KC 26.5.2 - Importing an existing private key into Keycloak using a java-keystore key provider #45951

rober12 · 2026-02-03T08:29:51Z

rober12
Feb 3, 2026

Question

Hello everyone,

I am trying to configure a Key Provider of type java-keystore in Keycloak and I am struggling to understand how to properly import an existing private key.

In my case, I already have a pair of keys that:

Are available in HEX and JWK formats, and I understand that Keycloak ultimately expects keys to be provided via a PKCS#12 or JKS keystore, but I am not sure what the correct process is to transform my existing keys into one of these formats.
Are associated with a DID registered in EBSI.
Must be used by Keycloak to sign Verifiable Credentials, so that the signing key matches the DID of the issuer, instead of using a Keycloak-generated key.

My questions are the following:

How can an existing private key be imported into Keycloak when using a java-keystore provider?
The configuration seems to expect a path to the keystore file, but the documentation does not clearly specify:
- Whether the key must be in PEM, PKCS#12 (.p12 / .pfx), JKS, or another format.
- Whether certificates are mandatory or if a private key alone is sufficient.
What are the concrete steps to make this work end to end?

I suspect this might be something obvious, but I am having a hard time understanding how all the pieces fit together.

The motivation behind this is that I already have issuer keys bound to a DID, and I want Keycloak to use those exact keys when issuing Verifiable Credentials, instead of generating and managing its own issuer keys.

Any guidance, clarification, or examples would be greatly appreciated.

I found and example of how to create a Java keystore from scratch (https://github.com/keycloak/keycloak-oauth-sig/blob/main/oid4vci-deployment/src/utils/crypto/generate_keystore.sh#L21), but I want to create a Java keystore from an existing private key.

Thank you very much in advance.

rober12 · 2026-02-04T14:17:20Z

rober12
Feb 4, 2026
Author

I resolve it!

2 replies

dalbani Feb 25, 2026

Could you explain how you did it, @rober12?
That would be useful for other people (like me 😄) to do the same.

rober12 Feb 26, 2026
Author

Hi @dalbani , yes of course — below are the steps I followed.

First of all, it’s important to know which formats Keycloak supports. These are:

JKS
PKCS12
BCFKS

I managed to get it working with PKCS12. I didn’t test the others.

Once you know which formats are supported by Keycloak, what I did was convert my keys from JWK format to PKCS12 format. This was not easy — I had to do quite a bit of research. The steps were as follows:

Convert the keys from JWK to PEM.
Once you have the PEM file, use OpenSSL to generate the PKCS12 file.

After you have the keys in PKCS12 format, you need to mount a volume in the Keycloak container so that the key is available in a path like: /opt/keycloak/target/YOUR_KEY.pcks12

After completing this process, go to the Keycloak Admin Console and navigate to:

Realm Settings → Keys → Add Provider → Java keystore

In the Keystore field, enter the path /opt/keycloak/target/YOUR_KEY.pcks12, then fill in the remaining fields, and that’s it.

I hope this helps.

Navigation Menu

Repository navigation

KC 26.5.2 - Importing an existing private key into Keycloak using a java-keystore key provider #45951

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

KC 26.5.2 - Importing an existing private key into Keycloak using a java-keystore key provider #45951

Uh oh!

Uh oh!

rober12 Feb 3, 2026

Replies: 1 comment · 2 replies

Uh oh!

rober12 Feb 4, 2026 Author

Uh oh!

dalbani Feb 25, 2026

Uh oh!

rober12 Feb 26, 2026 Author

rober12
Feb 3, 2026

Replies: 1 comment 2 replies

rober12
Feb 4, 2026
Author

rober12 Feb 26, 2026
Author