We Keep Coding

How to sign a String with an Android X509Certificate certificate A1

Good afternoon folks, I'm new to developing apps for android and after many searches I still can't sign a string with X509Certificate A1 on android. I have the certificate in byte [] and the password, which are returned from a service and I pass as a parameter to the method SubscribeString, but I'm not able to sign. I tried to use the following code:
public String SubscribeString(String texto, byte[] certificateByte, String password)
{
try {
InputStream certificado = new ByteArrayInputStream(certificateByte);
KeyStore rep = KeyStore.getInstance(KeyStore.getDefaultType());
rep.load(certificado, password.toCharArray());
String alias = "TravelTicket";
PrivateKey privateKey = (PrivateKey) rep.getKey(alias, password.toCharArray());
Signature dsa = Signature.getInstance("SHA1withRSA");
/* Initializing the object with a private key */
dsa.initSign(privateKey);
/* Update and sign the data */
dsa.update(texto.getBytes());
byte[] sig = dsa.sign();
texto = new String(Base64.getEncoder().encode(sig));
} catch (Exception ex) {
ex.printStackTrace();
}
return texto;
}

(SSL) Loading a private key into android keystore

I have my file, key.key which i now used OpenSSL to convert to PKCS8 format, this is the key template
-----BEGIN PRIVATE KEY-----
some letters and numbers
-----END PRIVATE KEY-----
When im trying to load it into my key store as so:
PrivateKey privateKey = kf.generatePrivate(new PKCS8EncodedKeySpec(privateKeyBytes));
I get the Error
com.android.org.conscrypt.OpenSSLX509CertificateFactory$ParsingException: Error parsing private key
(im using OkHttpChannel builder and Conscrypt as a security provider).
I tried changing the key's format, which is why it is now in PKCS8 since iv'e read its the eaziest one for android java to read.
Update::
Even after loading the key and the two certificates i still get the
------------------Untrusted chain: ---------------------- error, any help ?
The code used:
private static byte[] getBytesFromInputStream(InputStream is) throws IOException {
ByteArrayOutputStream os = new ByteArrayOutputStream();
byte[] buffer = new byte[0xFFFF];
for (int len = is.read(buffer); len != -1; len = is.read(buffer)) {
os.write(buffer, 0, len);
}
return os.toByteArray();
}
// build a key store from a set of raw certificates
private static KeyStore createKeyStore(Resources resources, int certsId, boolean ca) {
KeyStore ks = null;
try {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
if (ca) {
ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(null, null);
InputStream certIS = resources.openRawResource(R.raw.ca_crt);
X509Certificate cert = (X509Certificate) cf.generateCertificate(certIS);
ks.setCertificateEntry("ca", cert);
} else {
ks = KeyStore.getInstance("AndroidKeyStore");
ks.load(null, null);
InputStream certIS = resources.openRawResource(R.raw.client_crt);
Certificate cert = cf.generateCertificate(certIS);
InputStream privateKeyIS = resources.openRawResource(R.raw.client_pkcs8);
byte[] privateKeyBytes = RNGrpcChannelBuilder.getBytesFromInputStream(privateKeyIS);
KeyFactory kf = KeyFactory.getInstance("RSA");
PrivateKey privateKey = kf.generatePrivate(new PKCS8EncodedKeySpec(privateKeyBytes));
Certificate[] certChain = new Certificate[1];
certChain[0] = cert;
ks.setKeyEntry("client", privateKey, null, certChain);
}
} catch (Exception e) {
throw new RuntimeException(e);
}
return ks;
}
public static ManagedChannel build(String host, int port, Resources resources,
#Nullable String serverHostOverride) {
KeyStore ca = RNGrpcChannelBuilder.createKeyStore(resources, R.array.certs, true);
KeyStore client = RNGrpcChannelBuilder.createKeyStore(resources, R.array.certs, false);
OkHttpChannelBuilder channelBuilder =
OkHttpChannelBuilder.forAddress(host, port);
if (serverHostOverride != null) {
// Force the hostname to match the cert the server uses.
channelBuilder.overrideAuthority(serverHostOverride);
}
try {
channelBuilder.negotiationType(io.grpc.okhttp.NegotiationType.TLS);
channelBuilder.useTransportSecurity();
channelBuilder.sslSocketFactory(getSslSocketFactory(ca, client));
} catch (Exception e) {
throw new RuntimeException(e);
}
return channelBuilder.build();
}
private static SSLSocketFactory getSslSocketFactory(KeyStore ca, KeyStore client)
throws Exception {
KeyManagerFactory kmf =
KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
String password = "";
kmf.init(client, password.toCharArray());
// initialize trust manager factor from certs keystore
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ca);
// initialize SSL context from trust manager factory
SSLContext context = SSLContext.getInstance("TLS");
context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());
// return socket factory from the SSL context
return context.getSocketFactory();
}

Signing CSR with Java does not validate using OpenSSL

I'm signing a CSR to an intermediate certificate, both of which were generated using OpenSSL. The signing code uses Java Bouncy Castle APIs, and the code successfully generates a cert. When inspecting the cert, everything appears fine. The issuer and other data show up correctly in the dump.
However, when executing an openssl verify command, it fails with:
error 20 at 0 depth lookup:unable to get local issuer certificate
Signing an OpenSSL generated CSR to this same intermediate certificate verifies correctly.
The verify is successful when checked with the Java code:
cert.verify(cacert.getPublicKey())
-----BEGIN CERTIFICATE-----
MIIDEjCCArmgAwIBAgIFAJl/JBYwCgYIKoZIzj0EAwIwdTETMBEGA1UEDRMKMTUw
MzkxNzkxNDEVMBMGA1UEAwwMcGh5enpsaXRlLTAxMQ4wDAYDVQQLDAVQaHl6ejEd
MBsGA1UECgwUTWltb3NhIE5ldHdvcmtzLCBJbmMxCzAJBgNVBAgMAkNBMQswCQYD
VQQGEwJVUzAeFw0xNzA4MzAwMDA4MzhaFw0yNzAzMzEwMDA4MzhaMIG8Me0wGwYD
VQQKExRNaW1vc2EgTmV0d39ya3MsIEluYzEjMCEGA2UEAxMaMDEyMzcyOEI4MDAw
MTAwMTA3QkM0RkREQUMxEzARBgNVBAUTCjMwNzE1NDE4MjIxGjAYBgNVBCoTETIw
OmI1OmM2OjBmOmQ7OjNiMRowGAYDVQQEExEyMDpiNTpjNjowZjpkNjozETEaMBgG
A1UEKRMRMjA5YjU6YzY6MGY6ZDY6M2MxDTALBgNVBAwTBDMzMzkwWTATBgcqhkjO
PQIBBggqhkjOPQMBBwNCAARUdhMYLbb94GlWSh8b01lVfKL7+6sCw7hZdiMy9JIF
YBnTjLyGm1HjoRKl6ItuEzjdNFXMnFlMMuCbUTsij4L2o4HtMIHqMAwGA1UdEwQF
MAMBAf8wHQYDVR0OBBYEFPjbF9wIOB3uq2C7Yf6l8iMSU7SDMIGlBgNVHSMEgZ0w
gZqAFAshdhvN+xIrKpHeFG4o/TrJt6i/oXykejB4MQswCQYDVQQGEwJVUzELMAkG
A1UECBMCQ0ExHTAbBgNVBAoTFE1pbW9zYSBOZXR3b3JrcywgSW5jMQ4wDAYDVQQL
EwVQaHl6ejEYMBYGA1UEAxMPaW50ZXJjZWRpYRXlMTMzMRMwEQYDVQQNEwoxNDEy
OTU0Nzk1ggQFoABWMBMGA1UdEQQMMAqICCsGAQQBgtJcMAoGCCqGSM49BAMCA0cA
MEQCIFK2FycAFextGiAQPozuT2LFR/AtPDHpGyXn6z3ccUCVAiBFkwn/YBVz5yof
r5YHxgoz0LIJ+XUqLACNTHJhHstDCA==
-----END CERTIFICATE-----
public static X509Certificate certFromFile(String path) {
X509Certificate cert;
try {
CertificateFactory fact = CertificateFactory.getInstance("X.509");
FileInputStream is = new FileInputStream(path);
cert = (X509Certificate) fact.generateCertificate(is);
} catch (CertificateException | FileNotFoundException e) {
String error = e.getMessage();
System.err.println(error);
return null;
}
return cert;
}
public static String DumpCert(X509Certificate cert) {
ByteArrayOutputStream out = new ByteArrayOutputStream();
try {
out.write("-----BEGIN CERTIFICATE-----\n".getBytes());
out.write(Base64.encode(cert.getEncoded()));
out.write("\n-----END CERTIFICATE-----\n".getBytes());
out.close();
} catch (IOException | CertificateEncodingException e) {
System.out.println(e.getMessage());
}
String certpem = null;
try {
certpem = new String(out.toByteArray(), "ISO-8859-1");
} catch (UnsupportedEncodingException e) {
System.out.println(e.getMessage());
}
return certpem;
}
public static ContentSigner createSigner(PrivateKey privateKey) {
try {
ContentSigner sig = new JcaContentSignerBuilder("SHA256withECDSA").build(privateKey);
return sig;
} catch (Exception e) {
throw new RuntimeException("Could not create content signer.", e);
}
}
public static String signCSR(PKCS10CertificationRequest csr, GeneralName san, int validity,
X509Certificate cacert, KeyStore keystore, String alias) throws Exception {
Date from = new Date();
Date to = new Date(System.currentTimeMillis() + (validity * 86400000L));
PrivateKey cakey = null;
try {
cakey = (PrivateKey) keystore.getKey(alias, null);
} catch (Exception e) {
System.out.println(e.getMessage());
}
GeneralNames subjectAltNames = new GeneralNames(san);
org.bouncycastle.asn1.x500.X500Name csrSubject = csr.getSubject();
X500Name issuer = new X500Name(cacert.getSubjectX500Principal().getName());
X500Name caName = X500Name.getInstance(PrincipalUtil.getIssuerX509Principal(cacert).getEncoded());
GeneralNames gn = new GeneralNames(new GeneralName(caName));
BigInteger serial = new BigInteger(32, new SecureRandom());
SubjectPublicKeyInfo keyinfo = csr.getSubjectPublicKeyInfo();
DigestCalculator digCalc = new BcDigestCalculatorProvider().get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);
X509v3CertificateBuilder certgen = new X509v3CertificateBuilder(issuer, serial, from, to, csrSubject, keyinfo);
BigInteger serialcert = cacert.getSerialNumber();
Boolean buildCACert = true;
PublicKey caKey = cacert.getPublicKey();
SubjectPublicKeyInfo keyinfoCA = SubjectPublicKeyInfo.getInstance(caKey.getEncoded());
AuthorityKeyIdentifier akiMain = x509ExtensionUtils.createAuthorityKeyIdentifier(keyinfoCA);
AuthorityKeyIdentifier aki = new AuthorityKeyIdentifier(akiMain.getKeyIdentifier(), gn, serialcert);
certgen.addExtension(Extension.basicConstraints, false, new BasicConstraints(buildCACert));
certgen.addExtension(Extension.subjectKeyIdentifier, false, x509ExtensionUtils.createSubjectKeyIdentifier(keyinfo));
certgen.addExtension(Extension.authorityKeyIdentifier, false, aki);
certgen.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
ContentSigner signer = createSigner(cakey);
X509CertificateHolder holder = certgen.build(signer);
X509Certificate cert = null;
try {
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
InputStream in = new ByteArrayInputStream(holder.getEncoded());
cert = (X509Certificate) certFactory.generateCertificate(in);
} catch (CertificateException | IOException e) {
System.out.println(e.getMessage());
}
return DumpCert(cert);
}
public static GeneralName getSubjectAlternativeName(PKCS10CertificationRequest csr) {
org.bouncycastle.asn1.pkcs.Attribute[] certAttributes = csr.getAttributes();
for (org.bouncycastle.asn1.pkcs.Attribute attribute : certAttributes) {
if (attribute.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0));
GeneralNames gns = GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName);
GeneralName name = gns.getNames()[0];
return name;
}
}
return null;
}
public static String PrepAndSignCSR(String raw_csr, String certPath, String keystore) {
KeyStore ks = null;
Object parsedObject = null;
String alias = "alias";
String s = null;
X509Certificate caCert = null;
StringReader sr = new StringReader(raw_csr);
PEMParser pemParser = new PEMParser(sr);
try {
parsedObject = pemParser.readObject();
System.out.println("PemParser returned : " + parsedObject);
} catch (IOException e) {
String error = e.getMessage();
System.err.println(error);
}
PKCS10CertificationRequest CSR = (PKCS10CertificationRequest) parsedObject;
caCert = certFromFile(certPath);
try {
ks = KeyStore.getInstance("ncipher.sworld", "nCipherKM");
FileInputStream in = new FileInputStream(keystore);
ks.load(in, null);
} catch (KeyStoreException |
NoSuchAlgorithmException |
CertificateException |
IOException |
NoSuchProviderException e) {
System.err.println(e.getMessage());
}
GeneralName san = getSubjectAlternativeName(CSR);
try {
String cert = signCSR(CSR, san, 3500, caCert, ks, alias);
return cert;
} catch (Exception e) {
String error = e.getMessage();
System.err.println(error);
}
return null;
}
public static void main(String[] args) {
.
.
.
String fini = PrepAndSignCSR(csr, caCertPath, keystore);
System.out.println(fini);
}
}

After some debug sessions within openssl, I found the issuer name was not matching. Replaced this line with getEncoded...
X500Name issuer = newX500Name(cacert.getSubjectX500Principal().getName());
X500Name issuer = X500Name.getInstance(cacert.getSubjectX500Principal().getEncoded());
The signed certs are now verifying with openssl verify command.

You're comparing apples and oranges.
java.security.cert.Certificate.verify() does nothing more than check the digital signature against the supplied public key.
openssl x509 verify checks the entire certificate chain, looks for the trust anchor, and verifies the digital signature and expiry dates of every certificate in the chain.
You need to specify the -CAfile or -CApath options to openssl. See the man page.

getting Exception java.security.InvalidKeyException: Wrong format: RAW bytes needed

Im trying to write a program for encrypting, signing and decrypting files using private public keys . While running the program below i receive the following error -
Exception in thread "main" java.security.InvalidKeyException: Wrong format: RAW bytes needed at com.sun.crypto.provider.CipherCore.getKeyBytes(CipherCore.java:623) at com.sun.crypto.provider.CipherCore.init(CipherCore.java:494) at com.sun.crypto.provider.CipherCore.init(CipherCore.java:458) at com.sun.crypto.provider.AESCipher.engineInit(AESCipher.java:307) at javax.crypto.Cipher.init(Cipher.java:1226) at
javax.crypto.Cipher.init(Cipher.java:1166) at
Main.main(Main.java:87)
MY CODE
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.net.URL;
import java.nio.ByteBuffer;
import java.security.*;
import java.security.cert.CertificateException;
import javax.crypto.*;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
public class Main
{
public static void main(String[] args) throws IOException, UnrecoverableKeyException, KeyStoreException, NoSuchAlgorithmException, NoSuchPaddingException, CertificateException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException, SignatureException{
//open the file containing keys
File file = new File("keys/ks_file.jks");
//cipher object that will hold the information
Cipher aes = Cipher.getInstance("AES/ECB/PKCS5Padding");
//create keystore object from stored keys inside the file
KeyStore keystore = loadKeyStore(file, "sergey", "JKS");
//messageDigest instance
MessageDigest md = MessageDigest.getInstance("SHA1");
//singanture instance
Signature dsa = Signature.getInstance("SHA1withDSA");
//params for getting keys
String allias = "enc_key", password = "sergey";
SecureRandom s_random = SecureRandom.getInstance("SHA1PRNG");
//create random bytes for semtric key
byte key_bytes[] = new byte[16];
s_random.setSeed(711);
s_random.nextBytes(key_bytes);
Key key = new SecretKeySpec(key_bytes, "AES");
Key key_enc = keystore.getKey(allias, password.toCharArray());
KeyPair enc_key = null;
if (key_enc instanceof PrivateKey) {
// Get certificate of public key
java.security.cert.Certificate cert = keystore.getCertificate(allias);
// Get public key
PublicKey publicKey = cert.getPublicKey();
enc_key = new KeyPair(publicKey, (PrivateKey) key_enc);
}
//cipher the file
aes.init(Cipher.ENCRYPT_MODE, key);
FileInputStream fis;
FileOutputStream fos;
CipherInputStream cis;
fis = new FileInputStream("tmp/a.txt");
cis = new CipherInputStream(fis, aes);
fos = new FileOutputStream("tmp/b.txt");
byte[] b = new byte[8];
int i = cis.read(b);
byte[] bytes = ByteBuffer.allocate(4).putInt(i).array();
//update message digest for signature
md.update(bytes);
while (i != -1) {
fos.write(b, 0, i);
i = cis.read(b);
bytes = ByteBuffer.allocate(4).putInt(i).array();
md.update(bytes);
}
fis.close();
cis.close();
fos.close();
//encode the secret key
/**************** ERROR HAPPENS IN NEXT LINE - LINE 87 *******************/
aes.init(Cipher.ENCRYPT_MODE, (Key)enc_key.getPublic());
byte[] cipherKey = aes.doFinal(key.toString().getBytes());
//we save the final digest
byte[] hash = md.digest();
//init singature with private key
dsa.initSign(enc_key.getPrivate());
//update the signature with the hash aster digest
dsa.update(hash);
//final signature
byte[] sig = dsa.sign();
//creating config xml
try {
DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
// root elements
Document doc = docBuilder.newDocument();
Element rootElement = doc.createElement("config");
doc.appendChild(rootElement);
// signature elements
Element sig_xml = doc.createElement("sig");
rootElement.appendChild(sig_xml);
sig_xml.setAttribute("value", sig.toString());
// key element
Element key_xml = doc.createElement("key");
rootElement.appendChild(key_xml);
key_xml.setAttribute("value", cipherKey.toString());
// write the content into xml file
TransformerFactory transformerFactory = TransformerFactory.newInstance();
Transformer transformer = transformerFactory.newTransformer();
DOMSource source = new DOMSource(doc);
StreamResult result = new StreamResult(new File("./config.xml"));
transformer.transform(source, result);
System.out.println("File saved!");
} catch (ParserConfigurationException pce) {
pce.printStackTrace();
} catch (TransformerException tfe) {
tfe.printStackTrace();
}
}
/**
* Reads a Java keystore from a file.
*
* #param keystoreFile
* keystore file to read
* #param password
* password for the keystore file
* #param keyStoreType
* type of keystore, e.g., JKS or PKCS12
* #return the keystore object
* #throws KeyStoreException
* if the type of KeyStore could not be created
* #throws IOException
* if the keystore could not be loaded
* #throws NoSuchAlgorithmException
* if the algorithm used to check the integrity of the keystore
* cannot be found
* #throws CertificateException
* if any of the certificates in the keystore could not be loaded
*/
public static KeyStore loadKeyStore(final File keystoreFile,
final String password, final String keyStoreType)
throws KeyStoreException, IOException, NoSuchAlgorithmException,
CertificateException {
if (null == keystoreFile) {
throw new IllegalArgumentException("Keystore url may not be null");
}
final URI keystoreUri = keystoreFile.toURI();
final URL keystoreUrl = keystoreUri.toURL();
final KeyStore keystore = KeyStore.getInstance(keyStoreType);
InputStream is = null;
try {
is = keystoreUrl.openStream();
keystore.load(is, null == password ? null : password.toCharArray());
} finally {
if (null != is) {
is.close();
}
}
return keystore;
}
}
The specific line, in which the exception occurs is:
aes.init(Cipher.ENCRYPT_MODE, (Key)enc_key.getPublic());

AES is a symmetric cipher algorithm, for this it needs a symmetric key, not a public key.
In order to create symmetric key, use helper class SecretKeySpec.
Your encryption scheme should create a random sequence of bits as a key material for AES cipher, and then encrypt/decrypt this key material with Public/Private keys.
The message itself should be encrypted/decrypted with AES key.

Convert SSL .pem to .p12 with or without OpenSSL

I get external .pem files that need to be converted to .p12 files - I add a username and password in the process. (I need to do this to utilize a third party API.)
Using openssl, the command is...
openssl pkcs12 -export -in xxxx.pem -inkey xxxx.pem -out xxx.p12 -passout pas:newpassword -name "newname"
I can run this from a terminal session and it works perfectly.
However, I will need to do this often and have written a Java class that handles this and more (my application is mostly .jsp with Tomcat and Apache). When I try run the same command from Java using Runtime.exec, I get the dreaded "unable to write 'random state'" error ( Using OpenSSL what does "unable to write 'random state'" mean? ).
I assume that the difference is that, when I run from Java, the user is not "root".
So, is there a better way to convert from pem to .p12 using a Java library rather than executing a command line program (i.e. openssl)?
Otherwise, I guess I need to do some configuration on my server. I can not find any .md file anywhere on the server. The only openssl.cnf file is in a weird directory (/etc/pki/tls). Do I need to create a new openssl.cnf file somewhere else?

This should do what you want to do (using the BouncyCastle PEMReader as suggested above) -- take a PEM-encoded private key + certificate, and output a PKCS#12 file. Uses the same password for the PKCS12 that was used to protect the private key.
public static byte[] pemToPKCS12(final String keyFile, final String cerFile, final String password) throws Exception {
// Get the private key
FileReader reader = new FileReader(keyFile);
PEMReader pem = new PEMReader(reader, new PasswordFinder() {
#Override public char[] getPassword() {
return password.toCharArray();
}
});
PrivateKey key = ((KeyPair)pem.readObject()).getPrivate();
pem.close();
reader.close();
// Get the certificate
reader = new FileReader(cerFile);
pem = new PEMReader(reader);
X509Certificate cert = (X509Certificate)pem.readObject();
pem.close();
reader.close();
// Put them into a PKCS12 keystore and write it to a byte[]
ByteArrayOutputStream bos = new ByteArrayOutputStream();
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(null);
ks.setKeyEntry("alias", (Key)key, password.toCharArray(), new java.security.cert.Certificate[]{cert});
ks.store(bos, password.toCharArray());
bos.close();
return bos.toByteArray();
}

Based on #MugglesMerriweather 's answer, an updated version to v1.51 is the following:
public static byte[] convertPEMToPKCS12(final String keyFile, final String cerFile,
final String password)
throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException
{
// Get the private key
FileReader reader = new FileReader(keyFile);
PEMParser pem = new PEMParser(reader);
PEMKeyPair pemKeyPair = ((PEMKeyPair)pem.readObject());
JcaPEMKeyConverter jcaPEMKeyConverter = new JcaPEMKeyConverter().setProvider("SC");
KeyPair keyPair = jcaPEMKeyConverter.getKeyPair(pemKeyPair);
PrivateKey key = keyPair.getPrivate();
pem.close();
reader.close();
// Get the certificate
reader = new FileReader(cerFile);
pem = new PEMParser(reader);
X509CertificateHolder certHolder = (X509CertificateHolder) pem.readObject();
java.security.cert.Certificate X509Certificate =
new JcaX509CertificateConverter().setProvider("SC")
.getCertificate(certHolder);
pem.close();
reader.close();
// Put them into a PKCS12 keystore and write it to a byte[]
ByteArrayOutputStream bos = new ByteArrayOutputStream();
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(null);
ks.setKeyEntry("alias", (Key) key, password.toCharArray(),
new java.security.cert.Certificate[]{X509Certificate});
ks.store(bos, password.toCharArray());
bos.close();
return bos.toByteArray();
}

In Java, use Bouncycastle but be warned, learning curve is steep and documentation scarce. I strongly recommend you look at the examples which are available as part of the source distribution
Start with the PemReader.

Based on the answers i created a java 7 class, which handles everything for creating a valid SSLContext. Also it creates the necessary chain. TODO: Trustmanager if necessary.
public final class SSL_Context {
private static SSL_Context instance = new SSL_Context();
public static SSL_Context getInstance() {
return instance;
}
private SSLContext sslContext = null;
private SSL_Context() {
try {
sslContext = generateSSLContext();
}
catch (Exception e)
{
ErrorLogger.logException(e);
}
}
final private void dumpKeyStore(KeyStore keyStore)
{
try {
// List the aliases
Enumeration aliases = keyStore.aliases();
for (; aliases.hasMoreElements(); ) {
String alias = (String) aliases.nextElement();
// Does alias refer to a private key?
boolean a = keyStore.isKeyEntry(alias);
// Does alias refer to a trusted certificate?
boolean b = keyStore.isCertificateEntry(alias);
ErrorLogger.log(alias + " " + a + " " + b, 2);
}
} catch (Exception e) {
ErrorLogger.logException(e);
}
}
final private KeyStore convertPEMToPKCS12(final String keyAndPubFile, final String chainFile, final String password) {
try {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
PrivateKey key;
Certificate pubCert;
try (FileReader reader = new FileReader(keyAndPubFile);
PEMParser pem = new PEMParser(reader)) {
PEMKeyPair pemKeyPair = ((PEMKeyPair) pem.readObject());
JcaPEMKeyConverter jcaPEMKeyConverter = new JcaPEMKeyConverter().setProvider("BC");
KeyPair keyPair = jcaPEMKeyConverter.getKeyPair(pemKeyPair);
key = keyPair.getPrivate();
X509CertificateHolder certHolder = (X509CertificateHolder) pem.readObject();
pubCert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);
}
// Get the certificates
try (FileReader reader = new FileReader(chainFile);
PEMParser pem = new PEMParser(reader)) {
//load all certs
LinkedList<Certificate> certsll = new LinkedList<>();
X509CertificateHolder certHolder = (X509CertificateHolder) pem.readObject();
do {
Certificate X509Certificate = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);
certsll.add(X509Certificate);
}
while ((certHolder = (X509CertificateHolder) pem.readObject()) != null);
Certificate[] chain = new Certificate[certsll.size()+1];
chain[0] = pubCert;
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(null);
int i = 1;
for (Certificate cert : certsll) {
ks.setCertificateEntry("chain" + i, cert);
chain[i] = ks.getCertificate("chain" + i);
i++;
}
ks.setKeyEntry("cert", key, password.toCharArray(), chain);
return ks;
}
}
catch (Exception e)
{
ErrorLogger.logException(e);
}
return null;
}
final private SSLContext generateSSLContext()
{
String keyStorePassword = "";
try {
KeyStore keyStore = convertPEMToPKCS12("ssl/keyandcert.pem", "ssl/ca_bundle.crt", keyStorePassword);
SSLContext sslContext = SSLContext.getInstance("TLSv1");
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());
sslContext.init(keyManagerFactory.getKeyManagers(), null, new SecureRandom());
return sslContext;
} catch (Exception e) {
ErrorLogger.logException(e);
}
return null;
}
final public SSLContext getContext() {
return sslContext;
}
final public static void main(String args[])
{
getInstance().getContext();
}
}

This solutions is an adaptation of #sascha-arthur's to accomodate for:
Handles edge-case where PrivateKey format is not as expected.
Gracefully handle scenario where public key is not available
Fixed a few minor redundancies and formatting
The code:
String alias="myalias";
char[] password = "mypassword".toCharArray();
// Private Key
PEMParser pem = new PEMParser(new FileReader(keyFile));
Object parsedObject = pem.readObject();
PrivateKeyInfo privateKeyInfo = parsedObject instanceof PEMKeyPair ? ((PEMKeyPair)parsedObject).getPrivateKeyInfo() : (PrivateKeyInfo)parsedObject;
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(privateKeyInfo.getEncoded());
KeyFactory factory = KeyFactory.getInstance("RSA");
PrivateKey key = factory.generatePrivate(privateKeySpec);
List<X509Certificate> certs = new ArrayList<>();
X509CertificateHolder certHolder = (X509CertificateHolder)pem.readObject();
if(certHolder != null) {
certs.add(new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder));
}
// Certificate
pem = new PEMParser(new FileReader(certFile));
while((certHolder = (X509CertificateHolder)pem.readObject()) != null) {
certs.add(new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder));
}
// Keystore
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(null);
for (int i = 0; i < certs.size(); i++) {
ks.setCertificateEntry(alias + "_" + i, certs.get(i));
}
KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load(null);
keyStore.setKeyEntry(alias, key, password, certs.toArray(new X509Certificate[certs.size()]));
For this to work with a LetsEncrypt certificate, you'll need to use the following files:
privkey.pem
fullchain.pem