 <p>The terminology is a bit confusing indeed, but both <code>javax.net.ssl.keyStore</code> and <code>javax.net.ssl.trustStore</code> are used to specify which keystores to use, for two different purposes. Keystores come in various formats and are not even necessarily files (see <a href="http://stackoverflow.com/questions/6157550/question-on-java-keystores/6157716#6157716">this question</a>), and <code>keytool</code> is just a tool to perform various operations on them (import/export/list/...).</p> <p>The <code>javax.net.ssl.keyStore</code> and <code>javax.net.ssl.trustStore</code> parameters are the default parameters used to build <code>KeyManager</code>s and <code>TrustManager</code>s (respectively), then used to build an <code>SSLContext</code> which essentially contains the SSL/TLS settings to use when making an SSL/TLS connection via an <code>SSLSocketFactory</code> or an <code>SSLEngine</code>. These system properties are just where the default values come from, which is then used by <code>SSLContext.getDefault()</code>, itself used by <code>SSLSocketFactory.getDefault()</code> for example. (All of this can be customized via the API in a number of places, if you don't want to use the default values and that specific <code>SSLContext</code>s for a given purpose.)</p> <p>The difference between the <code>KeyManager</code> and <code>TrustManager</code> (and thus between <code>javax.net.ssl.keyStore</code> and <code>javax.net.ssl.trustStore</code>) is as follows (quoted from the <a href="http://download.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#RelsTM_KM">JSSE ref guide</a>):</p> <blockquote> <p>TrustManager: Determines whether the remote authentication credentials (and thus the connection) should be trusted.</p> <p>KeyManager: Determines which authentication credentials to send to the remote host.</p> </blockquote> <p>(Other parameters are available and their default values are described in the <a href="http://download.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#Customization">JSSE ref guide</a>. Note that while there is a default value for the trust store, there isn't one for the key store.)</p> <p>Essentially, the keystore in <code>javax.net.ssl.keyStore</code> is meant to contain your private keys and certificates, whereas the <code>javax.net.ssl.trustStore</code> is meant to contain the CA certificates you're willing to trust when a remote party presents its certificate. In some cases, they can be one and the same store, although it's often better practice to use distinct stores (especially when they're file-based).</p>