# Unable to load keystore : Invalid keystore format **URL:** \ **Category:** Pega-as-a-Service\ **Tags:** 5-5, devops, dev-designer-studio, installation-and-deployment, senior-system-architect, security\ **Created:** [November 21, 2022, 8:53am UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539 "2022-11-21T08:53:41Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![MarcHulsman](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/marchulsman/32/16188_2.png) [@MarcHulsman](https://forums.pega.com/u/MarcHulsman)\ **Post date:** [November 21, 2022, 8:53am UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/1 "2022-11-21T08:53:41Z")
Hi, I am trying to setup Deployment Manager 5.5 as described in: [Pegasystems Documentation](https://docs-previous.pega.com/devops/86/securely-authenticating-deployment-manager)? In here it says I have to create the JKS files, so I followed the steps in: [Pegasystems Documentation](https://docs-previous.pega.com/security/86/creating-keystorejks-and-truststorejks-files) I know that the keytool is a Java-tool, which comes at installing Java on your local computer. The syntax for using keytool is explained here: [keytool-Key and Certificate Management Tool](https://docs.oracle.com/javase/7/docs/technotes/tools/solaris/keytool.html) The first step is to create a new self-signed certificate: keytool -genkey -alias -keyalg RSA -keysize -keypass -keystore cluster-keystore.jks -storepass So for me it looks like: keytool -genkey -alias dmkeystore -keyalg RSA -keysize 2048 -keypass Password12! -keystore cluster-keystore.jks -storepass Password12! The keysize has to be 2048, because the keyalg is RSA. Now the cluster-keystore.jks is created, I login to the Pega environment and go to the keystore DMKeyStore and ‘Upload file’ and fill in the newly created ‘Keystore password’ Password12! and click on ‘Save’. While tracing this, I can see an ERROR occuring in the Activity Data-Admin-Security-Keystore Validate, step 3: (Data-Admin-Security-Keystore)Unable to load keystore : Invalid keystore format I have looked the Pega documentation, previous discussions and still can’t figure out what I am doing wrong and how it should be done. Can someone please help me? Kind regards, Marc ---
**Author:** ![Atanu\_Sen](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Atanu\_Sen](https://forums.pega.com/u/Atanu_Sen)\ **Post date:** [December 13, 2022, 11:31am UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/2 "2022-12-13T11:31:59Z")
@MarcHulsman - I am also facing similar issue. I kept the size at 1024. Pega Support - please provide resolution. ---
**Author:** ![MarijeSchillern](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/marijeschillern/32/23321_2.png) [@MarijeSchillern](https://forums.pega.com/u/MarijeSchillern)\ **Post date:** [December 13, 2022, 12:16pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/3 "2022-12-13T12:16:18Z")
@AtanuS17 @MarcHulsman please can you confirm that you also activated the key for application data encryption (ie the step after saving it) [Encrypting application data by using a custom key management service](https://docs.pega.com/bundle/platform-88/page/platform/security/encrypt-application-data-using-a-custom-key-management-service.html) > 1. Identify and activate the key for application data encryption. > > 2. In the header of Dev Studio, click Configure \> System \> Settings \> Data Encryption. > > 3. In the Application data encryption section, in the Keystore field, enter the name of the keystore that you created in step 3. > > 4. Click Activate. If you need an in-depth investigation into your issue, please log a support incident on the [MSP](https://msp.pega.com/). ---
**Author:** ![Kishore\_Sanagapalli](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/kishore_sanagapalli/32/4954_2.png) [@Kishore\_Sanagapalli](https://forums.pega.com/u/Kishore_Sanagapalli)\ **Post date:** [December 13, 2022, 12:26pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/4 "2022-12-13T12:26:05Z")
@MarcHulsman Hi, You’ll need to generate Cluster-Keystore.jks Trust-store.jks file too using keytool commands. Out of those 2, you did generate one already. Once you generate the trust-store.jks file and upload it, The Issue will be fixed. ---
**Author:** ![Atanu\_Sen](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Atanu\_Sen](https://forums.pega.com/u/Atanu_Sen)\ **Post date:** [December 14, 2022, 1:05pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/5 "2022-12-14T13:05:35Z")
@KishoreSanagapalli - basically what you are saying id only the cluster-truststore.jks file needs to be uploaded to the keystore? ---
**Author:** ![Atanu\_Sen](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Atanu\_Sen](https://forums.pega.com/u/Atanu_Sen)\ **Post date:** [December 14, 2022, 1:12pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/6 "2022-12-14T13:12:16Z")
@MarijeSchillern - this keystore is for inter node communication encryption between Pega Deployment Manager Orchestrator and Candidate nodes. ---
**Author:** ![Atanu\_Sen](https://avatars.discourse-cdn.com/v4/letter/a/47e85d/32.png) [@Atanu\_Sen](https://forums.pega.com/u/Atanu_Sen)\ **Post date:** [December 15, 2022, 1:37pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/7 "2022-12-15T13:37:50Z")
@MarcHulsman - An “Invalid keystore format” error **occurs when a keystore is read by a JDK version lower than a keystore generated with JDK 8u301 and higher**. - from google ---
**Author:** ![Kishore\_Sanagapalli](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/kishore_sanagapalli/32/4954_2.png) [@Kishore\_Sanagapalli](https://forums.pega.com/u/Kishore_Sanagapalli)\ **Post date:** [December 15, 2022, 2:20pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/8 "2022-12-15T14:20:24Z")
@AtanuS17 Do let me know if you are still facing the issue, even after following all the below instructions ---
**Author:** ![Kishore\_Sanagapalli](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/kishore_sanagapalli/32/4954_2.png) [@Kishore\_Sanagapalli](https://forums.pega.com/u/Kishore_Sanagapalli)\ **Post date:** [December 15, 2022, 1:53pm UTC](https://forums.pega.com/t/unable-to-load-keystore-invalid-keystore-format/3539/9 "2022-12-15T13:53:00Z")
@AtanuS17 I mean to say that, You need to follow the steps listed in the below URL’s like generating Key store and Trust store JKS files. Post the generation, YOu’ll need to upload in the application. URL’s to generate the .jks files [https://docs.pega.com/security/86/creating-keystorejks-and-truststorejks-files](https://docs.pega.com/security/86/creating-keystorejks-and-truststorejks-files) Adding the .JKS files to Pega Platform [https://docs.pega.com/security/86/uploading-keystore-and-truststore-files](https://docs.pega.com/security/86/uploading-keystore-and-truststore-files) Creating Key Store Files [https://community.pega.com/sites/default/files/help\_v83/procomhelpmain.htm#data-/data-admin-/data-admin-security-/data-admin-](https://community.pega.com/sites/default/files/help_v83/procomhelpmain.htm#data-/data-admin-/data-admin-security-/data-admin-)security-keystore/main.htm#\_\_\_\_\_\_\_\_\_\_\_\_\_Keystores Uploading the Key Store and Trust Store files [Uploading the keystore and truststore files | Pega](https://docs.pega.com/security/86/uploading-keystore-and-truststore-files) But from the latest error you have posted, I can see that Java JDK version mismatch is there. I assume, you’ll need to contact your middleware Team for that, even if the issue occured again upon upoloading the both Key store and Trust Store JKS files. **Note: At one point, generating the Key store and Trust store files will prompt you to trust them to your organization layer from Middleware Area. You’ll need to upload both .JKS files inside the application when you login too. Issue will be fixed then.** ![Key-store.png](https://pega1.discourse-cdn.com/pega/original/2X/7/7cacf57a0029557f6ae7c897936eea8d36a5cdfa.png)