title: Java keystore - compatibility java 8 & 11
body: <p>I need to generate a java keystore, using java 11, and be able to use it in both java 8 and java 11. I'm using format PKCS12. For some reason, when I generate it, using keytool from java 11, the keytool from java 8 can't open it.</p>
  <p>Generating using java 11</p>
  <pre><code>(java 11)$ keytool -genkeypair -keyalg RSA -noprompt -alias key -dname &quot;CN=hostname, OU=XX, O=XX, L=YY, S=CZ, C=CZ&quot; -keystore file.p12 -storepass password -keypass password -deststoretype pkcs12
  </code></pre>
  <p>For java 11 the keystore is fine and working. But if I try to read it using java 8</p>
  <pre><code>(java 8)$ keytool -list -keystore file.p12 
  keytool error: java.io.IOException: Invalid keystore format
  </code></pre>
  <p>Why is this happening? I thought PKCS12 is a standardized format, and should be universal. But for some reason it's not working even between java versions.</p>
  <p>I was able to solve this issue by switching keytool to legacy generating, using switch <code>-J-Dkeystore.pkcs12.legacy</code>.</p>
  <p>I want to change my project to generate keystore in code. Something like:</p>
  <pre><code>KeyStore ks = KeyStore.getInstance(&quot;pkcs12&quot;);
  ks.load(null, password);
  ks.setKeyEntry(keyAlias, keyPair.getPrivate(), password, certChain);
  ks.store(output, password);
  </code></pre>
  <p>But I've encountered same issue. If I generate it in java 11, then java 8 is not able to open it (not using keytool neither in java code). Is there a way to make <code>KeyStore</code> class to generate keystore in &quot;compatible&quot; format? Or any other way to generate a keystore in code, so it is compatible?</p>