What keystore format should I use?

Recommendation: Use PKCS12 format for new keystores.

• PKCS12 is the industry standard and portable across different tools and platforms
• JKS is Java-specific and considered legacy (though still supported)

<configuration>
  <storetype>PKCS12</storetype>
  <keystore>${project.build.directory}/keystore.p12</keystore>
</configuration>

How do I handle passwords securely?

Never hardcode passwords in your pom.xml or commit them to version control. Use one of these approaches:

<settings>
  <profiles>
    <profile>
      <id>secure</id>
      <properties>
        <keystore.password>your-password</keystore.password>
        <key.password>your-key-password</key.password>
      </properties>
    </profile>
  </profiles>
</settings>

<configuration>
  <storepass>${env.KEYSTORE_PASSWORD}</storepass>
  <keypass>${env.KEY_PASSWORD}</keypass>
</configuration>

export KEYSTORE_PASSWORD=secret
export KEY_PASSWORD=secret
mvn clean install

mvn clean install -Dkeystore.password=secret -Dkey.password=secret

mvn --encrypt-master-password
mvn --encrypt-password

Can I generate keystores automatically during the build?

Yes! The plugin is designed to integrate seamlessly with Maven's build lifecycle:

<plugin>
  <groupId>org.codehaus.mojo</groupId>
  <artifactId>keytool-maven-plugin</artifactId>
  <version>2.0.0</version>
  <executions>
    <execution>
      <id>auto-generate-keystore</id>
      <phase>generate-resources</phase>
      <goals>
        <goal>generateKeyPair</goal>
      </goals>
      <configuration>
        <keystore>${project.build.directory}/auto-generated.jks</keystore>
        <alias>auto-key</alias>
        <keyalg>RSA</keyalg>
        <keysize>2048</keysize>
        <validity>365</validity>
        <dname>CN=${project.artifactId}, O=${project.organization.name}</dname>
        <storepass>${keystore.password}</storepass>
        <keypass>${key.password}</keypass>
      </configuration>
    </execution>
  </executions>
</plugin>

For development environments, you can skip keystore generation when not needed:

mvn clean install -Dkeytool.skip=true

How do I migrate from command-line keytool to this plugin?

The plugin uses the Java KeyStore API directly, providing the same functionality as command-line keytool with better Maven integration:

Simply replace command-line invocations with the corresponding Maven goal and configuration.

What algorithms are supported?

Can I use this plugin in a multi-module project?

Yes! You can configure the plugin in the parent POM and inherit in modules, or configure module-specific keystores:

Parent POM:

<build>
  <pluginManagement>
    <plugins>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>keytool-maven-plugin</artifactId>
        <version>2.0.0</version>
        <configuration>
          <!-- Common configuration -->
          <keyalg>RSA</keyalg>
          <keysize>2048</keysize>
          <validity>365</validity>
          <storepass>${keystore.password}</storepass>
        </configuration>
      </plugin>
    </plugins>
  </pluginManagement>
</build>

Module POM:

<build>
  <plugins>
    <plugin>
      <groupId>org.codehaus.mojo</groupId>
      <artifactId>keytool-maven-plugin</artifactId>
      <executions>
        <execution>
          <goals>
            <goal>generateKeyPair</goal>
          </goals>
          <configuration>
            <!-- Module-specific configuration -->
            <keystore>${project.build.directory}/${project.artifactId}.jks</keystore>
            <alias>${project.artifactId}</alias>
            <dname>CN=${project.artifactId}, O=${project.parent.organization.name}</dname>
          </configuration>
        </execution>
      </executions>
    </plugin>
  </plugins>
</build>

How do I troubleshoot “Keystore was tampered with, or password was incorrect”?

This error typically occurs when:

1. Wrong password - Double-check your password configuration
2. Corrupted keystore - The keystore file may be corrupted
3. Wrong keystore type - Specify the correct storetype (JKS, PKCS12, etc.)

Solutions:

<!-- Explicitly specify keystore type -->
<configuration>
  <keystore>${project.build.directory}/myapp.jks</keystore>
  <storetype>JKS</storetype>  <!-- or PKCS12 -->
  <storepass>${correct.password}</storepass>
</configuration>

For PKCS12 files:

<configuration>
  <keystore>${project.build.directory}/myapp.p12</keystore>
  <storetype>PKCS12</storetype>
  <storepass>${correct.password}</storepass>
</configuration>

Can I use this with continuous integration systems?

Absolutely! The plugin works great with CI/CD pipelines:

GitHub Actions Example:

name: Build with Keystore

on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      
      - name: Set up JDK
        uses: actions/setup-java@v2
        with:
          java-version: '17'
          
      - name: Build with Maven
        run: mvn clean install
        env:
          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}

Jenkins Example:

pipeline {
    agent any
    
    environment {
        KEYSTORE_PASSWORD = credentials('keystore-password')
        KEY_PASSWORD = credentials('key-password')
    }
    
    stages {
        stage('Build') {
            steps {
                sh 'mvn clean install'
            }
        }
    }
}

What's the difference between version 1.x and 2.0?

Version 2.0 represents a complete architectural rewrite:

Migration is straightforward - the plugin configuration remains compatible, but you get better performance and reliability.

Where can I get help?

• Documentation: See the usage guide for comprehensive examples
• Issues: Report bugs or request features on GitHub Issues
• Source Code: GitHub Repository
• Maven Central: org.codehaus.mojo:keytool-maven-plugin