You have a Java keystore (JKS) file with a public/private keypair that you're importing via Certificate and Key Management. When you do so, you see an error message: Error: keystore file is corrupted:

enter image description here

1 Answer 1


The root cause of this issue is the change of default keystore format in Java 9:

For approximately two decades, Java and keytool had relied on the JDK-specific JKS keystore type as its default store. As specified by JEP 229, JDK9 transitions the default keystore to PKCS12

As of this writing (Spring '23), SF wants the legacy JKS format. If you're building the JKS by yourself via keytool, do this:

  • Java 9 or newer: add -deststoretype JKS to keytool -importkeystore... command

  • Java is older than 9: no change. Run keytool -importkeystore... as usual without the extra -deststoretype.. arg.

  • 1
    Error: The key used for "localhost" is not an RSA key. Sigh Salesforce doesn't allow ECDSA
    – compski
    Commented Mar 9, 2023 at 11:58
  • prnt.sc/pfMTA1q8y3OP screenshot for above
    – compski
    Commented Mar 16, 2023 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .