Keytool Operations

From NovaOrdis Knowledge Base
Jump to navigation Jump to search

External

Internal

Generate a Public/Private Key Pair

A key pair can be generated and placed in the keystore with the following command. The private key thus generated can be used in the procedure to generate digitally signed certificates.

keytool \
   -genkeypair \
   -alias jce-provider-signing-key \
   -keyalg RSA \
   -keysize 2048 \
   -dname "cn=Nova Ordis LLC, ou=Java Software Code Signing, o=Sun Microsystems Inc" \
   -keystore ./test-keystore.jks \
   -storepass n7ejfh2jef234rBe

For more general considerations on private keys, see:

Private Keys

Generate a Certificate Signing Request

A certificate signing request can be generated with the following command. This step is part of the procedure to generate digitally signed certificates.

keytool \
   -certreq \
   -alias jce-provider-signing-key \
   -file novaordis-jce-provider2.csr \
   -keystore ./jce-provider-signing-keystore.jks \
   -storepass somepass

Inspect a Certificate

The certificate data can be displayed with:

keytool -printcert -v -file ./test-cert.pem

It accepts certificates in PEM format.

Inspect a Keystore

keytool -list -v -keystore ./test-keystore.jks

Import into a Keystore

Import a Private Key into a Keystore

Import a Certificate into a Keystore

Delete from a Keystore

Delete a Private Key from a Keystore

Delete a Certificate from a Keystore

Key Format Conversions

Native to PKCS#12

Keys in PKCS#12 format can be generated with:

keytool \
   -importkeystore \
   -srckeystore saml.keystore \
   -destkeystore ./test-pvtkey.p12 \
   -deststoretype PKCS12 \
   -srcstorepass somepass \
   -deststorepass someotherpass \
   -srckeypass yetanotherpass \
   -destkeypass someotherpass2 \
   -srcalias myhostname