(Objective-C) Load Java KeyStore and Access Contents

Loads a Java keystore file and iterates over the contents. A Java keystore (.jks) file can contain one or more trusted root certificate entries and/or one or more private key entries. Each private key entry includes an associated certificate chain.

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoJavaKeyStore.h>
#import <CkoCert.h>
#import <NSString.h>
#import <CkoPrivateKey.h>
#import <CkoCertChain.h>

BOOL success = NO;

// This requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

CkoJavaKeyStore *jks = [[CkoJavaKeyStore alloc] init];

// Load the Java keystore from a file.  The JKS file password is used
// to verify the keyed digest that is found at the very end of the keystore.
// It verifies there has been no tampering with the file.
success = [jks LoadFile: @"jksFilePassword" path: @"/someDir/keyStore.jks"];
if (success == NO) {
    NSLog(@"%@",jks.LastErrorText);
    return;
}

// Find out how many of each type of entry:
int numTrustedCerts = [jks.NumTrustedCerts intValue];
int numPrivateKeys = [jks.NumPrivateKeys intValue];

CkoCert *cert = [[CkoCert alloc] init];
NSString *alias = 0;

// For each trusted certificate, access it by getting
// it as a cert object.  Also get the alias associated with the certificate.
NSLog(@"%@",@"Trusted Certs:");
int i = 0;
while (i < numTrustedCerts) {
    success = [jks TrustedCertAt: [NSNumber numberWithInt: i] cert: cert];
    NSLog(@"%@%@%@",[jks GetTrustedCertAlias: [NSNumber numberWithInt: i]],@": ",cert.SubjectDN);
    i = i + 1;
}

CkoPrivateKey *privKey = [[CkoPrivateKey alloc] init];
CkoCertChain *certChain = [[CkoCertChain alloc] init];

// For each private key entry, get the private key and
// the associated certificate chain.
// Each private key is password protected.  Usually it is the same
// password as used for the keyed digest of the entire JKS.  
// However, this does not have to be.  The password is passed
// here to handle the possibility of each private key requiring
// a different password.
NSLog(@"%@",@"Private Keys:");
i = 0;
while (i < numPrivateKeys) {
    [jks PrivateKeyAt: @"jksFilePassword" index: [NSNumber numberWithInt: i] privKey: privKey];
    NSLog(@"%@",[jks GetPrivateKeyAlias: [NSNumber numberWithInt: i]]);
    [jks CertChainAt: [NSNumber numberWithInt: i] certChain: certChain];

    // The 1st certificate in the chain is the one associated with the private key.
    [certChain CertAt: [NSNumber numberWithInt: 0] cert: cert];
    NSLog(@"%@",cert.SubjectDN);

    i = i + 1;
}