Today I needed to use the JWT flow to get an access token from Salesforce to use the Salesforce API in a server to server scenario. To do that you need a private key (usually in PEM format) for the client and the corresponding public key in a keystore on the Salesforce side. Being lazy I simply generated a public / private key pair in Salesforce with an exportable private key and exported the keystore.
Since Salesforce exports the keystore in Java Keystore Format (JKS) I need to work with the Java keytool and openssl to export the private key. Below are the steps. The landing_site_pk alias below is the same of the private key entry in the keystore and the API name of the keystore in Salesforce and Passw0rd is the password specified when exporting the keystore. Adjust as needed.
$ keytool -importkeystore -srckeystore ./00D090000046d3F.jks -srcstorepass Passw0rd -srcalias landing_site_pk -destalias landing_site_pk -destkeystore ./00D090000046d3F.p12 -deststoretype PKCS12 -deststorepass Passw0rd -destkeypass Passw0rd Importing keystore ./00D090000046d3F.jks to ./00D090000046d3F.p12... $ openssl pkcs12 -in ./00D090000046d3F.p12 -nodes -nocerts -out 00D090000046d3F.pem Enter Import Password: MAC verified OK $ cat 00D090000046d3F.pem Bag Attributes friendlyName: landing_site_pk localKeyID: 54 69 6D 65 20 31 36 30 36 33 39 30 30 35 36 38 30 38 Key Attributes: -----BEGIN PRIVATE KEY----- MIIEuwIBA....bTe+Hzyz -----END PRIVATE KEY-----
Thank you very much for this short but to the point post. Was having a hard time trying to figure out how to get the private key.