The java keytool cannot import or export private keys. In particular it cannot handle PKCS12 files (although the J2EE version of keytool can). As a workaround, I downloaded PKCS12Import.java from the Jetty project. It can create a JKS keystore file from a PKCS12 file.