---
product: Chilkat
product_version: 11.7.0
language: objc
language_label: Objective-C
class: JavaKeyStore
class_name: CkoJavaKeyStore
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/objcCkoJavaKeyStoreRef.html
---
# Chilkat JavaKeyStore — Objective-C — v11.7.0

> Chilkat 11.7.0 · language=objc · class=JavaKeyStore (CkoJavaKeyStore)
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/JavaKeyStore.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/guide.md`.

## Purpose

**Load, inspect, modify, convert, and save Java keystore data.**

`Chilkat.JavaKeyStore` is the Chilkat class for working with Java keystore data. It supports private-key entries with aliases and certificate chains, trusted certificate entries, and secret-key entries. It can load and save keystores, import private-key entries from PFX, add trusted certificates and symmetric keys, retrieve private keys and certificate chains, manage aliases, change private-key passwords, and convert keystore contents to PEM, PFX, or JWK Set format.

**Load and save keystores**

Read Java keystore data into memory, inspect or modify its contents, and save the updated keystore when changes are complete.

**Private-key entries**

Work with private keys stored under aliases, including their associated certificate chains and entry-specific passwords.

**Trusted certificates**

Add, retrieve, and manage trusted certificate entries used for trust stores, TLS validation, and Java-based security configuration.

**Secret-key entries**

Store and retrieve symmetric secret keys when the keystore is used for application key material in addition to certificates.

**Import and convert**

Import private-key entries from PFX/P12 and export or convert keystore contents to PEM, PFX, or JWK Set format.

**Alias management**

Enumerate aliases, locate entries, rename or manage entry names, and organize keys and certificates by application-specific identifiers.

**Common pattern:** Load the keystore with its store password, locate the needed entry by alias, retrieve the private key, certificate chain, trusted certificate, or secret key, then save the keystore or export the selected material in the format required by the target system. Use `JavaKeyStore` when the data is organized as a Java keystore; use `Cert`, `PrivateKey`, `Pfx`, or `TrustedRoots` when working directly with individual certificate or key objects.

For an extended overview, see [JavaKeyStore Class Overview](https://www.chilkatsoft.com/javakeystore_class_overview.asp).

## Object creation, unlocking and error handling

**Object Creation**

```objectivec
CkoJavaKeyStore *obj = [[CkoJavaKeyStore alloc] init];
```

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Objective-C.

How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `@property (nonatomic, copy) NSString *DebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `@property (nonatomic, readonly, copy) NSString *LastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `@property (nonatomic, readonly, copy) NSString *LastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `@property (nonatomic, readonly, copy) NSString *LastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `@property (nonatomic) BOOL LastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `YES` means success, `NO` means failure. |
| `VerboseLogging` | `@property (nonatomic) BOOL VerboseLogging;` | read/write | If set to `YES`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `@property (nonatomic, readonly, copy) NSString *Version;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `NumPrivateKeys` | property, read-only | `@property (nonatomic, readonly, copy) NSNumber *NumPrivateKeys;` |
| `NumSecretKeys` | property, read-only | `@property (nonatomic, readonly, copy) NSNumber *NumSecretKeys;` |
| `NumTrustedCerts` | property, read-only | `@property (nonatomic, readonly, copy) NSNumber *NumTrustedCerts;` |
| `RequireCompleteChain` | property, read/write | `@property (nonatomic) BOOL RequireCompleteChain;` |
| `VerifyKeyedDigest` | property, read/write | `@property (nonatomic) BOOL VerifyKeyedDigest;` |
| `AddPfx` | method | `- (BOOL)AddPfx:(CkoPfx *)pfx     alias:(NSString *)alias     password:(NSString *)password;` |
| `AddPrivateKey` | method | `- (BOOL)AddPrivateKey:(CkoCert *)cert     alias:(NSString *)alias     password:(NSString *)password;` |
| `AddSecretKey` | method | `- (BOOL)AddSecretKey:(NSString *)encodedKeyBytes     encoding:(NSString *)encoding     algorithm:(NSString *)algorithm     alias:(NSString *)alias     password:(NSString *)password;` |
| `AddTrustedCert` | method | `- (BOOL)AddTrustedCert:(CkoCert *)cert     alias:(NSString *)alias;` |
| `CertChainAt` | method | `- (BOOL)CertChainAt:(NSNumber *)index     certChain:(CkoCertChain *)certChain;` |
| `CertChainOf` | method | `- (BOOL)CertChainOf:(NSString *)alias     caseSensitive:(BOOL)caseSensitive     certChain:(CkoCertChain *)certChain;` |
| `ChangePassword` | method | `- (BOOL)ChangePassword:(NSNumber *)index     oldPassword:(NSString *)oldPassword     newPassword:(NSString *)newPassword;` |
| `GetPrivateKeyAlias` | method | `- (NSString *)GetPrivateKeyAlias:(NSNumber *)index;` |
| `GetSecretKey` | method | `- (NSString *)GetSecretKey:(NSString *)password     index:(NSNumber *)index     encoding:(NSString *)encoding;` |
| `GetSecretKeyAlias` | method | `- (NSString *)GetSecretKeyAlias:(NSNumber *)index;` |
| `GetTrustedCertAlias` | method | `- (NSString *)GetTrustedCertAlias:(NSNumber *)index;` |
| `LoadBd` | method | `- (BOOL)LoadBd:(NSString *)password     bd:(CkoBinData *)bd;` |
| `LoadBinary` | method | `- (BOOL)LoadBinary:(NSString *)password     jksData:(NSData *)jksData;` |
| `LoadEncoded` | method | `- (BOOL)LoadEncoded:(NSString *)password     jksEncData:(NSString *)jksEncData     encoding:(NSString *)encoding;` |
| `LoadFile` | method | `- (BOOL)LoadFile:(NSString *)password     path:(NSString *)path;` |
| `LoadJwkSet` | method | `- (BOOL)LoadJwkSet:(NSString *)password     jwkSet:(CkoJsonObject *)jwkSet;` |
| `PrivateKeyAt` | method | `- (BOOL)PrivateKeyAt:(NSString *)password     index:(NSNumber *)index     privKey:(CkoPrivateKey *)privKey;` |
| `PrivateKeyOf` | method | `- (BOOL)PrivateKeyOf:(NSString *)password     alias:(NSString *)alias     caseSensitive:(BOOL)caseSensitive     privKey:(CkoPrivateKey *)privKey;` |
| `RemoveEntry` | method | `- (BOOL)RemoveEntry:(NSNumber *)entryType     index:(NSNumber *)index;` |
| `SetAlias` | method | `- (BOOL)SetAlias:(NSNumber *)entryType     index:(NSNumber *)index     alias:(NSString *)alias;` |
| `ToBd` | method | `- (BOOL)ToBd:(NSString *)password     bd:(CkoBinData *)bd;` |
| `ToBinary` | method | `- (NSData *)ToBinary:(NSString *)password;` |
| `ToEncodedString` | method | `- (NSString *)ToEncodedString:(NSString *)password     encoding:(NSString *)encoding;` |
| `ToFile` | method | `- (BOOL)ToFile:(NSString *)password     path:(NSString *)path;` |
| `ToJwkSet` | method | `- (BOOL)ToJwkSet:(NSString *)password     sbJwkSet:(CkoStringBuilder *)sbJwkSet;` |
| `ToPemObj` | method | `- (BOOL)ToPemObj:(NSString *)password     pemObj:(CkoPem *)pemObj;` |
| `ToPfxObj` | method | `- (BOOL)ToPfxObj:(NSString *)password     pfxObj:(CkoPfx *)pfxObj;` |
| `TrustedCertAt` | method | `- (BOOL)TrustedCertAt:(NSNumber *)index     cert:(CkoCert *)cert;` |
| `TrustedCertOf` | method | `- (BOOL)TrustedCertOf:(NSString *)alias     caseSensitive:(BOOL)caseSensitive     cert:(CkoCert *)cert;` |
| `UseCertVault` | method | `- (BOOL)UseCertVault:(CkoXmlCertVault *)vault;` |

Deprecated members are listed at the end of this file with their replacements; do not use them in new code.

## Properties

### JavaKeyStore.NumPrivateKeys

`Chilkat 11.7.0 · objc · JavaKeyStore · NumPrivateKeys · property · read-only · since 9.5.0.44`

```objectivec
@property (nonatomic, readonly, copy) NSNumber *NumPrivateKeys;
```

Returns the number of private-key entries currently contained in the keystore. Each private-key entry has an alias, a protected private key, and an associated certificate chain. Valid private-key indexes range from `0` through `NumPrivateKeys - 1`.

**Entry password versus store password:** The private key in each entry may have its own password. That entry password is supplied to methods such as `PrivateKeyAt` and `PrivateKeyOf`. It is distinct from the store password used when loading or saving the complete keystore.

### JavaKeyStore.NumSecretKeys

`Chilkat 11.7.0 · objc · JavaKeyStore · NumSecretKeys · property · read-only · since 9.5.0.66`

```objectivec
@property (nonatomic, readonly, copy) NSNumber *NumSecretKeys;
```

Returns the number of symmetric secret-key entries currently contained in the keystore. Examples include AES, HMAC, Blowfish, and ChaCha key material. Valid indexes range from `0` through `NumSecretKeys - 1`.

**JCEKS entry type:** Secret-key entries require the JCEKS format; the traditional JKS format stores private-key entries and trusted-certificate entries but does not provide the JCEKS secret-key entry type.

### JavaKeyStore.NumTrustedCerts

`Chilkat 11.7.0 · objc · JavaKeyStore · NumTrustedCerts · property · read-only · since 9.5.0.44`

```objectivec
@property (nonatomic, readonly, copy) NSNumber *NumTrustedCerts;
```

Returns the number of trusted-certificate entries currently contained in the keystore. Each entry contains one certificate and an alias. Valid indexes range from `0` through `NumTrustedCerts - 1`.

**A trusted entry is not necessarily a root CA:** Java keystores can mark any certificate as trusted. The application or Java security configuration decides what that trust means; this class does not validate the certificate merely because it is stored as a trusted-certificate entry.

### JavaKeyStore.RequireCompleteChain

`Chilkat 11.7.0 · objc · JavaKeyStore · RequireCompleteChain · property · read/write · since 9.5.0.44`

```objectivec
@property (nonatomic) BOOL RequireCompleteChain;
```

Controls whether a complete certificate chain is required when a private-key entry is added. The default is `YES`. When enabled, `AddPrivateKey` and `AddPfx` fail if Chilkat cannot build the chain through the issuing certificates to a root or self-signed certificate. When set to `NO`, an incomplete chain may be stored.

**Providing missing issuers:** Call `UseCertVault` to make additional certificates available for chain construction. Trusted CA roots supplied through Chilkat trusted-root facilities may also help complete the chain. This property affects chain construction while adding entries; it does not perform application trust-policy validation.

### JavaKeyStore.VerifyKeyedDigest

`Chilkat 11.7.0 · objc · JavaKeyStore · VerifyKeyedDigest · property · read/write · since 9.5.0.44`

```objectivec
@property (nonatomic) BOOL VerifyKeyedDigest;
```

Controls validation of the keystore-level integrity digest when a JKS or JCEKS store is loaded. The default is `YES`. In this mode, the load method uses the supplied store password to verify that the serialized keystore has not been altered and that the password is appropriate for the store.

When set to `NO`, a load method may be called with an empty password to read the store without validating its integrity digest.

**Security consequence:** Disabling this check does not decrypt private or secret key entries and does not make their entry passwords unnecessary. It only skips store-level integrity verification, so corrupted or modified keystore data may be accepted. Leave this property enabled for normal use.

## Methods

### JavaKeyStore.AddPfx

`Chilkat 11.7.0 · objc · JavaKeyStore · AddPfx · method · since 9.5.0.44`

```objectivec
- (BOOL)AddPfx:(CkoPfx *)pfx 
    alias:(NSString *)alias 
    password:(NSString *)password;
```

Imports the private-key entries found in the `Pfx` object supplied in `pfx`. One Java keystore private-key entry is added for each private key in the PFX/PKCS #12 data. Certificates from the PFX are used to construct the certificate chain associated with each imported private key.

`aliasName` specifies the alias for the first imported private key. If it is empty, Chilkat chooses an alias in this order:

1. The subject common name of the private key certificate.
2. The subject email address.
3. The PKCS #12 friendly-name attribute.
4. The certificate serial number.

If the PFX contains additional private keys, their aliases are chosen automatically using the same preference order. `password` becomes the entry password used to protect the imported private keys in the Java keystore.

**What is not imported:** Standalone certificates from the PFX are not added as trusted-certificate entries. They are used only as possible members of private-key certificate chains. Call `AddTrustedCert` separately when a certificate should become an explicit trust entry.

**Chain completion:** If `RequireCompleteChain` is enabled, the method fails when any imported private-key chain cannot be completed. `UseCertVault` can supply additional issuer certificates.

Returns YES for success, NO for failure.

### JavaKeyStore.AddPrivateKey

`Chilkat 11.7.0 · objc · JavaKeyStore · AddPrivateKey · method · since 9.5.0.44`

```objectivec
- (BOOL)AddPrivateKey:(CkoCert *)cert 
    alias:(NSString *)alias 
    password:(NSString *)password;
```

Adds a private-key entry using the certificate in `cert`. The `Cert` object must have access to its associated private key. Chilkat obtains that private key and builds the certificate chain beginning with `cert`.

`aliasName` is the entry alias. If it is empty, Chilkat chooses an alias from the certificate in this order: subject common name, subject email address, then certificate serial number. `password` is the password used to protect the private key inside the keystore.

**Certificate-chain construction:** A private-key entry consists of the private key and the certificate chain for its public key. If `RequireCompleteChain` is enabled, the method fails unless the chain can be completed. Use `UseCertVault` when additional issuer certificates are needed.

Returns YES for success, NO for failure.

### JavaKeyStore.AddSecretKey

`Chilkat 11.7.0 · objc · JavaKeyStore · AddSecretKey · method · since 9.5.0.66`

```objectivec
- (BOOL)AddSecretKey:(NSString *)encodedKeyBytes 
    encoding:(NSString *)encoding 
    algorithm:(NSString *)algorithm 
    alias:(NSString *)alias 
    password:(NSString *)password;
```

Adds a symmetric secret-key entry. `encodedKeyBytes` contains the key bytes encoded as text, and `encoding` names that encoding, such as `hex`, `base64`, or `base64url`. `algorithm` records the key algorithm, such as `AES`, `HMAC_SHA256`, or `CHACHA`. `aliasName` is the alias, and `password` is the password used to protect the key entry.

The algorithm value describes the intended key type; it does not transform the supplied key bytes. For example, a 128-bit AES key is supplied as exactly 16 decoded bytes and `algorithm` is set to `AES`.

**JCEKS and legacy protection:** Secret-key entries are stored in JCEKS form. JCEKS protects these entries using the legacy `PBEWithMD5AndTripleDES` mechanism defined by that format. Use this format when interoperability requires JCEKS, and protect both the entry password and the resulting file.

Returns YES for success, NO for failure.

### JavaKeyStore.AddTrustedCert

`Chilkat 11.7.0 · objc · JavaKeyStore · AddTrustedCert · method · since 9.5.0.44`

```objectivec
- (BOOL)AddTrustedCert:(CkoCert *)cert 
    alias:(NSString *)alias;
```

Adds `cert` as a trusted-certificate entry under the alias supplied in `aliasName`. A trusted-certificate entry contains the certificate only; it does not contain a private key or a certificate chain.

**Trust is an application decision:** Adding a certificate as a trusted entry does not prove that it is a CA certificate, validate its signature chain, or make it universally trustworthy. It records that the keystore owner intends to trust that certificate for the consuming Java application or security configuration.

Returns YES for success, NO for failure.

### JavaKeyStore.CertChainAt

`Chilkat 11.7.0 · objc · JavaKeyStore · CertChainAt · method · since 11.0.0`

```objectivec
- (BOOL)CertChainAt:(NSNumber *)index 
    certChain:(CkoCertChain *)certChain;
```

Loads `certChain` with the certificate chain belonging to the private-key entry at zero-based index `index`. Valid indexes range from `0` through `NumPrivateKeys - 1`. The first certificate contains the public key corresponding to the private key; subsequent certificates are issuing certificates toward the root.

Returns YES for success, NO for failure.

### JavaKeyStore.CertChainOf

`Chilkat 11.7.0 · objc · JavaKeyStore · CertChainOf · method · since 11.0.0`

```objectivec
- (BOOL)CertChainOf:(NSString *)alias 
    caseSensitive:(BOOL)caseSensitive 
    certChain:(CkoCertChain *)certChain;
```

Searches the private-key entries for an alias equal to `aliasName` and loads the matching certificate chain into `certChain`. `caseSensitive` controls whether the alias comparison is case-sensitive. The first certificate in the chain contains the public key corresponding to the private key.

**Alias case behavior:** Java keystore implementations can differ in alias case handling. Avoid aliases that differ only by case, even when a case-sensitive search is requested.

Returns YES for success, NO for failure.

### JavaKeyStore.ChangePassword

`Chilkat 11.7.0 · objc · JavaKeyStore · ChangePassword · method · since 9.5.0.44`

```objectivec
- (BOOL)ChangePassword:(NSNumber *)index 
    oldPassword:(NSString *)oldPassword 
    newPassword:(NSString *)newPassword;
```

Changes the password protecting the private-key entry at `index`. Indexing begins at `0`. `oldPassword` is the current entry password and `newPassword` is the new entry password.

**This does not change only the store password:** A JKS/JCEKS store can have one password for store-level integrity and separate passwords for private-key entries. To migrate a keystore from one common password to another, load it using the old store password, call this method for each private-key entry that uses the old password, and then save the store using the new store password.

Returns YES for success, NO for failure.

### JavaKeyStore.GetPrivateKeyAlias

`Chilkat 11.7.0 · objc · JavaKeyStore · GetPrivateKeyAlias · method · since 9.5.0.44`

```objectivec
- (NSString *)GetPrivateKeyAlias:(NSNumber *)index;
```

Returns the alias of the private-key entry at `index`. Indexing begins at `0`; valid indexes range from `0` through `NumPrivateKeys - 1`.

**Alias portability:** Java keystore alias case behavior is implementation-dependent. Avoid creating aliases that differ only by letter case, even when a Chilkat lookup method offers a case-sensitive option.

Returns `nil` on failure

### JavaKeyStore.GetSecretKey

`Chilkat 11.7.0 · objc · JavaKeyStore · GetSecretKey · method · since 9.5.0.66`

```objectivec
- (NSString *)GetSecretKey:(NSString *)password 
    index:(NSNumber *)index 
    encoding:(NSString *)encoding;
```

Recovers the secret-key entry at `index` and returns its raw key bytes encoded using `encoding`. `password` is the password protecting that entry. Indexing begins at `0`. Common output encodings include `hex`, `base64`, and `base64url`.

**Secret material:** The returned text represents the actual symmetric key bytes, not a fingerprint or identifier. Avoid writing it to logs, command histories, or unprotected configuration files.

Returns `nil` on failure

### JavaKeyStore.GetSecretKeyAlias

`Chilkat 11.7.0 · objc · JavaKeyStore · GetSecretKeyAlias · method · since 9.5.0.66`

```objectivec
- (NSString *)GetSecretKeyAlias:(NSNumber *)index;
```

Returns the alias of the secret-key entry at `index`. Indexing begins at `0`; valid indexes range from `0` through `NumSecretKeys - 1`.

Returns `nil` on failure

### JavaKeyStore.GetTrustedCertAlias

`Chilkat 11.7.0 · objc · JavaKeyStore · GetTrustedCertAlias · method · since 9.5.0.44`

```objectivec
- (NSString *)GetTrustedCertAlias:(NSNumber *)index;
```

Returns the alias of the trusted-certificate entry at `index`. Indexing begins at `0`; valid indexes range from `0` through `NumTrustedCerts - 1`.

Returns `nil` on failure

### JavaKeyStore.LoadBd

`Chilkat 11.7.0 · objc · JavaKeyStore · LoadBd · method · since 9.5.0.77`

```objectivec
- (BOOL)LoadBd:(NSString *)password 
    bd:(CkoBinData *)bd;
```

Loads a JKS or JCEKS keystore from the bytes currently contained in `bd`. `password` is the store password used for integrity verification when `VerifyKeyedDigest` is enabled.

Returns YES for success, NO for failure.

### JavaKeyStore.LoadBinary

`Chilkat 11.7.0 · objc · JavaKeyStore · LoadBinary · method · since 9.5.0.44`

```objectivec
- (BOOL)LoadBinary:(NSString *)password 
    jksData:(NSData *)jksData;
```

Loads a JKS or JCEKS keystore from the serialized bytes in `jksData`. `password` is the store password used for store-level integrity verification when `VerifyKeyedDigest` is enabled.

**Two password layers:** Loading the store does not require Chilkat to decrypt every private or secret key. The passwords protecting individual key entries are supplied later when those keys are retrieved or exported.

Returns YES for success, NO for failure.

### JavaKeyStore.LoadEncoded

`Chilkat 11.7.0 · objc · JavaKeyStore · LoadEncoded · method · since 9.5.0.44`

```objectivec
- (BOOL)LoadEncoded:(NSString *)password 
    jksEncData:(NSString *)jksEncData 
    encoding:(NSString *)encoding;
```

Decodes the serialized keystore text in `jksEncData` using the binary encoding named by `encoding`, then loads the resulting JKS or JCEKS bytes. Common encodings include `base64`, `hex`, and `base64url`. `password` is the store password used for integrity verification.

**Encoding is not encryption:** `encoding` describes how binary keystore bytes are represented as text. It does not name the keystore format and does not protect the data cryptographically.

Returns YES for success, NO for failure.

### JavaKeyStore.LoadFile

`Chilkat 11.7.0 · objc · JavaKeyStore · LoadFile · method · since 9.5.0.44`

```objectivec
- (BOOL)LoadFile:(NSString *)password 
    path:(NSString *)path;
```

Loads a JKS or JCEKS keystore from the file at `path`. `password` is the store password used to verify the keystore-level integrity digest when `VerifyKeyedDigest` is enabled.

**JKS/JCEKS versus PKCS #12:** This class is intended for the proprietary Java JKS and JCEKS formats. Modern Java releases use PKCS #12 as the default keystore type; use `Chilkat.Pfx` when the input is a `.p12` or `.pfx` container.

Returns YES for success, NO for failure.

### JavaKeyStore.LoadJwkSet

`Chilkat 11.7.0 · objc · JavaKeyStore · LoadJwkSet · method · since 9.5.0.66`

```objectivec
- (BOOL)LoadJwkSet:(NSString *)password 
    jwkSet:(CkoJsonObject *)jwkSet;
```

Loads supported keys from the JWK Set in `jwkSet` into this Java keystore object. `password` is used to protect imported private-key and secret-key entries. A JWK `kid` value is used as the entry alias when present.

**JWK Set structure:** `jwkSet` should contain a JSON object with a `keys` array. Private asymmetric JWKs contain private parameters such as `d`; symmetric JWKs use `kty: "oct"` and contain the key in `k`. Treat the input as sensitive whenever it contains private or symmetric key material.

Returns YES for success, NO for failure.

### JavaKeyStore.PrivateKeyAt

`Chilkat 11.7.0 · objc · JavaKeyStore · PrivateKeyAt · method · since 11.0.0`

```objectivec
- (BOOL)PrivateKeyAt:(NSString *)password 
    index:(NSNumber *)index 
    privKey:(CkoPrivateKey *)privKey;
```

Loads `privKey` with the private key at zero-based index `index`. `password` is the password protecting that private-key entry. Valid indexes range from `0` through `NumPrivateKeys - 1`.

**Use the entry password:** `password` is not necessarily the password used to load the complete keystore. Java keystores can protect each private-key entry with a different password.

Returns YES for success, NO for failure.

### JavaKeyStore.PrivateKeyOf

`Chilkat 11.7.0 · objc · JavaKeyStore · PrivateKeyOf · method · since 11.0.0`

```objectivec
- (BOOL)PrivateKeyOf:(NSString *)password 
    alias:(NSString *)alias 
    caseSensitive:(BOOL)caseSensitive 
    privKey:(CkoPrivateKey *)privKey;
```

Searches the private-key entries for an alias equal to `aliasName` and loads the matching private key into `privKey`. `password` is the password protecting that key entry, and `caseSensitive` controls whether the alias comparison is case-sensitive.

Returns YES for success, NO for failure.

### JavaKeyStore.RemoveEntry

`Chilkat 11.7.0 · objc · JavaKeyStore · RemoveEntry · method · since 9.5.0.44`

```objectivec
- (BOOL)RemoveEntry:(NSNumber *)entryType 
    index:(NSNumber *)index;
```

Removes an entry selected by type and zero-based index. `entryType` uses the following documented values:

| `entryType` | Entry selected |
| :--- | :--- |
| `1` | Trusted-certificate entry; `index` indexes the trusted-certificate list. |
| `2` | Private-key entry; `index` indexes the private-key list. |

`index` is an index within the selected entry category, not an index across all entries in the keystore.

**In-memory change:** This method modifies the current object. Call `ToFile`, `ToBd`, or another `To*` method to persist the updated keystore.

Returns YES for success, NO for failure.

### JavaKeyStore.SetAlias

`Chilkat 11.7.0 · objc · JavaKeyStore · SetAlias · method · since 9.5.0.44`

```objectivec
- (BOOL)SetAlias:(NSNumber *)entryType 
    index:(NSNumber *)index 
    alias:(NSString *)alias;
```

Changes the alias of an entry selected by type and zero-based index. `entryType` uses the following documented values:

| `entryType` | Entry selected |
| :--- | :--- |
| `1` | Trusted-certificate entry; `index` indexes the trusted-certificate list. |
| `2` | Private-key entry; `index` indexes the private-key list. |

`aliasName` is the new alias. The index is relative to the selected category, not the complete set of keystore entries.

**Choose aliases carefully:** Aliases identify entries within a Java keystore, but case sensitivity is implementation-dependent. Use unique aliases that do not differ only by case.

Returns YES for success, NO for failure.

### JavaKeyStore.ToBd

`Chilkat 11.7.0 · objc · JavaKeyStore · ToBd · method · since 11.0.0`

```objectivec
- (BOOL)ToBd:(NSString *)password 
    bd:(CkoBinData *)bd;
```

Serializes the current Java keystore and writes the complete JKS or JCEKS file image to `bd`. `password` is the store password used to create the keystore-level integrity digest.

**Separate entry protection:** Private-key and secret-key entries may have passwords distinct from the store password. Serializing with `password` does not automatically change those entry passwords.

Returns YES for success, NO for failure.

### JavaKeyStore.ToBinary

`Chilkat 11.7.0 · objc · JavaKeyStore · ToBinary · method · since 9.5.0.44`

```objectivec
- (NSData *)ToBinary:(NSString *)password;
```

Serializes the current Java keystore and returns the complete JKS or JCEKS file image as bytes. `password` is the store password used to create the keystore-level integrity digest.

**Store password versus entry passwords:** The store password protects the integrity of the serialized keystore. Private-key and secret-key entries may remain protected by their own entry passwords, which were supplied when the entries were added or changed. The store password is not general-purpose encryption for all aliases and certificates in the file.

Returns `nil` on failure

### JavaKeyStore.ToEncodedString

`Chilkat 11.7.0 · objc · JavaKeyStore · ToEncodedString · method · since 9.5.0.44`

```objectivec
- (NSString *)ToEncodedString:(NSString *)password 
    encoding:(NSString *)encoding;
```

Serializes the current Java keystore and returns the resulting JKS or JCEKS bytes encoded as text using `encoding`. Common choices include `base64`, `hex`, and `base64url`. `password` is the store password used to create the keystore-level integrity digest.

Returns `nil` on failure

### JavaKeyStore.ToFile

`Chilkat 11.7.0 · objc · JavaKeyStore · ToFile · method · since 9.5.0.44`

```objectivec
- (BOOL)ToFile:(NSString *)password 
    path:(NSString *)path;
```

Serializes the current Java keystore and writes the complete JKS or JCEKS file image to `path`. `password` is the store password used to create the keystore-level integrity digest.

**Password roles:** The store password may differ from the passwords protecting individual private-key or secret-key entries. Saving with a new store password does not automatically change each entry password; use `ChangePassword` for private-key entries when needed.

Returns YES for success, NO for failure.

### JavaKeyStore.ToJwkSet

`Chilkat 11.7.0 · objc · JavaKeyStore · ToJwkSet · method · since 9.5.0.66`

```objectivec
- (BOOL)ToJwkSet:(NSString *)password 
    sbJwkSet:(CkoStringBuilder *)sbJwkSet;
```

Exports supported private-key and secret-key entries as a JSON Web Key Set and writes the JSON to `sbJwkSet`. `password` is used to recover protected key entries. Each exported JWK receives a `kid` value derived from the keystore alias.

**Sensitive output:** A JWK containing private parameter `d` or symmetric parameter `k` contains secret key material. Protect the resulting JSON as carefully as the original keystore and do not log or transmit it over an untrusted channel.

Returns YES for success, NO for failure.

### JavaKeyStore.ToPemObj

`Chilkat 11.7.0 · objc · JavaKeyStore · ToPemObj · method · since 11.0.0`

```objectivec
- (BOOL)ToPemObj:(NSString *)password 
    pemObj:(CkoPem *)pemObj;
```

Converts the keystore material supported by the `Pem` class and loads the result into `pemObj`. `password` is used to decrypt private-key entries during the conversion.

**Output handling:** The destination `Pem` object receives the converted material in memory. Its own export methods and properties control whether later PEM text is encrypted and how it is formatted. Treat unencrypted private-key PEM as sensitive data.

Returns YES for success, NO for failure.

### JavaKeyStore.ToPfxObj

`Chilkat 11.7.0 · objc · JavaKeyStore · ToPfxObj · method · since 11.0.0`

```objectivec
- (BOOL)ToPfxObj:(NSString *)password 
    pfxObj:(CkoPfx *)pfxObj;
```

Converts the certificates and recoverable private-key entries in the Java keystore and loads the result into `pfxObj`. `password` is used to decrypt private-key entries during the conversion.

**Conversion password:** `password` is an input password for recovering the Java keystore entries. It is not automatically the password that will protect a later serialized PFX; use the destination `Pfx` export method to choose the PFX password.

Returns YES for success, NO for failure.

### JavaKeyStore.TrustedCertAt

`Chilkat 11.7.0 · objc · JavaKeyStore · TrustedCertAt · method · since 11.0.0`

```objectivec
- (BOOL)TrustedCertAt:(NSNumber *)index 
    cert:(CkoCert *)cert;
```

Loads `cert` with the trusted certificate at the zero-based index `index`. Valid indexes range from `0` through `NumTrustedCerts - 1`. The returned certificate is the single certificate stored in the trust entry and has no private key merely by virtue of being trusted.

Returns YES for success, NO for failure.

### JavaKeyStore.TrustedCertOf

`Chilkat 11.7.0 · objc · JavaKeyStore · TrustedCertOf · method · since 11.0.0`

```objectivec
- (BOOL)TrustedCertOf:(NSString *)alias 
    caseSensitive:(BOOL)caseSensitive 
    cert:(CkoCert *)cert;
```

Searches the trusted-certificate entries for an alias equal to `aliasName` and loads the matching certificate into `cert`. `caseSensitive` controls whether the alias comparison is case-sensitive.

Returns YES for success, NO for failure.

### JavaKeyStore.UseCertVault

`Chilkat 11.7.0 · objc · JavaKeyStore · UseCertVault · method · since 9.5.0.44`

```objectivec
- (BOOL)UseCertVault:(CkoXmlCertVault *)vault;
```

Adds `vault` to the certificate sources Chilkat searches when it needs issuer certificates to build a private-key certificate chain. This is useful before calling `AddPrivateKey` or `AddPfx` when the supplied certificate material does not already contain the complete chain.

**Lookup source only:** Registering a certificate vault does not copy all vault certificates into the Java keystore and does not create trusted-certificate entries. Certificates are consulted only as candidates for chain construction.

Returns YES for success, NO for failure.

## Deprecated members — do not use in new code

| Member | Kind | Deprecated in | Use instead |
|---|---|---|---|
| `FindCertChain` | method | before 11.6.1 | `CertChainOf` |
| `FindPrivateKey` | method | before 11.6.1 | `PrivateKeyOf` |
| `FindTrustedCert` | method | before 11.6.1 | `TrustedCertOf` |
| `GetCertChain` | method | before 11.6.1 | `CertChainAt` |
| `GetPrivateKey` | method | before 11.6.1 | `PrivateKeyAt` |
| `GetTrustedCert` | method | before 11.6.1 | `TrustedCertAt` |
| `ToPem` | method | before 11.6.1 | `ToPemObj` |
| `ToPfx` | method | before 11.6.1 | `ToPfxObj` |

## Related classes

[`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/Cert.md), [`CertChain`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/CertChain.md), [`JsonObject`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/JsonObject.md), [`Pem`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/Pem.md), [`Pfx`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/Pfx.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/PrivateKey.md), [`StringBuilder`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/StringBuilder.md), [`XmlCertVault`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/objc/classes/XmlCertVault.md)