Import keystore with private keys and trusted certificates

post

https://{host}:{port}/api/v3/migration/keystores

Imports keystores (PKCS#12 or JKS) containing private keys and trusted certificates (CAs).

Format Auto-Detection:

PKCS#12 (.p12, .pfx): Detected via magic bytes 0x30
JKS (.jks): Detected via magic bytes 0xFEEDFEED
Both formats fully supported for migration

Supports:

Private keys with X.509 certificates
Trusted certificates (Root CAs, Intermediate CAs)
Mixed bundles (keys + CAs)
Truststore-only files (no private keys)

Certificate Validation Modes:

STRICT (production): Reject expired/invalid certificates
IMPORT_ONLY (recovery): Allow expired with keyOps=[decrypt,verify]
SKIP (testing): No validation

Multi-Key Support:

Single key: Uses kid unchanged
Multiple keys (AUTO): Generates kid-{sanitizedAlias}
Multiple keys (MANUAL): Uses explicit kidMappings

Trusted Certificates:

Assigned kids with "-trust-" prefix: kid-trust-{sanitizedAlias}
Stored in same keystore as private keys
Used for PKCS#7/CMS signature verification

Idempotency:

Reimporting existing entries returns 200 OK with skipped list
Partial reimport (some new, some existed) returns 206 Partial Content
New entries return 201 Created

Maximum Size: 20 MB (configurable via MIGRATION_MAX_KEYSTORE_SIZE)

Response: Returns KeystoreImportResponse with summary, format detection, imported keys, certificates, skipped entries, and failures.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Keystore import request with optional validation and kid configuration:
• kid – base identifier for imported entries
• password – optional keystore password (null for unprotected)
• keystoreContent – Base64-encoded keystore file (PKCS#12 or JKS)
• validationMode – optional (STRICT, IMPORT_ONLY, SKIP); uses global config if omitted
• kidStrategy – optional (AUTO, MANUAL); default AUTO
• kidMappings – required if kidStrategy=MANUAL; map of alias→kid

Request for importing keystores in PKCS12 or JKS format. Format is automatically
detected - both are equally supported for migration purposes.

kid

string

required

Base kid under which keys will be stored.
For single-key keystores, this kid is used unchanged.
For multi-key keystores, this serves as the base for AUTO strategy
or is ignored for MANUAL strategy.

keystoreContent

string

required

Base64-encoded keystore file content (PKCS12 or JKS).
Format is automatically detected via magic bytes:

PKCS12: Starts with 0x30 (ASN.1 SEQUENCE)
JKS: Starts with 0xFEEDFEED
Both formats are fully supported for migration.

password

string

Password for opening the keystore file, if password-protected.
This field may be empty or null if the keystore is not encrypted.

validationMode

string

enum

Certificate validation mode (STRICT, IMPORT_ONLY, SKIP).
If not specified, uses system default from configuration.

STRICT: Reject import if certificates expired (production recommended)
IMPORT_ONLY: Allow import with restricted operations for expired certs
SKIP: No validation (testing only)

Allowed:

kidStrategy

string

enum

Kid generation strategy for multi-key keystores (AUTO or MANUAL).
Default: AUTO

AUTO: Generates kids as {kid}-{sanitized-alias}
MANUAL: Uses explicit kidMappings provided by user

Allowed:

kidMappings

object

Manual kid mappings (alias -> kid) for multi-key imports.
Required only when kidStrategy=MANUAL.
Maps keystore alias to desired kid for each key.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200All entries already exist (idempotent reimport, nothing new).

201Keystore imported successfully (all new entries created).

206Partial success: Some entries imported, others skipped or failed.

400Invalid Base64, unsupported keystore format, or wrong password.

413Payload Too Large: Keystore exceeds maximum size (20 MB default).

422All entries failed validation (STRICT mode).