Pfx Swift Reference Documentation
CkoPfx
Current Version: 11.5.0
Chilkat.Pfx
Load password-protected certificate and private-key bundles from files,
memory, encoded strings,
Enumerate contained certificates, private keys, and certificate chains to
locate the identity or trust material needed by the application.
Add certificates and private keys to create a PKCS#12 bundle for TLS,
S/MIME, signing, authentication, or platform import workflows.
Read and manage PKCS#12 safe-bag attributes such as friendly names or
local key identifiers when interoperability requires them.
Export PFX content as binary data, encoded text, files, PEM, or Java
KeyStore format depending on the target system.
Import certificates and private keys into Windows certificate stores or
macOS/iOS keychains when platform-backed access is required.
For an extended overview, see
Pfx Class Overview.
Load, inspect, build, export, convert, and import PFX / PKCS#12 containers.
Chilkat.Pfx is the Chilkat class for working with
PFX / PKCS#12 containers, which commonly hold certificates together with
their associated private keys and certificate chains. It can load
certificate/private-key bundles from files, memory, encoded data,
BinData, or PEM; add certificates and private keys; inspect
contained certificates and keys; manage safe-bag attributes; export to PFX,
PEM, encoded strings, binary data, files, or Java KeyStore format; and import
contents into Windows or macOS/iOS key stores.
Load PFX / PKCS#12 data
BinData, or PEM input.
Inspect certificates and keys
Build PFX containers
Safe-bag attributes
Export and convert
Import to key stores
Pfx when certificate material includes private keys packaged
in a PKCS#12 container. Load the PFX with its password, inspect or retrieve
the needed certificate and private key, then export, convert, or import the
contents into the format or platform store required by the application. Use
Chilkat.Cert and PrivateKey when working directly
with individual certificate or key objects.
Object Creation
let obj = CkoPfx()!
Properties
AlgorithmId
Gets or sets the password-based encryption scheme used for PKCS#8 shrouded private-key bags when writing a PFX. After a PFX is loaded, this property reports the scheme found for the loaded shrouded key bag.
The default is pbeWithSHAAnd3_KeyTripleDES_CBC for backward compatibility. Set this property to pbes2 to use the cipher and PBKDF2 HMAC choices specified by Pbes2CryptAlg and Pbes2HmacAlg.
pbes2 with AES when every target platform supports it.DebugLogFilePath
If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.
Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.
Possible causes of hangs include:
- A timeout property set to 0, indicating an infinite timeout.
- A hang occurring within an event callback in the application code.
- An internal bug in the Chilkat code causing the hang.
LastErrorHtml
Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastErrorText
Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
LastErrorXml
Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.
topLastMethodSuccess
Indicates the success or failure of the most recent method call: true means success, false means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages. Note: This property does not apply to methods that return integer values or to boolean-returning methods where the boolean does not indicate success or failure.
NumCerts
Returns the number of certificates currently contained in this PFX object. This count includes end-entity certificates and any available intermediate or root CA certificates.
Certificate indexes range from 0 through NumCerts - 1 for use with CertAt.
i has no positional relationship to private-key index i. In particular, CertAt(i) must not be assumed to return the certificate for PrivateKeyAt(i).localKeyId to associate a private key with its certificate when that attribute is present.NumPrivateKeys
Returns the number of private keys currently contained in this PFX object.
Private-key indexes range from 0 through NumPrivateKeys - 1 for use with PrivateKeyAt.
i has no positional relationship to certificate index i. A PFX commonly has more certificates than private keys because intermediate and root CA certificates are also included.localKeyId, retrieve it with GetSafeBagAttr and pass the value to CertByLocalKeyId. Do not pair a key and certificate by using the same index.Pbes2CryptAlg
Gets or sets the content-encryption cipher used when AlgorithmId is pbes2. After loading a PBES2-protected PFX, this property reports the cipher used by the loaded shrouded key bag.
| Value | Cipher |
|---|---|
aes256-cbc | AES-256 in CBC mode; the default for new PBES2 output. |
aes192-cbc | AES-192 in CBC mode. |
aes128-cbc | AES-128 in CBC mode. |
3des-cbc | Triple DES in CBC mode for compatibility. |
Pbes2HmacAlg chooses the HMAC-based PBKDF2 pseudorandom function used to derive the encryption key from the password.Pbes2HmacAlg
Gets or sets the HMAC algorithm used by PBKDF2 when AlgorithmId is pbes2. After loading a PBES2-protected PFX, this property reports the HMAC choice found in the loaded shrouded key bag.
hmacWithSha256— default for new PBES2 output.hmacWithSha384hmacWithSha512hmacWithSha1— primarily for compatibility with older consumers.
UncommonOptions
Provides specialized compatibility options for unusual PFX interoperability requirements. The default is an empty string, which is appropriate for normal use. Multiple options are separated by commas.
| Option | Effect |
|---|---|
LegacyOrder | Writes internal PKCS#12 ContentInfo objects in the ordering traditionally used by older Chilkat versions. |
NoTruncatePfxPassword64 | Prevents Chilkat's default compatibility behavior of truncating an extremely long PFX password to 64 characters. |
VerboseLogging
If set to true, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is false. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.
Version
Methods
AddCert
Adds to this PFX as an identity. The certificate must have an associated private key that Chilkat can obtain and copy. This requirement applies whether includeChain is true or false; AddCert does not provide a certificate-only mode.
includeChain controls only whether Chilkat also attempts to add the certificate chain:
| Certificate/private-key state | includeChain |
Result |
|---|---|---|
| No private key | false or true |
Fails. A certificate cannot be added by this method without its private key. |
| Private key exists but cannot be obtained or exported | false or true |
Fails. Chilkat does not fall back to adding the certificate without the key. |
| Usable private key | false |
Adds the private key and |
| Usable private key; complete chain locatable | true |
Adds the private key, |
| Usable private key; chain incomplete | true |
Succeeds with a partial chain. Missing intermediate or root certificates do not cause failure. |
includeChain is true, Chilkat searches the certificates already associated with UseCertVault. Each intermediate or root certificate is included when it can be located. The chain does not need to terminate at a root, and trust is not evaluated by this operation.Cert does not affect the material already stored in the PFX, and later changes to the PFX do not affect the source object.false but certificates already merged remain in the object. Treat failure as a possible partial modification. A missing or unobtainable private key is rejected before this merge begins.localKeyId, Chilkat generates one and assigns the same value to the key's primary certificate. This identifier associates the key and leaf certificate without relying on collection indexes. Intermediate and root CA certificates may be shared across multiple identities and are not paired by position.Returns true for success, false for failure.
AddPrivateKey
Adds and the certificate chain in certChain to this PFX object. The chain must contain at least one certificate. The certificate at index 0 is treated as the end-entity certificate associated with ; the remaining entries are additional certificates to include with the identity. The chain does not need to contain a root certificate and may consist only of the end-entity certificate.
0. The association is positional. A mismatch is not rejected and can produce a PFX identity that later fails during signing, decryption, or client authentication.PrivateKey or CertChain after this method returns does not affect the PFX.localKeyId, Chilkat generates one. The same identifier is assigned to the certificate at index 0, linking that certificate to the key. Other safe-bag attributes are not generated automatically.false after leaving some certificates in the PFX.Returns true for success, false for failure.
CertAt
Copies the certificate at the zero-based index at into cert. The first certificate is at index 0; valid indexes are less than NumCerts.
On success, cert is replaced with an independent, detached copy of the selected certificate. The method does not merge with or append to any certificate already held by cert. The returned copy does not remain linked to the PFX: changing either object later does not affect the other, and the copied certificate remains usable even if the PFX is subsequently modified or destroyed.
at is out of range or the certificate cannot be returned, the method returns false without modifying cert. When reusing a Cert object in a loop, always use its contents only after this method returns true; otherwise cert may still contain the certificate from an earlier successful call.CertAt(i) is not necessarily the certificate associated with PrivateKeyAt(i). To associate a key with its certificate, obtain the key's localKeyId with GetSafeBagAttr and use CertByLocalKeyId.Returns true for success, false for failure.
CertByLocalKeyId
Searches for a certificate whose certificate-bag localKeyId attribute matches byLocalKeyId and copies it into cert. encoding names the binary representation used for byLocalKeyId, such as decimal, base64, or hex.
On success, cert is replaced with the matching certificate. The method does not merge with any certificate already held by cert.
encoding is invalid, byLocalKeyId cannot be decoded, or no matching certificate is found, the method returns false without modifying cert. Always use cert only after a true return, because a reused destination may still contain a certificate from an earlier call.i, call GetSafeBagAttr with byLocalKeyId = true, encoding = i, and cert = localKeyId. That method returns the identifier in decimal representation, so pass the returned value as byLocalKeyId and decimal as encoding here.CertAt(i) is not the certificate for PrivateKeyAt(i) unless that happens coincidentally.Returns true for success, false for failure.
GetLastJsonData
Replaces the entire contents of with structured JSON information from the most recent operation. The data is copied as a complete replacement; it is never merged with members already present in .
The exact members depend on the preceding method. After loading a PFX, the JSON may describe authenticated-safe content, safe bags, encryption information, and bag attributes. If no JSON data is available, is cleared to an empty JSON object.
JsonObject is safe without clearing it first, but do not expect older members to remain.LastErrorText.Returns true for success, false for failure.
GetSafeBagAttr
Reads a recognized safe-bag attribute from a private key or certificate contained in this PFX. is true for a private key and false for a certificate. index is the zero-based index within the selected collection. attrName is the attribute name and is matched case-insensitively.
| Logical attribute | Accepted attrName names | Read behavior |
|---|---|---|
| Friendly name | friendlyName, keyContainerName, or keyName | All three names read the same underlying text attribute. The read succeeds only when the attribute contains a nonempty value; an unset or empty value causes failure. |
| Storage provider | storageProvider or msStorageProvider | Both names read the same underlying text attribute. The read succeeds only when the attribute contains a nonempty value; an unset or empty value causes failure. |
| Local key ID | localKeyId | The read succeeds only when a nonempty local key ID is present. The value is always returned in decimal encoding as one big-endian integer, regardless of the encoding used when it was set. |
| Enhanced key usage | enhancedKeyUsage | Not readable through this method. The operation reports failure even if the attribute was previously set with SetSafeBagAttr. |
An unrecognized attrName name, an invalid index, an unreadable attribute, or any recognized attribute whose value is unset or empty causes the read to fail.
01 02 03 04 05 06 07 08 are returned as 72623859790382856. Leading zero bytes are not preserved by a set-read-set round trip because 00 01 02 03 and 01 02 03 represent the same integer.i, read localKeyId with true and index = i. If a nonempty value is returned successfully, pass it to CertByLocalKeyId using the encoding decimal. Never assume that certificate index i matches private-key index i.Returns nil on failure
ImportToKeychain
Imports all certificates and private keys currently held by this Pfx object into the application's default keychain. This method is available only on macOS and iOS. On other platforms it returns false and reports that the method is macOS/iOS only.
The method does not accept a password. Any required password must already have been supplied when loading the PFX or PEM data; the objects presently contained in the Pfx are what this method imports.
toKeychain is reserved for future use: The JsonObject currently has no defined members and does not affect the import. Pass an empty JsonObject. Any JSON members supplied today are ignored. The destination keychain, access group, key accessibility, iCloud synchronization, and replacement behavior are not configurable through this method.The certificates and private keys are imported into the application's platform-default keychain without assigning special access-group, accessibility, or synchronization attributes. Normal macOS or iOS keychain-access rules and application entitlements still apply.
The calling sequence is the same on macOS and iOS: load or build the Pfx, create an empty JsonObject, and pass it as toKeychain.
Returns true for success, false for failure.
topLoadPem
Loads one or more certificate/private-key identities from the PEM-formatted text in and builds the contents of this Pfx object. password supplies the password when the PEM contains encrypted private keys.
The supported PEM block types are:
| PEM block | Meaning |
|---|---|
BEGIN CERTIFICATE | An X.509 certificate. |
BEGIN PRIVATE KEY | An unencrypted PKCS #8 private key. |
BEGIN ENCRYPTED PRIVATE KEY | A password-encrypted PKCS #8 private key. |
BEGIN RSA PRIVATE KEY | A traditional RSA private key, either unencrypted or password-encrypted. |
Multiple independent identities are supported. Each private key is paired with the certificate whose public key cryptographically matches it, and its chain is assembled from the other certificates in the PEM. Block order is therefore irrelevant; keys and certificates are not paired by position.
Returns true for success, false for failure.
LoadPfxBd
Loads a PFX / PKCS#12 container from the bytes currently held in . password is the password argument.
password accepts either a literal password, which is used for both integrity verification and all private-key bags, or a JSON object that can separately provide integrity, privKeys, and skipPrivateKeys. See LoadPfxFile for the exact JSON-detection rules, member types, defaults, and edge cases.Pfx object empty; previously loaded certificates and keys are not preserved.Returns true for success, false for failure.
LoadPfxBytes
Loads a PFX / PKCS#12 container from the in-memory bytes in . password is the password argument.
password accepts either a literal password, which is used for both integrity verification and all private-key bags, or a JSON object that can separately provide integrity, privKeys, and skipPrivateKeys. See LoadPfxFile for the exact JSON-detection rules, member types, defaults, and edge cases.Pfx object empty; previously loaded certificates and keys are not preserved.Returns true for success, false for failure.
topLoadPfxEncoded
Decodes the text in using the binary encoding named by encoding, then loads the resulting bytes as a PFX / PKCS#12 container. Common encodings include base64 and hex.
password is the password argument.
password accepts either a literal password, which is used for both integrity verification and all private-key bags, or a JSON object that can separately provide integrity, privKeys, and skipPrivateKeys. See LoadPfxFile for the exact JSON-detection rules, member types, defaults, and edge cases.encoding describes how binary PFX bytes were represented as text. It does not control certificate-name character encoding or password interpretation.Pfx object empty; previously loaded certificates and keys are not preserved.Returns true for success, false for failure.
LoadPfxFile
Loads a PFX / PKCS#12 container from the file path in . password follows the password contract below. The same contract is used by LoadPfxBytes, LoadPfxBd, and LoadPfxEncoded; it does not apply to LoadPem.
The password argument has two modes:
- Plain password: For any non-JSON value
P, Chilkat usesPfor both integrity verification and all private-key bags.skipPrivateKeysisfalse. - JSON options: After trimming leading and trailing whitespace, JSON mode is used only when the value begins with
{, ends with}, and parses as valid JSON. All three recognized members are optional and case-sensitive.
{
"integrity": "integrity-password",
"privKeys": "private-key-password",
"skipPrivateKeys": false
}| Member | Accepted value | Default when omitted |
|---|---|---|
integrity | String | Integrity verification is skipped. |
privKeys | String | The empty string is used as the password for every private-key bag. |
skipPrivateKeys | JSON Boolean true, or a string equal to true without regard to case | false |
Unknown JSON members are silently ignored. A misspelled member such as privkeys therefore does not produce a JSON error; the documented default is used instead. The single privKeys password applies to every private-key bag. Per-bag passwords are not supported.
skipPrivateKeys is true, private-key bags are not processed and the privKeys password is irrelevant. Integrity verification is still performed when an integrity member is supplied.integrity, for example {"skipPrivateKeys":true} or {}.integrity password does not validate the privKeys password. If integrity verification succeeds but private-key decryption fails, the load still fails unless private keys were skipped.Pfx object empty. Load into a new object when the previously loaded contents must be preserved on failure.Returns true for success, false for failure.
PrivateKeyAt
Copies the private key at the zero-based index at into privKey. The first private key is at index 0; valid indexes are less than NumPrivateKeys.
On success, privKey is replaced with an independent, detached copy of the selected private key. The method does not merge with or append to any key already held by privKey. The returned copy does not remain linked to the PFX: changing either object later does not affect the other, and the copied key remains usable even if the PFX is subsequently modified or destroyed.
at is out of range or the private key cannot be returned, the method returns false without modifying privKey. When reusing a PrivateKey object, use its contents only after this method returns true; otherwise privKey may still contain a key from an earlier successful call.PrivateKeyAt(i) is not necessarily associated with CertAt(i).GetSafeBagAttr with at set to true, privKey set to this private-key index, and ARG3 set to localKeyId. If the attribute is present, pass the returned value to CertByLocalKeyId using decimal as the encoding.privKey as secret key material. Avoid unnecessary serialization, logging, or long-lived copies.Returns true for success, false for failure.
SetSafeBagAttr
Sets a safe-bag attribute on a private key or certificate contained in this PFX. A safe-bag attribute is metadata attached to an item inside a PKCS#12/PFX container; it does not change the certificate or private-key material itself.
istrueto address a private key andfalseto address a certificate.indexis the zero-based index within the selected collection.nameis the attribute name. Attribute names are matched case-insensitively.valueis the value to set.encodingspecifies howvalueis decoded only when settinglocalKeyId. It is ignored for all text-valued attributes.
Setting a recognized attribute replaces its existing value; it never creates a duplicate attribute. The method returns false and makes no change if name is not one of the recognized names listed below.
| Logical attribute | Accepted name names | Value and behavior |
|---|---|---|
| Friendly name | friendlyName, keyContainerName, or keyName | These names refer to the same underlying text attribute. value is stored as text, and encoding is ignored. Setting through any alias replaces the value visible through every alias. |
| Storage provider | storageProvider or msStorageProvider | The two names refer to the same underlying text attribute. value is stored as text, and encoding is ignored. |
| Local key ID | localKeyId | A binary identifier commonly used to associate a private-key bag with its certificate bag. encoding specifies the encoding of value, such as hex, base64, or decimal. An empty value removes the attribute. |
| Enhanced key usage | enhancedKeyUsage | value is a comma-separated text list. Each item may be a recognized usage name, such as serverAuth, clientAuth, codeSigning, or emailProtection, or a dotted OID such as 1.3.6.1.5.5.7.3.1. Unrecognized items that are not valid OIDs are silently skipped. encoding is ignored. An empty value removes the attribute. This attribute is write-only through the safe-bag attribute API. |
hex, base64, or another encoding for those attributes has no effect.Returns true for success, false for failure.
ToBd
Serializes the current PFX contents as PKCS#12 data and writes the bytes to bd, using as the output password.
bd is cleared before serialization begins. On success, it contains only the newly generated PFX data; the method replaces the previous BinData contents and never appends to them.
false, the contents that bd held before the call are not restored. bd may be empty or may contain partially generated data. Use the destination only after a true return when complete output is required.The private-key encryption scheme is controlled by AlgorithmId and, for PBES2, the related algorithm properties.
bd may contain encrypted private-key material. Keep the password and resulting bytes protected even though they are stored only in memory.Returns true for success, false for failure.
ToBinary
Serializes the current PFX contents to PKCS#12 bytes in memory, using as the output password.
The private-key protection scheme is selected by AlgorithmId and, when PBES2 is selected, by Pbes2CryptAlg and Pbes2HmacAlg.
Returns nil on failure
ToEncodedString
Serializes the current PFX contents using as the output password, then returns the PKCS#12 bytes encoded as text using encoding. Common choices for encoding are base64 and hex.
The PFX encryption settings are controlled by AlgorithmId and the PBES2 properties.
Returns nil on failure
ToFile
Serializes the current PFX contents and writes the resulting PKCS#12 data to path, using as the output password.
.pfx and .p12 are the conventional filename extensions for PKCS#12 containers. The private-key protection scheme is controlled by AlgorithmId and the PBES2 properties.
Returns true for success, false for failure.
ToJksObj
Populates jksObj with a Java KeyStore (JKS) representation of this PFX. One private-key entry is created for each private key, and certificates in the PFX are used to construct the corresponding certificate chains. password protects the generated private-key entries.
jksObj is cleared before conversion begins. On success, it contains only the newly converted key store; the method replaces the destination's previous entries rather than merging with them.
false, the key store that jksObj held before the call is not restored. jksObj may be empty or partially populated. Use the destination only after a true return when a complete conversion is required.If is nonempty, it becomes the alias for the first private key. Otherwise, the alias is selected in this order:
- Certificate subject common name.
- Certificate subject email address.
- PKCS#9 friendly-name attribute.
- Certificate serial number.
Aliases for additional private keys are selected automatically using the same preference order.
Returns true for success, false for failure.
ToPem
Exports all private keys and certificates currently held by this object as PEM-formatted text. Certificates are written as standard BEGIN CERTIFICATE blocks.
Every private key is exported as unencrypted PKCS #8 in a BEGIN PRIVATE KEY block. This method does not emit PKCS #1 RSA, SEC 1 EC, traditional DSA, or legacy OpenSSL encrypted-private-key blocks.
ToPemEx to produce encrypted PKCS #8 private-key blocks or to omit selected categories of objects.Returns nil on failure
ToPemEx
Exports selected PFX contents as PEM-formatted text. Certificates are written as standard BEGIN CERTIFICATE blocks. Private keys are always written in PKCS #8 form: BEGIN PRIVATE KEY when unencrypted, or BEGIN ENCRYPTED PRIVATE KEY when encrypted. Traditional PKCS #1 RSA, SEC 1 EC, DSA, and legacy OpenSSL encrypted-key PEM formats are not produced.
The arguments control the output as follows:
| Argument | Effect |
|---|---|
| When true, emits OpenSSL-style bag and key attribute text in addition to the PEM blocks. |
noKeys | When true, omits private-key blocks. |
noCerts | When true, omits all certificate blocks. |
noCaCerts | When true, omits intermediate and root CA certificates while retaining applicable end-entity certificates. |
encryptAlg | Selects private-key encryption. Recognized keywords are aes128, aes192, aes256, des3, and 3des. Leave empty for unencrypted private keys. An unrecognized nonempty value falls back to triple-DES rather than silently producing unencrypted output. |
password | The password for encrypted private-key output. Encryption is applied only when both encryptAlg and password are nonempty. |
des3 and 3des use triple-DES in CBC mode with an 8-byte IV. The result is an encrypted PKCS #8 BEGIN ENCRYPTED PRIVATE KEY block.encryptAlg or password is empty, the output contains unencrypted PKCS #8 private-key material. Prefer aes256 for new encrypted output unless the receiving system requires another supported choice.Returns nil on failure
UseCertVault
Adds the certificates currently contained in to the set of certificate sources available for later chain-building operations, such as AddCert.
The call captures a point-in-time snapshot of the vault's certificates. Chilkat retains its own lifetime-safe references to those individual certificates and does not retain a reference to the XmlCertVault object itself. After this method returns, may be released, destroyed, or allowed to go out of scope; its contributed certificates remain available to this Pfx object.
UseCertVault again to capture certificates added later.Returns true for success, false for failure.
Deprecated
FindCertByLocalKeyId
Deprecated. Use CertByLocalKeyId instead.
Searches for a certificate whose certificate-bag localKeyId attribute matches the binary value supplied in byLocalKeyId. encoding names the representation used for byLocalKeyId, such as decimal, base64, or hex.
byLocalKeyId was obtained from GetSafeBagAttr using the attribute name localKeyId, pass decimal for encoding. This lookup is the reliable way to find a key's matching certificate; collection indexes do not correspond.Returns nil on failure
GetCert
Deprecated. Use CertAt instead.
Returns the certificate at the zero-based index specified by . The first certificate is at index 0. An invalid index causes the method to fail and return no object.
GetCert(i) is not necessarily the certificate associated with GetPrivateKey(i). Use a matching localKeyId when one is present.Returns nil on failure
GetPrivateKey
Deprecated. Use PrivateKeyAt instead.
Returns the private key at the zero-based index specified by . The first private key is at index 0. An invalid index causes the method to fail and return no object.
GetPrivateKey(i) is not necessarily associated with GetCert(i). Use the private key's localKeyId and CertByLocalKeyId when that attribute is present.PrivateKey object contains secret key material. Avoid logging, displaying, or exporting it unless the application explicitly requires that operation.Returns nil on failure
LastJsonData
Deprecated. Use GetLastJsonData instead.
Returns structured JSON information produced by the most recent operation that generated such data. The exact JSON members depend on the preceding method.
Returns nil on failure
ToJavaKeyStore
Deprecated. Use ToJksObj instead.
Creates a Java KeyStore object with one private-key entry for each private key in this PFX. Certificates in the PFX are used to construct the certificate chain for each entry. password is used to protect the generated private-key entries.
If is nonempty, it is used as the alias for the first private key. Otherwise, the alias is chosen using the following order:
- Certificate subject common name.
- Certificate subject email address.
- PKCS#9 friendly-name attribute.
- Certificate serial number.
Additional private keys receive automatically selected aliases using the same preference order.
Returns nil on failure