---
title: KeyStore  (deprecated)
description: The configuration for a Java KeyStore, which stores cryptographic private keys and public key certificates.
component: pinggateway
version: 2023.11
page_id: pinggateway:reference:KeyStore
canonical_url: https://docs.pingidentity.com/pinggateway/2025.11/reference/KeyStore.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-03T11:21:31Z
superseded_by: https://docs.pingidentity.com/pinggateway/2025.11/reference/KeyStore.html
section_ids:
  KeyStore-usage: Usage
  KeyStore-properties: Properties
  KeyStore-example: Example
  KeyStore-moreinfo: More information
---

# KeyStore (deprecated)

|   |                                                                                                                                                                                                                                                  |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|   | This object is deprecated; use [KeyStoreSecretStore](KeyStoreSecretStore.html) instead. For more information, refer to the [Deprecated](https://docs.pingidentity.com/pinggateway/release-notes/deprecated.html) section of the *Release Notes*. |

The configuration for a Java [KeyStore](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/security/KeyStore.html), which stores cryptographic private keys and public key certificates.

|   |                                                                                                                         |
| - | ----------------------------------------------------------------------------------------------------------------------- |
|   | Legacy keystore types such as JKS and JCEKS are supported but are not secure. Consider using the PKCS#12 keystore type. |

## Usage

```json
{
  "name": name,
  "type": "KeyStore",
  "config": {
    "url": configuration expression<url>,
    "passwordSecretId": configuration expression<secret-id>,
    "type": configuration expression<string>,
    "secretsProvider": SecretsProvider reference,
    "password": string //deprecated
  }
}
```

## Properties

* `"url"`: *configuration expression<[url](preface.html#definition-url)>, required*

  URL to the keystore file.

  See also [Expressions](Expressions.html#Expressions).

* `"passwordSecretId"`: *configuration expression<[secret-id](preface.html#definition-secretid)>, optional*

  The secret ID of the password required to read private keys from the KeyStore.

  This secret ID must point to a [GenericSecret](../security-guide/keys.html#secret-types).

  If the KeyStore is used as a truststore to store only public key certificates of peers and no password is required to do so, then you do not have to specify this field.

  Default: No password is set.

  See also [Expressions](Expressions.html#Expressions).

* `"type"`: *configuration expression<[string](preface.html#definition-string)>, optional*

  The secret store type.

* `"secretsProvider"`: *SecretsProvider [reference](preface.html#definition-reference), optional*

  The SecretsProvider to query for the keystore password. For more information, see [SecretsProvider](secrets.html#SecretsProvider).

  Default: The route's default secret service. For more information, refer to [Default secrets object](secrets.html#default-secrets-object).

* `"password"`: *string, optional*

  |   |                                                                                                                                                                                                                                  |
  | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | The use of this property is deprecated; use `passwordSecretId` instead. For more information, refer to the [Deprecated](https://docs.pingidentity.com/pinggateway/release-notes/deprecated.html) section of the *Release Notes*. |

  The password to read private keys from the keystore.

  If the keystore is used as a truststore to store only public key certificates of peers and no password is required to do so, then you do not have to specify this field.

  Default: No password is set.

## Example

The following example configures a KeyStore that references the Java KeyStore file `$HOME/keystore.p12`. The KeyStore password is provided by a Java system property or environment variable, and retrieved by the SystemAndEnvSecretStore. By default, the password value must be base64-encoded.

```json
{
  "name": "MyKeyStore",
  "type": "KeyStore",
  "config": {
    "url": "file://${env['HOME']}/keystore.p12",
    "passwordSecretId": "keystore.secret.id",
    "secretsProvider": "SystemAndEnvSecretStore"
  }
}
```

## More information

[org.forgerock.openig.security.KeyStoreHeaplet](../_attachments/apidocs/org/forgerock/openig/security/KeyStoreHeaplet.html)

[JSSE Reference guide](https://docs.oracle.com/en/java/javase/17/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-93DEEE16-0B70-40E5-BBE7-55C3FD432345)

[KeyManager](KeyManager.html)

[TrustManager](TrustManager.html)