If you are not familiar with the Java keytool command, check out our Getting Started article.

Let's say you have a Java keystore or truststore file named "trusted_certs" in the /usr/local/certs directory. If the Java keystore or truststore is password protected, you will be prompted for the password.

~]$ keytool -list -keystore "/usr/local/certs/trusted_certs"
Enter keystore password:

Or, the -storepass option can be used to provide the password on the command line.

keytool -keystore cacerts -storepass itsasecret -list

The -storepasswd option can be used to update the password that is used for the Java keystore or truststore file.

~]$ keytool -keystore cacerts -storepasswd
Enter keystore password:  <current password>
New keystore password: <new password>
Re-enter new keystore password: <new password>

Be aware that if the current password is less than 6 characters, you may get the following error.

Keystore password is too short - must be at least 6 characters

In this scenario, you can export each certificate from the keystore.

keytool -export -keystore "/path/to/keystore" -storetype pkcs12 -storepass "keystore_password" -alias "alias name" -file "example.pem" -rfc

And then import each certificate into a new keystore with the new password.

keytool -import -file /path/to/example.pem -alias "*.example.com" -keystore /path/to/keystore.p12 -storetype pkcs12 -storepass keystore_password