyStore是用于存放自己keytool产生的key(public/private) （浏览器是否相信server, public key经过CA签名用于商业SSL）, truststore用于存放第三方提供的经过CA认证的public key(用于server是否相信第三方连接)