Loads a private key and its certificate chain from a keystore file, to be presented as this side's identity during a TLS handshake (or, inside wsSecurity, to sign a message). See tutorials/web-services-security/50-Sign-And-Validate-Body.yaml.


 keystore:
   location: <file>
   [ password: <password> ]        # default: keyPassword
   [ keyPassword: <password> ]     # default: changeit
   [ keyAlias: <alias> ]           # default: the keystore's first key entry
   [ type: PKCS12 | JKS ]           # default: PKCS12
   [ provider: <name> ]

Example Configuration

wsSecurity:
   keystore:
     location: signer.p12
     password: secret
     keyAlias: signer
   secure:
     - signature:
         references:
           - by: BODY

wsSecurity:
   keystore:
     location: signer.p12
     password: secret
     keyAlias: signer
   secure:
     - signature:
         references:
           - by: BODY

Syntax

keystore:
  keyAlias: <string>
  keyPassword: <string>
  location: <string>
  password: <string>
  provider: <string>
  type: <string>

keystore:
  keyAlias: <string>
  keyPassword: <string>
  location: <string>
  password: <string>
  provider: <string>
  type: <string>

Attributes

Name	Required	Default	Description	Examples
keyAlias	false	the keystore's first key entry	Alias of the key entry to use from the keystore, for a keystore holding more than one.	-
keyPassword	false	changeit	Password unlocking the private key entry inside the keystore. Also used to open the keystore file itself when `password` is not set. In YAML, this can be a SpEL expression reading an environment variable instead of a literal value, e.g. "#{env.KEYSTORE_KEY_PASSWORD}", so the password itself need not be checked into version control.	abc123
location	false	-	File or resource holding the store: a PKCS#12/JKS keystore file, or, with `type="PEM"`, one or more X.509 certificates.	-
password	false	-	Password used to open the keystore/truststore file. Required for a PKCS#12/JKS store, except when `type="PEM"`, where it is ignored - a bare certificate has no password. On a `<keystore>`, leaving this unset falls back to `keyPassword` (default `changeit`), which is the common case when the same password protects both the file and the private key entry inside it.	-
provider	false	-	Provider to use when loading the keystore.	-
type	false	-	Keystore type (e.g., `PKCS12`, `JKS`), or `PEM` to load `location` as one or more bare X.509 certificates (`.cer`/`.crt`/`.pem`) instead of a keystore container. `PEM` only makes sense for a `truststore`, since a bare certificate carries no private key. `location` may hold more than one certificate - either PEM blocks or DER certificates concatenated back to back - and every one of them becomes a separate trust anchor; this is how to trust a CA chain (root plus intermediates) when the peer's messages only ever carry its leaf certificate.	-

Can be used in

components ssl wsSecurity