keytool(1) Security Tools keytool(1) (NAME) keytool - () X.509 . (SYNOPSIS) keytool [commands] commands (Commands) . : o o -gencert o -genkeypair o -genseckey o -importcert o -importpassword o o -importkeystore o o -certreq o o -exportcert o o -list o -printcert o -printcertreq o -printcrl o o -storepasswd o -keypasswd o -delete o -changealias o o -help keytool . / ( ) . keytool ( ) (cache) . (certificate) ( ) ( ) . ( Certificate .) . . keytool (secret keys) (DES) . keytool keystore . KeyStore aliases . (COMMAND AND OPTION NOTES) Commands . o (-) . o . o (italic) . o . Option Defaults . -v -rfc -J . . o . -keypass keytool keystore / . keytool / . o ( ) . -printcert : keytool -printcert {-file cert_file} {-v} -printcert cert_file : keytool -printcert -file VScert.cer o (space) . o -help . keytool keytool -help . (OPTION DEFAULTS) . -alias "mykey" -keyalg "DSA" ( -genkeypair) "DES" ( -genseckey) -keysize 2048 ( -genkeypair -keyalg "RSA" ) 1024 ( -genkeypair -keyalg "DSA" ) 256 ( -genkeypair -keyalg "EC" ) 56 ( -genseckey -keyalg "DES" ) 168 ( -genseckey -keyalg "DESede" ) -validity 90 -keystore < .keystore > -storetype < "keystore.type" getDefaultType java.security.KeyStore > -file stdin ( ) stdout ( ) -protected false / ( -sigalg) : o DSA -sigalg SHA1withDSA . o RSA -sigalg SHA256withRSA . o EC -sigalg SHA256withECDSA . -keyalg -sigalg Java Cryptography Architecture (JCA) http://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html#AppA ..SH " (COMMON OPTIONS)" -v -help . -v (verbose) . -Jjavaoption . -Jjavaoption javaoption Java . . . java -h java -X . keystore : -storetype storetype keystore . -keystore keystore keystore. storetype JKS keystore keytool keystore . keytool -genkeypair -keystore keystore .keystore . -keystore ks_file ks_file . storetype JKS KeyStore Implementation KeyStore . -keystore KeyStore.load . NONE URL (null stream) KeyStore.load . keystore NONE . -storepass[:env| :file] argument keystore . env file value . : o env: argument. o file: argument. : -keypass -srckeypass -destkeypass -srcstorepass -deststorepass env file . (:) . keystore . -storepass . keystore . . -providerName provider_name . -providerClass provider_class_name . -providerArg provider_arg -providerClass provider_class_name . -protected true false. true PIN . -importkeystore keystore -srcprotected -destprotected keystore . -ext {name{:critical} {=value}} X.509 . -genkeypair -gencert -certreq . . name ( ) OID . value . value . :critical isCritical true false . :critical :c . (NAMED EXTENSIONS) keytool . ( ). BC BasicContraints : : ca:{true|false}[,pathlen:] ca:true,pathlen: . ca:true . KU KeyUsage : usage(,usage)* usage digitalSignature nonRepudiation (contentCommitment) keyEncipherment dataEncipherment keyAgreement keyCertSign cRLSign encipherOnly decipherOnly . usage ( dig digitalSignature) ( dS digitalSignature cRLS cRLSign) . usage . EKU ExtendedKeyUsage : usage(,usage)* usage anyExtendedKeyUsage serverAuth clientAuth codeSigning emailProtection timeStamping OCSPSigning OID string . usage . usage . SAN SubjectAlternativeName : type:value(,type:value)* type EMAIL URI DNS IP OID . value type . IAN IssuerAlternativeName : SubjectAlternativeName. SIA SubjectInfoAccess : method:location-type:location-value (,method:location-type:location-value)* method timeStamping caRepository OID . location-type location- value type:value SubjectAlternativeName . AIA AuthorityInfoAccess : SubjectInfoAccess. method ocsp caIssuers OID . name OID (hexadecimal dump) DER extnValue OCTET STRING . (0-9 a-f A-F) HEX . 01:02:03:04 01020304 . . honored -gencert . all ( ) name{:[critical|non-critical]} ( isCritical ) -name ( all ) . . -ext honored -ext OID . ( OID) honored (criticality) . subjectKeyIdentifier . authorityKeyIdentifier . : ( ) . Certificate Conformance Warning . (COMMANDS) -gencert {-rfc} {-infile infile} {-outfile outfile} {-alias alias} {-sigalg sigalg} {-dname dname} {-startdate startdate {-ext ext}* {-validity valDays} [-keypass keypass] {-keystore keystore} [-storepass storepass] {-storetype storetype} {-providername provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} ( keytool -certreq ) . infile ( ) alias X.509 outfile ( ). -rfc PEM Base64 DER . sigalg . startdate . valDays . dname (subject) . . ext X.509 . -ext . -gencert . e1 . ca ca1 ca2 e1 : keytool -alias ca -dname CN=CA -genkeypair keytool -alias ca1 -dname CN=CA -genkeypair keytool -alias ca2 -dname CN=CA -genkeypair keytool -alias e1 -dname CN=E1 -genkeypair ca ca1 ca1 ca2 : keytool -alias ca1 -certreq | keytool -alias ca -gencert -ext san=dns:ca1 | keytool -alias ca1 -importcert keytool -alias ca2 -certreq | $KT -alias ca1 -gencert -ext san=dns:ca2 | $KT -alias ca2 -importcert e1 e1.cert ca2 . e1 ca ca1 ca2 : keytool -alias e1 -certreq | keytool -alias ca2 -gencert > e1.cert -genkeypair {-alias alias} {-keyalg keyalg} {-keysize keysize} {-sigalg sigalg} [-dname dname] [-keypass keypass] {-startdate value} {-ext ext}* {-validity valDays} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} ( ) . X.509 v3 . keystore alias . keyalg keysize . sigalg . keyalg . dname X.500 alias (issuer) (subject) . . keypass . . Return keystore . keypass . startdate <> Validity X.509 . : ([+-]nnn[ymdHMS])+ [yyyy/mm/dd] [HH:MM:SS] . . (+) (-) . nnn ( y m d H M S ). java.util.GregorianCalendar.add(int field, int amount) . : Calendar c = new GregorianCalendar(); c.add(Calendar.YEAR, -1); c.add(Calendar.MONTH, 1); c.add(Calendar.DATE, -1); return c.getTime() : // :: ( ). ( ) . ( 0 ). ( ) . . . . valDays ( -startdate -startdate ) . -genkey . . -genkeypair ..TP -genseckey {-alias alias} {-keyalg keyalg} {-keysize keysize} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} KeyStore.SecretKeyEntry alias . keyalg keysize . keypass . . Return keystore . keypass . -importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} {-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} ( PKCS#7 X.509 ) cert_file keystore alias . stdin . keytool X.509 v1 v2 v3 PKCS#7 . ( Base64 ) RFC 1421 . -----BEGIN -----END . : (CA) (CSR) CA ( -certreq Commands ). -alias . keytool . keystore . keytool . keytool . -importpassword {-alias alias} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} KeyStore.SecretKeyEntry alias . . keypass . . Return keystore . keypass . -importkeystore {-srcstoretype srcstoretype} {-deststoretype deststoretype} [-srcstorepass srcstorepass] [-deststorepass deststorepass] {-srcprotected} {-destprotected} {-srcalias srcalias {-destalias destalias} [-srckeypass srckeypass]} [-destkeypass destkeypass] {-noprompt} {-srcProviderName src_provider_name} {-destProviderName dest_provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} keystore keystore . -srcalias keystore . destalias srcalias . srckeypass . srckeypass keytool srcstorepass . srcstorepass . destkeypass . destkeypass . storepass keypass keystore PKCS #12 . keystore PKCS #12 -destkeypass -deststorepass . -srcalias keystore keystore . . srcstorepass . srcstorepass . keystore keystore keystore . . keystore . -noprompt . . . -printcertreq {-file file} PKCS #10 keytool-certreq . . . -certreq {-alias alias} {-dname dname} {-sigalg sigalg} {-file certreq_file} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} (CSR) PKCS #10 . CSR (CA) . ( ) ( ) keystore . alias PKCS #10 . . keypass keystore . dname (subject) CSR (Distinguished Name) X.500 . sigalg CSR . CSR certreq_file . CSR stdout . CA importcert . -exportcert {-alias alias} {-file cert_file} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-rfc} {-v} {-protected} {-Jjavaoption} alias keystore cert_file . stdout . . -rfc RFC 1421 . alias . alias . . alias . -export . . -exportcert ..TP -list {-alias alias} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v | -rfc} {-protected} {-Jjavaoption} keystore alias stdout . alias keystore . SHA1 . -v . -rfc RFC 1421 . -v -rfc . -printcert {-file cert_file | -sslserver host[:port]} {-jarfile JAR_file {-rfc} {-v} {-Jjavaoption} cert_file SSL host:port JAR JAR_file ( -jarfile) . HTTPS 443 . -sslserver -file . stdin . -rfc keytool PEM RFC 1421 . RFC 1421 . stdin RFC 1421 . SSL -J-Dhttps.proxyHost=proxyhost -J-Dhttps.proxyPort=proxyport . Java Secure Socket Extension (JSSE) http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html : keystore . -printcrl -file crl_ {-v} (CRL) crl_ . CRL (CA) . crl_ . : keystore . -storepasswd [-new new_storepass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption} keystore . new_storepass . -keypasswd {-alias alias} [-keypass old_keypass] [-new new_keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption} / alias old_keypass new_keypass . -keypass keystore . -new . -delete [-alias alias] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} alias keystore . . -changealias {-alias alias} [-destalias destalias] [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} keystore alias destalias . . -keypass . storepass ( ) . . -help . command_name : keytool -command_name -help..SH " (EXAMPLES)" keystore / . (GENERATE THE KEY PAIR) keystore . : keytool -genkeypair -dname "cn=Mark Jones, ou=Java, o=Oracle, c=US" -alias business -keypass -keystore /working/mykeystore -storepass -validity 180 keystore mykeystore ( ) . / (distinguished name) (common name) Mark Jones Java Oracle US . DSA . SHA1withDSA . keystore business . . . . . : keytool -genkeypair keystore mykey . keystore .keystore . keystore . keystore . -genkeypair -genkeypair ( cn=Mark Jones ou=Java o=Oracle c=US). (REQUEST A SIGNED CERTIFICATE FROM A CA) . (CA) . CA (CSR) : keytool -certreq -file MarkJ.csr CSR mykey MarkJ.csr . CA VeriSign . ( ) . CA . (IMPORT A CERTIFICATE FOR THE CA) CA . CA keystore keystore cacerts . -importcert Commands . o CA CA . o CA ( ) . CA . keystore cacerts CA VeriSign VeriSign keystore . CA CA cacerts CA . CA CA CA . ABC, Inc. CA ABCCA.cer ABC CA . . keytool -printcert keytool -importcert -noprompt . . ( ) . . keystore : keytool -importcert -alias abc -file ABCCA.cer ABCCA.cer keystore abc . (IMPORT THE CERTIFICATE REPLY FROM THE CA) CA ( ) ( cacerts ) . CA ( CA ) keystore keystore cacerts ( CA ). VeriSign VSMarkJ.cer : keytool -importcert -trustcacerts -file VSMarkJ.cer (EXPORT A CERTIFICATE THAT AUTHENTICATES THE PUBLIC KEY) jarsigner (JAR) . keystore . . MJ.cer mykey : keytool -exportcert -alias mykey -file MJ.cer JAR jarsigner . (IMPORT KEYSTORE) importkeystore keystore keystore keystore keystore . keystore . keystore ( ) . keytool keystore . keytool . keystore JKS key.jks keystore PKCS #11 : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass -deststorepass importkeystore keystore keystore . . -srcalias / . : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass -deststorepass -srcalias myprivatekey -destalias myoldprivatekey -srckeypass -destkeypass -noprompt keytool : (root) (ca) SSL (server). keystore . RSA . keytool -genkeypair -keystore root.jks -alias root -ext bc:c keytool -genkeypair -keystore ca.jks -alias ca -ext bc:c keytool -genkeypair -keystore server.jks -alias server keytool -keystore root.jks -alias root -exportcert -rfc > root.pem keytool -storepass -keystore ca.jks -certreq -alias ca | keytool -storepass -keystore root.jks -gencert -alias root -ext BC=0 -rfc > ca.pem keytool -keystore ca.jks -importcert -alias ca -file ca.pem keytool -storepass -keystore server.jks -certreq -alias server | keytool -storepass -keystore ca.jks -gencert -alias ca -ext ku:c=dig,kE -rfc > server.pem cat root.pem ca.pem server.pem | keytool -keystore server.jks -importcert -alias server (TERMS) (Keystore) keystore . (Keystore entries) (keystores) . keytool : (Key entries): . (secret key) (private key) . << >> (Certificate Chains) . keytool jarsigner . (Trusted certificate entries): . keystore () . . (KeyStore aliases) keystore ( ) (alias) . -genseckey -genkeypair ( ) -importcert keystore . keytool . duke / . << >> (Certificate Chains) . keytool -genkeypair -alias duke -keypass dukekeypasswd dukekeypasswd duke . Duke : keytool -keypasswd -alias duke -keypass dukekeypasswd -new newpass dukekeypasswd newpass . . . (KeyStore implementation) KeyStore java.security keystore . (concrete) keystore . (keytool jarsigner) (GUI) Policy Tool keystore . KeyStore (public) . Oracle . keystore () keystore JKS . keystore ( ) . keystore (provider-based) . KeyStore << >> (SPI Service Provider Interface) . KeystoreSpi java.security . (provider) Java Security API . keystore KeystoreSpi << >> http://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/HowToImplAProvider.html . getInstance KeyStore keystore . keystore keystore / keystore keystore . keystore . keytool keystore . keystore FileInputStream keystore . jarsigner keystore URL . keytool jarsigner keystore -storetype . Policy Tool keystore Keystore . keystore keystore keystore.type . java.security java.home\lib\security Windows java.home/lib/security Oracle Solaris java.home jre SDK Java Runtime Environment (JRE). keystore.type keystore . keystore . KeyStore getDefaultType keystore.type . keystore keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); keystore jks keystore Oracle . : keystore.type=jks keystore keystore . keystore pkcs12 : keystore.type=pkcs12 : keystore . JKS jks . (Certificate) ( ) ( issuer) ( subject) . : (Public Keys): . . (Digitally Signed): . . (Identity): . UID Oracle Solaris X.509. (Signature): (issuer) . (Private Keys): ( ). ( ) . DSA . . (Entity): . . . . (CA) . () . CA . VeriSign Thawte Entrust . Microsoft Certificate Server Entrust CA . keytool (import) (export) . . keytool X.509 . X.509 (X.509 Certificates) X.509 ( ). ASN.1/DER . (Abstract Syntax Notation 1) . (Definite Encoding Rules) . X.509 : (Version): X.509 . . keytool v1 v2 v3 . v3 . X.509 . X.509 . . . X.509 () (extensions) . : KeyUsage ( signing-only ) AlternativeNames ( DNS IP). (critical) . KeyUsage keyCertSign SSL SSL. (Serial number): . . << >> (CRL) . (Signature algorithm identifier): CA . (Issuer name): << >> (Distinguished Name) X.500 . << X.500>> (X.500 Distinguished Names) . CA . . CA . (Validity period): . . . . (Subject name): . X.500 . << >> (DN) X.500 . << X.500>> (X.500 Distinguished Names) . : CN=Java Duke, OU=Java Software Division, O=Oracle Corporation, C=US (CN) (OU) (O) (C) . (Subject public key information): ..TP (Certificate Chains) keytool keystore . . (self-signed) . -genkeypair . ( issuer) (subject) . . -genkeypair / . (CSR) -certreq (CA) CA -importcert (import) . -certreq -importcert . () CA . CA . CA . CA . ( CA ) CA CA CSR . CA (root) . ( ) . CA ( CA ). keystore . ( PKCS #7) . keytool . CA ( root) . . (distinguished name) CA VeriSign . CA . CA . CA keystore -printcert (fingerprint) CA . cacerts cacerts java.home\lib\security Oracle Solaris java.home/lib/security java.home jre SDK JRE. cacerts keystore CA . jks keystore keytool . keystore cacerts CA . : keytool -list -keystore java.home/lib/security/cacerts keystore cacerts changeit . SDK . : cacerts . CA cacerts cacerts . cacerts CA . CA cacerts . CA cacerts delete keytool . cacerts JRE . . Internet RFC 1421 Internet RFC 1421 . Base64 . -importcert -printcert . -exportcert -rfc . -list SHA1 . -v . -rfc . : -----BEGIN CERTIFICATE----- encoded certificate goes here. -----END CERTIFICATE----- X.500 (Distinguished Names) X.500 subject issuer () X.509 . keytool : commonName: Susan Jones. organizationUnit: ( ). Purchasing. localityName: () Palo Alto. stateName: California. country: CH. -dname -genkeypair : CN=cName, OU=orgUnit, O=org, L=city, S=state, C=countryCode : CN=commonName OU=organizationUnit O=organizationName L=localityName S=stateName C=country : CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US : keytool -genkeypair -dname "CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US" -alias mark . CN cn Cn . . . : CN=Steve Meier, OU=Java, O=Oracle, C=US (\) (escape ) : cn=Peter Schuster, ou=Java\, Product Development, o=Oracle, c=US . . (\) ..SH " (WARNINGS)" (IMPORTING TRUSTED CERTIFICATES WARNING) : . Windows: -printcert -importcert -noprompt . . \tmp\cert . -printcert : keytool -printcert -file \tmp\cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Sep 25 18:01:13 PDT 1997 until: Wed Dec 24 17:01:13 PST 1997 Certificate Fingerprints: MD5: 11:81:AD:92:C8:E5:0E:A2:01:2E:D4:7A:D7:5F:07:6F SHA1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 Oracle Solaris: -printcert -importcert -noprompt . . /tmp/cert . -printcert : keytool -printcert -file /tmp/cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Sep 25 18:01:13 PDT 1997 until: Wed Dec 24 17:01:13 PST 1997 Certificate Fingerprints: MD5: 11:81:AD:92:C8:E5:0E:A2:01:2E:D4:7A:D7:5F:07:6F SHA1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 . . JAR . : -printcert . keystore -importcert . . -importcert -noprompt . -noprompt . (PASSWORDS WARNING) keystore (store password) . / (private/secret key password) . -storepass -keypass . . . (CERTIFICATE CONFORMANCE WARNING) RFC 5280 (profile) X.509 (extensions) . http://tools.ietf.org/rfc/rfc5280.txt keytool . JRE . -dname -ext . (NOTES) (IMPORT A NEW TRUSTED CERTIFICATE) keystore keytool ( CA ) keystore . -trustcacerts cacerts. keytool ( keystore cacerts) ( ) . . << >> . . -noprompt . (IMPORT A CERTIFICATE REPLY) (certificate reply) keystore -trustcacerts keystore cacerts . << cacerts>> . : o X.509 keytool ( CA ) . (aliases) . . keytool . o PKCS #7 X.509 CA . CA -trustcacerts keytool keystore keystore cacerts . CA -trustcacerts keytool keystore keystore cacerts . -noprompt . alias . keypass . keystore . -import . . -importcert . (SEE ALSO) o jar(1) o jarsigner(1) o : Java SE http://docs.oracle.com/javase/tutorial/security/index.html JDK 8 03 March 2015 keytool(1)