KEYTOOL(1) JDK Commands KEYTOOL(1) (NAME) keytool - (SYNOPSIS) keytool [commands] commands keytool : o -certreq: o -changealias: o -delete: o -exportcert: o -genkeypair: o -genseckey: o -gencert: o -importcert: o -importpass: o -importkeystore: keystore o -keypasswd: o -list: keystore o -printcert: o -printcertreq: o -printcrl: (CRL) o -storepasswd: keystore o -showinfo: Commands and Options . (DESCRIPTION) keytool . / ( ) . keytool ( ) (cache) . ( ) ( ) . . . keytool ( - Data Encryption Standard) . . keytool keystore . keytool jdk.certpath.disabledAlgorithms jdk.security.legacyAlgorithms . (legacy) . jdk.certpath.disabledAlgorithms jdk.security.legacyAlgorithms java.security ( $JAVA_HOME/conf/security JDK) ..SH " (COMMAND AND OPTION NOTES)" (Commands and Options) : o (-) . o . o . o . . . -ext X.509v3 . o () ({ }) ([ ]) . o . -v -rfc -J . . o . -keypass keytool keystore / . keytool / . o ( ) . -printcert : keytool -printcert {-file cert_file} {-v} -printcert cert_file : keytool -printcert -file VScert.cer o (space) . (COMMANDS AND OPTIONS) keytool . Keystore: o -gencert o -genkeypair o -genseckey o -importcert o -importpass Keystore : o -importkeystore : o -certreq : o -exportcert : o -list o -printcert o -printcertreq o -printcrl Keystore: o -storepasswd o -keypasswd o -delete o -changealias : o -showinfo.SH " (COMMANDS FOR CREATING OR ADDING DATA TO THE KEYSTORE)" -gencert -gencert : o {-rfc}: RFC ( ) o {-infile infile}: o {-outfile outfile}: o {-alias alias}: o {-sigalg sigalg}: o {-dname dname}: (Distinguished name) o {-startdate startdate}: o {-ext ext}*: X.509 o {-validity days}: o [-keypass arg]: o {-keystore keystore}: (keystore) o [-storepass arg]: o {-storetype type}: o {-providername name}: (Provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . . keytool -addprovider SunPKCS11 -providerarg some.cfg ... : SunPKCS11 -providerclass sun.security.pkcs11.SunPKCS11 . JDK -providerclass . classpath reflection -providerclass . o {-providerclass class [-providerarg arg]}: . MyProvider reflection keytool -providerclass com.example.MyProvider ... o {-providerpath list}: (classpath) o {-v}: o {-protected}: -gencert ( keytool -certreq ) . infile (alias) X.509 outfile . -rfc Base64 PEM DER . -sigalg . startdate . days . dname (subject) . . -ext X.509 . -ext Common Command Options . -gencert . e1 . ca ca1 ca2 e1 : keytool -alias ca -dname CN=CA -genkeypair -keyalg rsa keytool -alias ca1 -dname CN=CA -genkeypair -keyalg rsa keytool -alias ca2 -dname CN=CA -genkeypair -keyalg rsa keytool -alias e1 -dname CN=E1 -genkeypair -keyalg rsa ca ca1 ca1 ca2 - (self-issued) : keytool -alias ca1 -certreq | keytool -alias ca -gencert -ext san=dns:ca1 | keytool -alias ca1 -importcert keytool -alias ca2 -certreq | keytool -alias ca1 -gencert -ext san=dns:ca2 | keytool -alias ca2 -importcert e1 e1.cert ca2 . e1 ca ca1 ca2 : keytool -alias e1 -certreq | keytool -alias ca2 -gencert > e1.cert -genkeypair -genkeypair : o {-alias alias}: o -keyalg alg: o {-keysize size}: o {-groupname name}: . (Elliptic Curve). o {-sigalg alg}: o {-signer alias}: o [-signerkeypass arg]: o [-dname name]: (Distinguished name) o {-startdate date}: o {-ext value}*: X.509 o {-validity days}: o [-keypass arg]: o {-keystore keystore}: o [-storepass arg]: .IP o 2 {-storetype type}: (keystore) o {-providername name}: (provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg] }: (fully qualified class name) . o {-providerpath list}: (classpath) o {-v}: ( ) o {-protected}: -genkeypair ( ) . -signer X.509 v3 . -signer ( ). . -keyalg -keysize . -sigalg . -keyalg . -groupname ( ) . -groupname -keysize . -signer PrivateKeyEntry . . ( -keyalg XDH X25519 X448 DH ) . -signerkeypass . . -dname X.500 (Distinguished Name) -alias . -signer (issuer) (subject) . -signer . . -keypass . . Return . -keypass . -startdate <> Validity () X.509 . : ([+-]nnn[ymdHMS])+ [yyyy/mm/dd] [HH:MM:SS] . . (+) (-) . nnn ( y m d H M S ). java.util.GregorianCalendar.add(int field, int amount) . : Calendar c = new GregorianCalendar(); c.add(Calendar.YEAR, -1); c.add(Calendar.MONTH, 1); c.add(Calendar.DATE, -1); return c.getTime() : // :: ( ). ( ) . ( 0 ). ( ) . - . . . date ( -startdate -startdate ) . -genseckey -genseckey : o {-alias alias}: o [-keypass arg]: o -keyalg alg: o {-keysize size}: o {-keystore keystore}: o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: ( ) o {-protected}: -genseckey (secret key) KeyStore.SecretKeyEntry alias . -keyalg -keysize . -keypass . . Return -keystore . -keypass . -importcert -importcert : o {-noprompt}: o {-trustcacerts}: cacerts o {-protected}: o {-alias alias}: (alias) o {-file file}: o [-keypass arg]: o {-keystore keystore}: keystore o {-cacerts}: keystore cacerts o [-storepass arg]: keystore o {-storetype type}: keystore o {-providername name}: (provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: -importcert ( PKCS#7 X.509 ) -file file keystore -alias . -file file stdin . keytool X.509 PKCS#7 . ( Base64 ) RFC 1421 . -----BEGIN -----END . : (CA) (CSR) CA . -certreq Commands for Generating a Certificate Request . -alias . alias keytool . keystore . alias keytool alias . -alias keytool . -importpass -importpass : o {-alias alias}: (alias) o [-keypass arg]: o {-keyalg alg}: o {-keysize size}: o {-keystore keystore}: keystore o [-storepass arg]: keystore o {-storetype type}: keystore o {-providername name}: (provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: o {-protected}: -importpass (passphrase) KeyStore.SecretKeyEntry -alias . . -keypass . . Return keystore . -keypass . -importkeystore -importkeystore : o -srckeystore keystore: keystore o {-destkeystore keystore}: keystore o {-srcstoretype type}: keystore o {-deststoretype type}: keystore o [-srcstorepass arg]: keystore o [-deststorepass arg]: keystore o {-srcprotected}: keystore o {-destprotected}: keystore o {-srcprovidername name}: keystore o {-destprovidername name}: keystore o {-srcalias alias}: (alias) o {-destalias alias}: (alias) o [-srckeypass arg]: o [-destkeypass arg]: o {-noprompt}: (prompt) o {-addprovider name [-providerarg arg]: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: (fully qualified class name) o {-providerpath list}: (classpath) o {-v}: (verbose) : : -srckeystore keystore -destkeystore keystore -importkeystore keystore keystore . : keytool -importkeystore -destkeystore keystore $HOME/.keystore . -srcalias keystore . -destalias -srcalias . -srckeypass . -srckeypass keytool -srcstorepass . -srcstorepass . -destkeypass . -destkeypass . storepass keypass keystore PKCS #12 . keystore PKCS#12 -destkeypass -deststorepass . -srcalias keystore keystore . . -srcstorepass . -srcstorepass . keystore keystore keystore . . keystore . -noprompt . . . -certreq -certreq : o {-alias alias}: o {-sigalg alg}: o {-file file}: o [ -keypass arg]: o {-keystore keystore}: keystore o {-dname name}: (Distinguished name) o {-ext value}: X.509 o [-storepass arg]: keystore o {-storetype type}: keystore o {-providername name}: (provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: (verbose) o {-protected}: -certreq (CSR) PKCS #10 . CSR (CA) . CA ( ) ( ) keystore . alias PKCS #10 . . -keypass keystore . -dname (subject) CSR . X.500 . -sigalg CSR . CSR -file file . CSR -stdout . -importcert CA . (COMMANDS FOR EXPORTING DATA) -exportcert -exportcert : o {-rfc}: RFC o {-alias alias}: o {-file file}: o {-keystore keystore}: keystore o {-cacerts}: keystore cacerts o [-storepass arg]: keystore o {-storetype type}: keystore o {-providername name}: (provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg] }: . o {-providerpath list}: (classpath) o {-v}: (verbose) o {-protected}: -exportcert -alias alias keystore -file file . stdout . . -rfc RFC 1421 . -alias . -alias . . -alias . -list -list : o {-rfc}: RFC o {-alias alias}: o {-keystore keystore}: (keystore) o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: (provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg] }: (fully qualified class name) . o {-providerpath list}: (classpath) o {-v}: (verbose) o {-protected}: -list -alias stdout . -alias alias . SHA-256 . -v . -rfc Internet RFC 1421 . : -v -rfc . . -printcert -printcert : o {-rfc}: RFC o {-file cert_file}: o {-sslserver server[:port]}:: (SSL) o {-jarfile JAR_file}: .jar o {-keystore keystore}: o {-trustcacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-protected}: o {-v}: -printcert -file cert_file SSL -sslserver server[:port] JAR -jarfile JAR_file . . HTTPS 443 . : -sslserver -file . . stdin . -rfc keytool PEM Internet RFC 1421 . stdin RFC 1421 . SSL () -J-Dhttps.proxyHost=proxyhost -J-Dhttps.proxyPort=proxyport . : . ( -keystore) cacerts ( -trustcacerts) . -printcertreq -printcertreq : o {-file file}: o {-v}: -printcertreq PKCS #10 keytool -certreq . . . -printcrl -printcrl : o {-file crl}: o {-keystore keystore}: o {-trustcacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-protected}: o {-v}: -printcrl (CRL) -file crl . CRL (CA) . CA crl ..PP : . CRL ( -keystore) cacerts ( -trustcacerts) . (COMMANDS FOR MANAGING THE KEYSTORE) -storepasswd -storepasswd : o [-new arg]: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: ( ) -storepasswd . -new arg . -keypasswd -keypasswd : o {-alias alias}: (alias) o [-keypass old_keypass]: o [-new new_keypass]: o {-keystore keystore}: o {-storepass arg}: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: ( ) -keypasswd / -alias -keypass old_keypass -new new_keypass . . -keypass -keypass (-storepass arg) . -new . -delete -delete : o [-alias alias]: (alias) o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: ( ) o {-protected}: -delete -alias alias . alias . -changealias -changealias : o {-alias alias}: (alias) o [-destalias alias]: o [-keypass arg]: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: (classpath) o {-v}: ( ) o {-protected}: -changealias -alias alias -destalias alias . . -keypass . -storepass ( ) . . -showinfo -showinfo : o {-tls}: TLS o {-v}: () -showinfo . -tls TLS (cipher suites) . (COMMANDS FOR DISPLAYING HELP INFORMATION) --help keytool keytool . o keytool : keytool --help o keytool : keytool - --help (COMMON COMMAND OPTIONS) -v --help . -v (verbose) . -Joption . -Joption option Java . . . java -h java -X . keystore : -storetype storetype keystore . -keystore keystore keystore. storetype JKS keystore keytool keystore . keytool -genkeypair -keystore keystore .keystore . -keystore ks_file ks_file . storetype JKS KeyStore Implementation KeyStore aliases . -keystore KeyStore.load . NONE URL null KeyStore.load . keystore NONE keystore . -cacerts cacerts keystore cacerts . -keystore path_to_cacerts -storetype type_of_cacerts . -keystore -storetype -cacerts . -storepass [:env | :file ] argument keystore . env file argument . : o env: argument. o file: argument. : -keypass -srckeypass -destkeypass -srcstorepass -deststorepass env file . (:) . keystore . -storepass . keystore . . -providername name . -addprovider name ( SunPKCS11) . -providerclass class . -providerpath list (classpath) . -providerarg arg -addprovider -providerclass class . -protected=true|false ( ) true . -importkeystore keystore -srcprotected -destprotected keystore . -ext {name{:critical} {=value}} (certificate extension) X.509 . -genkeypair -gencert -certreq . . name ( Supported Named Extensions ) OID . value . value . :critical isCritical true false . :critical :c . -conf file . (PRE-CONFIGURED OPTIONS FILE) properties -conf . (property) <> () keytool . <> () . ${prop} (system property) . (" ') . . keytool <> ( ) keytool ( ) . <> (override) . keytool . preconfig : # A tiny pre-configured options file keytool.all = -keystore ${user.home}/ks keytool.list = -v keytool.genkeypair = -keyalg rsa keytool -conf preconfig -list : keytool -keystore ~/ks -v -list keytool -conf preconfig -genkeypair -alias me : keytool -keystore ~/ks -keyalg rsa -genkeypair -alias me keytool -conf preconfig -genkeypair -alias you -keyalg ec : keytool -keystore ~/ks -keyalg rsa -genkeypair -alias you -keyalg ec : keytool -keystore ~/ks -genkeypair -alias you -keyalg ec -keyalg ec . (EXAMPLES OF OPTION VALUES) : -alias "mykey" -keysize 2048 (when using -genkeypair and -keyalg is "RSA", "DSA", "RSASSA-PSS", or "DH") 256 (when using -genkeypair and -keyalg is "EC") 255 (when using -genkeypair and -keyalg is "EdDSA", or "XDH) 56 (when using -genseckey and -keyalg is "DES") 168 (when using -genseckey and -keyalg is "DESede") -validity 90 -keystore -destkeystore -storetype -file stdin (if reading) stdout (if writing) -protected false ( -sigalg) : keyalg keysize default sigalg -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- DSA any size SHA256withDSA RSA <= 3072 SHA256withRSA <= 7680 SHA384withRSA > 7680 SHA512withRSA EC < 384 SHA256withECDSA < 512 SHA384withECDSA = 512 SHA512withECDSA RSASSA-PSS <= 3072 RSASSA-PSS (with SHA-256) <= 7680 RSASSA-PSS (with SHA-384) > 7680 RSASSA-PSS (with SHA-512) EdDSA 255 Ed25519 448 Ed448 Ed25519 255 Ed25519 Ed448 448 Ed448 o 2 RSASSA-PSS MessageDigest (hash) MGF1 . o 2 EdDSA : Ed25519 Ed448. EdDSA -keyalg EdDSA -keysize 255 -keysize 448 Ed25519 Ed448 . -keysize Ed25519 . -keyalg Ed25519 -keyalg Ed448 . : JDK . JDK . -keysize -sigalg . " (SUPPORTED NAMED EXTENSIONS)" keytool . . BC BasicContraints : ca:{true|false}[,pathlen:len] len ca:true,pathlen:len . len ca:true . KU KeyUsage : usage(, usage)* usage : o 2 digitalSignature o 2 nonRepudiation (contentCommitment) o 2 keyEncipherment o 2 dataEncipherment o 2 keyAgreement o 2 keyCertSign o 2 cRLSign o 2 encipherOnly o 2 decipherOnly usage ( dig digitalSignature) (camel-case) ( dS digitalSignature cRLS cRLSign) . usage . EKU ExtendedKeyUsage : usage(, usage)* usage : o 2 anyExtendedKeyUsage o 2 serverAuth o 2 clientAuth o 2 codeSigning o 2 emailProtection o 2 timeStamping o 2 OCSPSigning o 2 OID usage . usage . SAN SubjectAlternativeName : type:value(, type:value)* type : o 2 EMAIL o 2 URI o 2 DNS o 2 IP o 2 OID value type . IAN IssuerAlternativeName : SAN SubjectAlternativeName. SIA SubjectInfoAccess : method:location-type:location-value(, method:location-type:location-value)* method : o 2 timeStamping o 2 caRepository o 2 OID location-type location-value type:value SubjectAlternativeName . AIA AuthorityInfoAccess : SIA SubjectInfoAccess. method : o 2 ocsp o 2 caIssuers o 2 OID name OID (hex dump) (DER) extnValue OCTET STRING . (0-9 a-f A-F) HEX . 01:02:03:04 01020304 . . honored -gencert . all ( ) name{:[critical|non-critical]} ( isCritical ) -name ( all ) . ..PP -ext honored -ext OID . ( OID) (criticality) . OID . subjectKeyIdentifier . authorityKeyIdentifier . : ( ) . Certificate Conformance Warning . " (EXAMPLES OF TASKS IN CREATING A KEYSTORE)" keystore / . o 2 o 2 CA o 2 CA o 2 CA o 2 o 2 Keystore o 2 SSL " (GENERATING THE KEY PAIR)" keystore . : keytool -genkeypair -dname "cn=myname, ou=mygroup, o=mycompany, c=mycountry" -alias business -keyalg rsa -keypass password -keystore /working/mykeystore -storepass password -validity 180 (keystore) mykeystore ( ) -keypass . / (distinguished name) myname mygroup mycompany mycountry . RSA . SHA256withRSA . keystore -alias business . -keypass . . -keyalg . . : keytool -genkeypair -keyalg rsa keystore mykey . keystore .keystore . .keystore . keystore . : -genkeypair . cn=myname, ou=mygroup, o=mycompany, c=mycountry)..SH " CA (REQUESTING A SIGNED CERTIFICATE FROM A CA)" : (self-signed) CA . CA : "1." 3 CSR: 4 keytool -certreq -file myname.csr CSR (alias) mykey myname.csr . "2." 3 myname.csr CA DigiCert. CA ( ) . CA . " CA (IMPORTING A CERTIFICATE FOR THE CA)" CA : "1." 3 CA keystore keystore cacerts . -importcert Commands . 4 o 2 : CA CA . o 2 CA ( ) . CA. cacerts CA (the Oracle Java Root Certificate program) [http://www.oracle.com/technetwork/java/javase/javasecarootcertsprogram-1876540.html] . CA CA cacerts CA (import) . CA CA . CA CA . X.cer CA CA . : "1." 3 keytool -printcert keytool -importcert -noprompt. . "2." 3 . ( ) . . "2." 3 CA . 4 keystore : keytool -importcert -alias alias -file *X*.cer` CA keystore alias . (CA) ( cacerts ) . : o 2 CA CA . o 2 CA . keystore keystore cacerts . DigiCert : : DCmyname.cer . keytool -importcert -trustcacerts -file DCmyname.cer : jarsigner Java Archive (JAR) . keystore . . : "1." 3 myname.cer : 4 : mykey . keytool -exportcert -alias mykey -file myname.cer "2." 3 JAR jarsigner . KEYSTORE importkeystore keystore keystore . keystore keystore . keystore . keystore ( ) . keytool keystore . keytool . keystore JKS key.jks keystore PKCS #11 : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass password -deststorepass password importkeystore keystore keystore . . -srcalias : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass password -deststorepass password -srcalias myprivatekey -destalias myoldprivatekey -srckeypass password -destkeypass password -noprompt keytool : o 2 (root) o 2 (ca) o 2 SSL (server) keystore . keytool -genkeypair -keystore root.jks -alias root -ext bc:c -keyalg rsa keytool -genkeypair -keystore ca.jks -alias ca -ext bc:c -keyalg rsa keytool -genkeypair -keystore server.jks -alias server -keyalg rsa keytool -keystore root.jks -alias root -exportcert -rfc > root.pem keytool -storepass password -keystore ca.jks -certreq -alias ca | keytool -storepass password -keystore root.jks -gencert -alias root -ext BC=0 -rfc > ca.pem keytool -keystore ca.jks -importcert -alias ca -file ca.pem keytool -storepass password -keystore server.jks -certreq -alias server | keytool -storepass password -keystore ca.jks -gencert -alias ca -ext ku:c=dig,kE -rfc > server.pem cat root.pem ca.pem server.pem | keytool -keystore server.jks -importcert -alias server " (TERMS)" " (Keystore)" (keystore) . " (Keystore entries)" . keytool : (Key entries): . (secret key) (private key) . Certificate Chains . keytool jarsigner . (Trusted certificate entries): . keystore (subject/) . . " (Keystore aliases)" keystore ( ) (alias) . -genseckey -genkeypair ( ) -importcert keystore . keytool . duke / (self-signed) . Certificate Chains . keytool -genkeypair -alias duke -keyalg rsa -keypass passwd passwd duke . Duke : keytool -keypasswd -alias duke -keypass passwd -new newpasswd passwd newpasswd . . . " (Keystore implementation)" KeyStore java.security keystore . (concrete) keystore . (keytool jarsigner) keystore . KeyStore (public) . JDK 9 keystore PKCS12 . keystore RSA PKCS12 Personal Information Exchange Syntax Standard . . Oracle . keystore JKS . keystore ( ) . keystore (provider) . KeyStore Service Provider Interface ( SPI) . KeystoreSpi java.security . provider Java Security API . keystore KeystoreSpi <> . keystore getInstance KeyStore . keystore keystore / keystore keystore . keystore . keytool keystore . keystore FileInputStream keystore . jarsigner keystore URL . keytool jarsigner keystore -storetype . keystore keystore keystore.type . java.security : o 2 OS X: java.home/lib/security o 2 : java.home\lib\security keystore.type keystore . keystore . KeyStore getDefaultType keystore.type . keystore keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); keystore pkcs12 keystore RSA PKCS12 Personal Information Exchange Syntax . : keystore.type=pkcs12 keystore keystore . keystore jks Oracle : keystore.type=jks : keystore . JKS jks . (Certificate) ( ) ( issuer) ( subject) . : o 2 (Public Keys): . . o 2 (Digitally Signed): . . o 2 (Identity): . Oracle Solaris UID X.509 . o 2 (Signature): (issuer) . o 2 (Private Keys): ( ). ( crypto systems ) . DSA . . o 2 (Entity): . . . . (Certification Authority CA) . CA () . CA . DigiCert Comodo Entrust . Microsoft Certificate Server Entrust CA . keytool (import) (export) . (self-signed) . keytool X.509 . X.509 (X.509 Certificates) X.509 ( ) . ASN.1/DER . Abstract Syntax Notation 1 . Definite Encoding Rules . X.509 : o 2 (Version): X.509 . . keytool v1 v2 v3 (import) (export) . v3 . 2 o 2 X.509 ( X.509 Version 1) . o 2 X.509 ( X.509 Version 2) . . . o 2 X.509 ( X.509 Version 3) () (extensions) . : KeyUsage ( signing-only ) AlternativeNames ( DNS IP). (critical) . KeyUsage (critical) keyCertSign SSL SSL. o 2 (Serial number): . . (Certificate Revocation List CRL) . o 2 (Signature algorithm identifier): CA . o 2 (Issuer name): (Distinguished Name) X.500 . CA . . (root) CA (top-level) . o 2 (Validity period): . . . . o 2 (Subject name): . X.500 . (DN) X.500 . 2 CN=Java Duke, OU=Java Software Division, O=Oracle Corporation, C=US (CN) (OU) (O) (C) (subject) . o 2 : . (Certificate Chains) keytool keystore . . : (self-signed). -genkeypair Commands . () (subject) . . -genkeypair / ( -signer ). (CSR) -certreq (CA) CA -importcert . () () CA . CA . CA . CA . ( CA ) CA CSR . CA (root) . ( ) . CA ( CA ). keystore . ( PKCS #7) . keytool . CA ( root) . . (distinguished name) CA DigiCert . CA . CA . CA keystore -printcert (fingerprint) CA . cacerts (cacerts Certificates File) cacerts : o 2 OS X: JAVA_HOME/lib/security o 2 : JAVA_HOME\lib\security cacerts keystore CA . jks keystore keytool . keystore cacerts CA . OS X : keytool -list -cacerts keystore cacerts changeit . SDK . : cacerts . CA cacerts cacerts . cacerts CA . CA cacerts . CA cacerts -delete keytool . cacerts $JAVA_HOME/lib/security JDK . . RFC 1421 (Internet RFC 1421 Certificate Encoding Standard) RFC 1421 . Base64 . -importcert -printcert () . -exportcert -rfc . -list SHA-256 . -v . -rfc . : -----BEGIN CERTIFICATE----- encoded certificate goes here. -----END CERTIFICATE----- X.500 (X.500 Distinguished Names) X.500 subject issuer () X.509 . keytool : o 2 commonName: Susan Jones. o 2 organizationUnit: ( ) Purchasing. o 2 localityName: () Palo Alto. o 2 stateName: California. o 2 country: CH. -dname -genkeypair : CN=cName, OU=orgUnit, O=org, L=city, S=state, C=countryCode : CN=commonName OU=organizationUnit O=organizationName L=localityName S=stateName C=country distinguished name : CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US : keytool -genkeypair -dname "CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US" -alias mark -keyalg rsa . CN cn Cn . . . : CN=Smith, OU=Java, O=Oracle, C=US distinguished name (\) (escape ) : cn=Jack, ou=Java\, Product Development, o=Oracle, c=US distinguished name . distinguished name . (\) . " (WARNINGS)" " (IMPORTING TRUSTED CERTIFICATES WARNING)" : (trusted) . Windows: -printcert -importcert -noprompt . . \tmp\cert . -printcert : keytool -printcert -file \tmp\cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Jun 24 18:01:13 PDT 2016 until: Wed Jun 23 17:01:13 PST 2016 Certificate Fingerprints: SHA-1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA-256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 Linux: -printcert -importcert -noprompt . . /tmp/cert . -printcert : keytool -printcert -file /tmp/cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Jun 24 18:01:13 PDT 2016 until: Wed Jun 23 17:01:13 PST 2016 Certificate Fingerprints: SHA-1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA-256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 . . JAR class . : -printcert . keystore -importcert . . -importcert -noprompt . -noprompt ..SH " (PASSWORDS WARNING)" keystore . / . -storepass -keypass . . . " (CERTIFICATE CONFORMANCE WARNING)" Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile [https://tools.ietf.org/rfc/rfc5280.txt] X.509 . keytool (self-signed) . JDK . -dname -ext . " (IMPORT A NEW TRUSTED CERTIFICATE)" keystore keytool ( CA ) keystore . -trustcacerts cacerts. keytool ( keystore cacerts) () . . . -noprompt . " (IMPORT A CERTIFICATE REPLY)" keystore -trustcacerts keystore cacerts . : o 2 X.509 keytool ( CA ) . (aliases) . . keytool . o 2 PKCS #7 X.509 CA . CA -trustcacerts keytool keystore keystore cacerts . CA -trustcacerts keytool keystore keystore cacerts . -noprompt . alias . keypass . keystore . -import . . -importcert . JDK 17 2021 KEYTOOL(1)