Convert PEM to JKS

First convert to PKCS12:

openssl pkcs12 -export -in ${{ CERT_PEM }} -inkey ${{ KEY_PEM }} -out ${{ PKCS12_FILE }} -name "${{ CERT_NAME }}"

Import PKCS12 to JKS:

keytool -importkeystore -srckeystore ${{ PKCS12_FILE }} -srcstoretype pkcs12 -destkeystore ${{ JKS_FILE }} -deststoretype JKS

keytool will warn that JKS uses a proprietary format and suggest migrating to PKCS12 — that warning is expected, and the keystore is still written. PKCS12 has been the default keystore type since JDK 9, so only convert to JKS when something downstream actually demands it; otherwise stop at the .p12 and point your application at that.