To extract a ‘.crt’ file from a Java keystore, it seems that I have to do the following:

1. List the certs in the keystore

keytool -list -v -keystore <keystore.jks>

Note the alias of the relevant crt you want to export

2. Extract the crt from the keystore

keytool -export -alias <alias> -keystore <keystore.jks> -file temp.crt

3. Transform the binary (?) crt into a pem file

openssl x509 -inform DER -in temp.crt -out outcert.pem -text

4. Inside the outcert.pem, at the bottom, there is the private key of the crt file. It starts with the ‘—BEGIN’ section. Save the content into another file. That file is your final crt file