Question

Can we load multiple Certificates & Keys in a Key Store?

Is it always required to load only Pairs (i.e. Certificates & Keys together)?

If a Key Store has multiple Certificates and Keys, which one will get selected when Java SSL tries to establish connection as a Server?

Answer 1

Although this depends on the KeyStore type, generally, you can store multiple private keys and certificates in a single store.

Which key and certificate combination is used for a Java-based server will depend on how the application was implemented. A number of applications let you select a given certificate using the alias name. The key and certificate getters in KeyStore take an alias parameter to make this choice. Usually, when this is not specified in the configuration, the application or framework will use the first suitable one it finds based on the KeyStore.aliases() enumeration.

Tomcat, for example, uses the keyAlias attribute in its Connector configuration:

keyAlias: The alias used to for the server
certificate in the keystore. If not
specified the first key read in the
keystore will be used.

Regarding key pairs, some KeyStores (again, depending on the type) can be used to store SecretKeys (e.g. DES), that is shared keys, as well as public-private key pairs.