---
title: KeyManager
description: The configuration of a Java Secure Socket Extension KeyManager to manage private keys for IG. The configuration references the keystore that holds the keys.
component: pinggateway
version: 7.2
page_id: pinggateway:reference:KeyManager
canonical_url: https://docs.pingidentity.com/pinggateway/2025.11/reference/KeyManager.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2025-06-02T16:30:54Z
superseded_by: https://docs.pingidentity.com/pinggateway/2025.11/reference/KeyManager.html
section_ids:
  KeyManager-usage: Usage
  KeyManager-properties: Properties
  KeyManager-example: Example
  KeyManager-moreinfo: More information
---

# KeyManager

The configuration of a Java Secure Socket Extension [KeyManager](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/javax/net/ssl/KeyManager.html) to manage private keys for IG. The configuration references the keystore that holds the keys.

When IG acts as a server, it uses a KeyManager to prove its identity to the client. When IG acts as a client, it uses a KeyManager to prove its identity to the server.

## Usage

```json
{
  "name": string,
  "type": "KeyManager",
  "config": {
    "keystore": KeyStore reference,
    "passwordSecretId": configuration expression<secret-id>,
    "alg": configuration expression<string>,
    "secretsProvider": SecretsProvider reference,
    "password": string //deprecated
  }
}
```

## Properties

* `"keystore"`: *KeyStore [reference](preface.html#definition-reference), required*

  The KeyStore that references the store for key certificates. When `keystore` is used in a KeyManager, it queries for private keys; when `keystore` is used in a TrustManager, it queries for certificates.

  Provide either the name of the KeyStore object defined in the heap, or an inline KeyStore configuration object.

  When ClientHandler or ReverseProxyHandler use `keystore` in web container mode, the keystore can be different to that used by the web container.

  See also [KeyStore](MiscellaneousConfigurationObjects.html#KeyStore).

* `"passwordSecretId"`: *configuration expression<[secret-id](preface.html#definition-secretid)>, required*

  The secret ID of the password required to read private keys from the KeyStore.

* `"alg"`: *configuration expression<[string](preface.html#definition-string)>, optional*

  The certificate algorithm to use.

  Default: the default for the platform, such as `SunX509`.

  See also [Expressions](Expressions.html#Expressions).

* `"secretsProvider"`: *SecretsProvider [reference](preface.html#definition-reference), optional*

  The SecretsProvider to query for the keystore password. For more information, see [SecretsProvider](secrets.html#SecretsProvider).

  Default: The route's default secret service. For more information, see [Default secrets object](secrets.html#default-secrets-object).

* `"password"`: *string, required*

  |   |                                                                                                                                                                       |
  | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | The use of this property is deprecated; use `passwordSecretId` instead. For more information, refer to [Deprecation](../release-notes/deprecated-functionality.html). |

  The password to read private keys from the keystore.

## Example

The following example configures a KeyManager that depends on a [KeyStore](KeyStore.html) configuration. The KeyManager and KeyStore passwords are provided by Java system properties or environment variables, and retrieved by the SystemAndEnvSecretStore. By default, the password values must be base64-encoded.

```json
{
  "name": "MyKeyManager",
  "type": "KeyManager",
  "config": {
    "keystore": {
      "type": "KeyStore",
      "config": {
        "url": "file://${env['HOME']}/keystore.jks",
        "passwordSecretId": "keymanager.keystore.secret.id",
        "secretsProvider": "SystemAndEnvSecretStore"
      }
    },
    "passwordSecretId": "keymanager.secret.id",
    "secretsProvider": "SystemAndEnvSecretStore"
  }
}
```

## More information

[org.forgerock.openig.security.KeyManagerHeaplet](../_attachments/apidocs/org/forgerock/openig/security/KeyManagerHeaplet.html)

[JSSE Reference guide ](https://docs.oracle.com/en/java/javase/17/security/java-secure-socket-extension-jsse-reference-guide.html#GUID-93DEEE16-0B70-40E5-BBE7-55C3FD432345), [KeyStore](MiscellaneousConfigurationObjects.html#KeyStore), [TrustManager](MiscellaneousConfigurationObjects.html#TrustManager)