Since this was a bit of a pain for me, I figured I’d post a quick how-to. I couldn’t find any one page with info, so this pseudocody howto is gathered from a few places.

The only easy way seems to be using a java tool called not-yet-commons-ssl which will do this for you. So download their latest jar and use it (update as necessary for your version of not-yet-commons):

java -cp not-yet-commons-ssl-0.3.11.jar org.apache.commons.ssl.KeyStoreBuilder your-new-keystore-password-here yourdomain.tld.key yourdomain.tld.crt

This will leave you with a yourdomain.tld.jks file, which you can then go ahead and sign your applet with:

jarsigner -keystore yourdomain.tld.jks -keypass your-new-keystore-password-here applet.to.sign.jar yourdomain.tld