KEYTOOL(1) JDK Commands KEYTOOL(1) (NAME) keytool - ( ) (SYNOPSIS) keytool [] keytool : o -certreq: (Certificate Request) o -changealias: (alias) o -delete: o -exportcert: (Export) o -genkeypair: ( ) o -genseckey: (Secret Key) o -gencert: o -importcert: (Import) o -importpass: o -importkeystore: (Keystore) o -keypasswd: o -list: o -printcert: o -printcertreq: o -printcrl: (CRL) o -storepasswd: o -showinfo: o -version: . (DESCRIPTION) keytool . / ( ) . keytool ( ) (Cache) . ( ) ( ) . . . keytool ( DES) . . keytool (Keystore) . keytool jdk.certpath.disabledAlgorithms jdk.security.legacyAlgorithms . . jdk.certpath.disabledAlgorithms jdk.security.legacyAlgorithms java.security ( $JAVA_HOME/conf/security ) . (COMMAND AND OPTION NOTES) : o (-) . o . o . o : . . . -ext X.509v3 . o ({ }) ([ ]) . o . -v -rfc -J . o . -keypass keytool / . keytool / . o ( ) . -printcert : keytool -printcert {-file cert_file} {-v} -printcert cert_file : keytool -printcert -file VScert.cer o (space) . (COMMANDS AND OPTIONS) keytool . : o -gencert o -genkeypair o -genseckey o -importcert o -importpass : o -importkeystore : o -certreq : o -exportcert : o -list o -printcert o -printcertreq o -printcrl : o -storepasswd o -keypasswd o -delete o -changealias : o -showinfo : o -version (COMMANDS FOR CREATING OR ADDING DATA TO THE KEYSTORE) -gencert -gencert : o {-rfc}: RFC ( ) o {-infile infile}: o {-outfile outfile}: o {-alias alias}: o {-sigalg sigalg}: o {-dname dname}: (Distinguished Name) o {-startdate startdate}: o {-ext ext}*: X.509 o {-validity days}: o [-keypass arg]: o {-keystore keystore}: o [-storepass arg]: o {-storetype type}: o {-providername name}: (Provider) o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . . : keytool -addprovider SunPKCS11 -providerarg some.cfg ... : SunPKCS11 -providerclass sun.security.pkcs11.SunPKCS11 . JDK -providerclass . (classpath) (reflection) -providerclass . o {-providerclass class [-providerarg arg]}: (Fully Qualified Class Name) . MyProvider : keytool -providerclass com.example.MyProvider ... o {-providerpath list}: o {-v}: (Verbose) o {-protected}: -gencert ( keytool -certreq ) . infile X.509 outfile . -rfc PEM Base64 DER . -sigalg . startdate . days . dname (Subject) . -ext X.509 . -ext . -gencert . e1 . ca ca1 ca2 e1 : keytool -alias ca -dname CN=CA -genkeypair -keyalg rsa keytool -alias ca1 -dname CN=CA -genkeypair -keyalg rsa keytool -alias ca2 -dname CN=CA -genkeypair -keyalg rsa keytool -alias e1 -dname CN=E1 -genkeypair -keyalg rsa ca ca1 ca1 ca2 : keytool -alias ca1 -certreq | keytool -alias ca -gencert -ext san=dns:ca1 | keytool -alias ca1 -importcert keytool -alias ca2 -certreq | keytool -alias ca1 -gencert -ext san=dns:ca2 | keytool -alias ca2 -importcert e1 e1.cert ca2 . e1 ca ca1 ca2 : keytool -alias e1 -certreq | keytool -alias ca2 -gencert > e1.cert -genkeypair -genkeypair : o {-alias alias}: o -keyalg alg: o {-keysize size}: o {-groupname name}: . (Elliptic Curve). o {-sigalg alg}: o {-signer alias}: o [-signerkeypass arg]: o [-dname name]: (Distinguished Name) o {-startdate date}: o {-ext value}*: X.509 o {-validity days}: o [-keypass arg]: o {-keystore keystore}: o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg] }: . o {-providerpath list}: o {-v}: o {-protected}: -genkeypair ( ) . -signer X.509 v3 . -signer ( ) . . -keyalg . -keysize . -groupname ( ) . -keysize KeyPairGenerator initialize(int keysize) . -groupname KeyPairGenerator initialize(AlgorithmParameterSpec params) params new NamedParameterSpec(groupname) . -groupname -keysize . -groupname . -keysize . -sigalg . -keyalg . -signer PrivateKeyEntry . . ( -keyalg XDH X25519 X448 DH ) . -signerkeypass . . -dname X.500 -alias . -signer (issuer) (subject) . -signer . . -keypass . . Return (Enter) . -keypass . -startdate "Not Before" Validity X.509 . : ([+-]nnn[ymdHMS])+ [yyyy/mm/dd] [HH:MM:SS] . . (+) (-) . nnn ( y m d H M S ). java.util.GregorianCalendar.add(int field, int amount) . : Calendar c = new GregorianCalendar(); c.add(Calendar.YEAR, -1); c.add(Calendar.MONTH, 1); c.add(Calendar.DATE, -1); return c.getTime() // :: ( ) . ( ) . ( 0 ). . . . . date ( -startdate -startdate) . -genseckey -genseckey : o {-alias alias}: o [-keypass arg]: o -keyalg alg: o {-keysize size}: o {-keystore keystore}: o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: o {-protected}: -genseckey KeyStore.SecretKeyEntry alias . -keyalg -keysize . -keypass . . Return -keystore . -keypass . -importcert -importcert : o {-noprompt}: o {-trustcacerts}: cacerts o {-protected}: o {-alias alias}: o {-file file}: o [-keypass arg]: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: -importcert ( PKCS#7 X.509 ) -file file keystore -alias . -file file stdin . keytool X.509 PKCS#7 . ( Base64) RFC 1421 . -----BEGIN -----END . : (CA) (CSR) CA. -certreq . -alias . keytool . . keytool . -alias keytool . -importpass -importpass : o {-alias alias}: o [-keypass arg]: o {-keyalg alg}: o {-keysize size}: o {-keystore keystore}: o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: o {-protected}: -importpass KeyStore.SecretKeyEntry -alias . . -keypass . . Return keystore . -keypass . (COMMANDS FOR IMPORTING CONTENTS FROM ANOTHER KEYSTORE) -importkeystore -importkeystore : o -srckeystore keystore: o {-destkeystore keystore}: o {-srcstoretype type}: o {-deststoretype type}: o [-srcstorepass arg]: o [-deststorepass arg]: o {-srcprotected}: o {-destprotected}: o {-srcprovidername name}: o {-destprovidername name}: o {-srcalias alias}: o {-destalias alias}: o [-srckeypass arg]: o [-destkeypass arg]: o {-noprompt}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: o {-providerpath list}: o {-v}: : : -srckeystore keystore -destkeystore keystore -importkeystore . : keytool -importkeystore -destkeystore $HOME/.keystore . -srcalias . -destalias -srcalias . -srckeypass . -srckeypass keytool -srcstorepass . -srcstorepass . -destkeypass . -destkeypass . storepass keypass PKCS #12 . PKCS#12 -destkeypass -deststorepass . -srcalias . . -srcstorepass . -srcstorepass . . . . -noprompt . . . (COMMANDS FOR GENERATING A CERTIFICATE REQUEST) -certreq -certreq : o {-alias alias}: o {-sigalg alg}: o {-file file}: o [ -keypass arg]: o {-keystore keystore}: o {-dname name}: (Distinguished Name) o {-ext value}: X.509 o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: o {-protected}: -certreq (CSR) PKCS #10 . CSR (CA) . CA ( ) ( ) . alias PKCS #10 . . -keypass . -dname (Subject) CSR X.500 . -sigalg CSR . CSR -file file . CSR -stdout . CA -importcert . (COMMANDS FOR EXPORTING DATA) -exportcert -exportcert : o {-rfc}: RFC o {-alias alias}: o {-file file}: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg] }: . o {-providerpath list}: o {-v}: o {-protected}: -exportcert -alias alias -file file . stdout . . -rfc RFC 1421 . -alias . -alias . . -alias . (COMMANDS FOR DISPLAYING DATA) -list -list : o {-rfc}: RFC o {-alias alias}: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg] }: . o {-providerpath list}: o {-v}: o {-protected}: -list -alias stdout . -alias alias . SHA-256 . -v . -rfc RFC 1421 . : -v -rfc . -printcert -printcert : o {-rfc}: RFC o {-file cert_file}: o {-sslserver server[:port]}: (SSL) o {-jarfile JAR_file}: .jar o {-keystore keystore}: o {-trustcacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-protected}: o {-v}: -printcert -file cert_file SSL -sslserver server[:port] JAR -jarfile JAR_file . . HTTPS 443 . : -sslserver -file . stdin . -rfc keytool PEM RFC 1421 . stdin RFC 1421 . SSL () -J-Dhttps.proxyHost=proxyhost -J-Dhttps.proxyPort=proxyport . : . ( -keystore) cacerts ( -trustcacerts) . -printcertreq -printcertreq : o {-file file}: o {-v}: -printcertreq PKCS #10 ( keytool -certreq ) . . -printcrl -printcrl : o {-file crl}: o {-keystore keystore}: o {-trustcacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-protected}: o {-v}: -printcrl (CRL) -file crl . CRL . CA crl . : . CRL ( -keystore) cacerts ( -trustcacerts) . (COMMANDS FOR MANAGING THE KEYSTORE) -storepasswd -storepasswd : o [-new arg]: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: -storepasswd . -new arg . -keypasswd -keypasswd : o {-alias alias}: o [-keypass old_keypass]: o [-new new_keypass]: o {-keystore keystore}: o {-storepass arg}: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: -keypasswd / -alias -keypass old_keypass -new new_keypass . . -keypass -keypass (-storepass arg) . -new . -delete -delete : o [-alias alias]: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: o {-protected}: -delete -alias alias . (alias) . -changealias -changealias : o {-alias alias}: o [-destalias alias]: o [-keypass arg]: o {-keystore keystore}: o {-cacerts}: cacerts o [-storepass arg]: o {-storetype type}: o {-providername name}: o {-addprovider name [-providerarg arg]}: ( SunPKCS11) . o {-providerclass class [-providerarg arg]}: . o {-providerpath list}: o {-v}: o {-protected}: -changealias -alias alias -destalias alias . . -keypass . -storepass ( ) . . (COMMANDS FOR DISPLAYING SECURITY-RELATED INFORMATION) -showinfo -showinfo : o {-tls}: TLS o {-v}: -showinfo . -tls TLS (Cipher Suites) . (COMMANDS FOR DISPLAYING PROGRAM VERSION) -version keytool . (COMMANDS FOR DISPLAYING HELP INFORMATION) --help keytool keytool . o keytool : keytool --help o keytool : keytool - --help (COMMON COMMAND OPTIONS) -v --help . -v (Verbose) . -Joption . -Joption option . . . java -h java -X . : -storetype storetype . -keystore keystore . JKS keytool . keytool -genkeypair -keystore .keystore . -keystore ks_file ks_file . storetype JKS . -keystore KeyStore.load . NONE URL (null stream) KeyStore.load . ( ) NONE . -cacerts cacerts cacerts . -keystore path_to_cacerts -storetype type_of_cacerts . -keystore -storetype -cacerts . -storepass [:env | :file ] argument . env file argument . : o env: argument. o file: argument. : -keypass -srckeypass -destkeypass -srcstorepass -deststorepass env file . (:) . . -storepass . . . -providername name . -addprovider name ( SunPKCS11) . -providerclass class . -providerpath list . -providerarg arg -addprovider -providerclass (Constructor) class . -protected=true|false true (PIN Reader) . -importkeystore -srcprotected -destprotected . -ext {name{:critical} {=value}} X.509 . -genkeypair -gencert -certreq . . name ( ) (OID) . value . value . :critical isCritical true false . :critical :c . -conf file . (PRE-CONFIGURED OPTIONS FILE) (Java Properties File) -conf . () keytool keytool.command_name . keytool.all () . ${prop} . ( . keytool keytool.all ( ) keytool ( ) . keytool.all . keytool . preconfig: # A tiny pre-configured options file keytool.all = -keystore ${user.home}/ks keytool.list = -v keytool.genkeypair = -keyalg rsa keytool -conf preconfig -list : keytool -keystore ~/ks -v -list keytool -conf preconfig -genkeypair -alias me : keytool -keystore ~/ks -keyalg rsa -genkeypair -alias me keytool -conf preconfig -genkeypair -alias you -keyalg ec : keytool -keystore ~/ks -keyalg rsa -genkeypair -alias you -keyalg ec : keytool -keystore ~/ks -genkeypair -alias you -keyalg ec -keyalg ec . (EXAMPLES OF OPTION VALUES) : -alias "mykey" -keysize 2048 (when using -genkeypair and -keyalg is "DSA") 3072 (when using -genkeypair and -keyalg is "RSA", "RSASSA-PSS", or "DH") 384 (when using -genkeypair and -keyalg is "EC") 56 (when using -genseckey and -keyalg is "DES") 168 (when using -genseckey and -keyalg is "DESede") -groupname ed25519 (when using -genkeypair and -keyalg is "EdDSA", key size is 255) x25519 (when using -genkeypair and -keyalg is "XDH", key size is 255) -validity 90 -keystore -destkeystore -storetype -file stdin (if reading) stdout (if writing) -protected false ( -sigalg) : : keyalg key size default sigalg ------------------------------------------- DSA any size SHA256withDSA RSA < 624 SHA256withRSA (key size is too small for using SHA-384) <= 7680 SHA384withRSA > 7680 SHA512withRSA EC < 512 SHA384withECDSA >= 512 SHA512withECDSA RSASSA-PSS < 624 RSASSA-PSS (with SHA-256, key size is too small for using SHA-384) <= 7680 RSASSA-PSS (with SHA-384) > 7680 RSASSA-PSS (with SHA-512) EdDSA 255 Ed25519 448 Ed448 Ed25519 255 Ed25519 Ed448 448 Ed448 o . -keysize -groupname . o RSASSA-PSS MessageDigest (Hash) MGF1 . o -keysize -groupname . : JDK . JDK . -keysize -groupname -sigalg . (SUPPORTED NAMED EXTENSIONS) keytool . . BC BasicConstraints : ca:{true|false}[,pathlen:len] len ca:true,pathlen:len . len ca:true . KU KeyUsage : usage(, usage)* usage : o digitalSignature o nonRepudiation (contentCommitment) o keyEncipherment o dataEncipherment o keyAgreement o keyCertSign o cRLSign o encipherOnly o decipherOnly usage ( dig digitalSignature) ( dS digitalSignature cRLS cRLSign). usage . EKU ExtendedKeyUsage : usage(, usage)* usage : o anyExtendedKeyUsage o serverAuth o clientAuth o codeSigning o emailProtection o timeStamping o OCSPSigning o (OID) usage . usage . SAN SubjectAlternativeName : type:value(, type:value)* type : o EMAIL o URI o DNS o IP o OID value type . IAN IssuerAlternativeName : SAN SubjectAlternativeName. SIA SubjectInfoAccess : method:location-type:location-value(, method:location-type:location-value)* method : o timeStamping o caRepository o OID location-type location-value type:value SubjectAlternativeName . AIA AuthorityInfoAccess : SIA SubjectInfoAccess. method : o ocsp o caIssuers o OID name OID DER extnValue OCTET STRING . (0-9, a-f, A-F) . 01:02:03:04 01020304 . . honored -gencert . all ( ) name{:[critical|non-critical]} ( isCritical ) -name ( all ) . . -ext honored -ext OID . ( OID) honored . OID . subjectKeyIdentifier . authorityKeyIdentifier . : ( ) . . (EXAMPLES OF TASKS IN CREATING A KEYSTORE) / : o o (CA) o (CA) o (CA) o o o SSL (GENERATING THE KEY PAIR) . : keytool -genkeypair -dname "cn=myname, ou=mygroup, o=mycompany, c=mycountry" -alias business -keyalg rsa -keypass password -keystore /working/mykeystore -storepass password -validity 180 mykeystore ( ) -keypass . / myname mygroup mycompany mycountry . RSA 3072 . SHA384withRSA . -alias business . -keypass . . -keyalg . : keytool -genkeypair -keyalg rsa mykey . .keystore . .keystore . . : -genkeypair . : cn=myname, ou=mygroup, o=mycompany, c=mycountry. (CA) (REQUESTING A SIGNED CERTIFICATE FROM A CA) : CA . CA : 1. CSR: keytool -certreq -file myname.csr CSR mykey myname.csr . 2. myname.csr CA DigiCert. CA () . CA . (CA) (IMPORTING A CERTIFICATE FOR THE CA) CA : 1. CA cacerts . -importcert . o CA CA . o CA ( ) . CA . cacerts CA [https://www.oracle.com/java/technologies/javase/carootcertsprogram.html] . CA CA cacerts CA . CA CA . CA CA . X.cer CA CA . : 1. keytool -printcert keytool -importcert -noprompt. . 2. . ( ) . . 2. CA . : keytool -importcert -alias alias -file X.cer CA alias . (CA) (IMPORTING THE CERTIFICATE REPLY FROM THE CA) CA ( cacerts) . : o CA CA . o CA . cacerts . DigiCert : : DCmyname.cer : keytool -importcert -trustcacerts -file DCmyname.cer (EXPORTING A CERTIFICATE THAT AUTHENTICATES THE PUBLIC KEY) : jarsigner (JAR) . . . : 1. myname.cer : : mykey : keytool -exportcert -alias mykey -file myname.cer 2. JAR jarsigner . (IMPORTING THE KEYSTORE) importkeystore . . . ( ) . keytool . keytool . JKS key.jks PKCS #11 : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass password -deststorepass password importkeystore . . -srcalias : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass password -deststorepass password -srcalias myprivatekey -destalias myoldprivatekey -srckeypass password -destkeypass password -noprompt SSL (GENERATING CERTIFICATES FOR AN SSL SERVER) keytool : o CA (root) o CA (ca) o SSL (server) . keytool -genkeypair -keystore root.jks -alias root -ext bc:c -keyalg rsa keytool -genkeypair -keystore ca.jks -alias ca -ext bc:c -keyalg rsa keytool -genkeypair -keystore server.jks -alias server -keyalg rsa keytool -keystore root.jks -alias root -exportcert -rfc > root.pem keytool -storepass password -keystore ca.jks -certreq -alias ca | keytool -storepass password -keystore root.jks -gencert -alias root -ext BC=0 -rfc > ca.pem keytool -keystore ca.jks -importcert -alias ca -file ca.pem keytool -storepass password -keystore server.jks -certreq -alias server | keytool -storepass password -keystore ca.jks -gencert -alias ca -ext ku:c=dig,kE -rfc > server.pem cat root.pem ca.pem server.pem | keytool -keystore server.jks -importcert -alias server (TERMS) (Keystore) . (Keystore entries) . keytool : (Key entries): . . . keytool jarsigner . (Trusted certificate entries): . () . . (Keystore aliases) ( ) (alias) . -genseckey -genkeypair ( ) -importcert . keytool . duke / . . keytool -genkeypair -alias duke -keyalg rsa -keypass passwd passwd duke . Duke : keytool -keypasswd -alias duke -keypass passwd -new newpasswd passwd newpasswd . . . (Keystore implementation) KeyStore java.security . . (keytool jarsigner) . KeyStore (public) . JDK 9 PKCS12 . RSA PKCS12 . . . () JKS . ( ) . (Provider) . KeyStore (SPI) . KeystoreSpi java.security SPI . (Provider) . KeystoreSpi . getInstance KeyStore . / . . keytool . FileInputStream . jarsigner URL . keytool jarsigner -storetype . keystore.type . java.security : o : java.home/lib/security o : java.home\lib\security keystore.type . KeyStore getDefaultType keystore.type . keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); pkcs12 RSA PKCS12 . : keystore.type=pkcs12 . jks : keystore.type=jks : JKS jks . (Certificate) ( ) ( issuer) ( subject) . : o (Public Keys): . . o (Digitally Signed): . . o (Identity): . UID X.509 . o (Signature): . (Issuer) . o (Private Keys): ( ). . DSA . . o / (Entity): . . . . (CA) . CA . CA . DigiCert Comodo Entrust . Microsoft Certificate Server Entrust CA . keytool . . keytool X.509 . X.509 (X.509 Certificates) X.509 ( ) . ASN.1/DER . (ASN.1) (DER) . X.509 : o (Version): X.509 . . keytool . o X.509 . o X.509 . . . o X.509 () (Extensions) . : KeyUsage ( signing-only) AlternativeNames ( DNS IP ). (Critical) . KeyUsage keyCertSign SSL SSL. o (Serial number): . (CRL) . o (Signature algorithm identifier): CA . o (Issuer name): X.500 . CA . . CA . o (Validity period): . . . . o (Subject name): . X.500 . (DN) : CN=Java Duke, OU=Java Software Division, O=Oracle Corporation, C=US (CN) (OU) (O) (C) . o (Subject public key information): . (Certificate Chains) keytool . . . . () . . -genkeypair / ( -signer ). (CSR) -certreq (CA) CA -importcert . () CA . CA . CA . CA . ( CA ) CA CA CSR . CA . ( ) . CA ( CA ). . ( PKCS #7) . keytool . ( ) CA . . DigiCert . CA . CA . CA -printcert CA . cacerts (cacerts Certificates File) cacerts : o : JAVA_HOME/lib/security o : JAVA_HOME\lib\security cacerts CA . keytool jks . cacerts CA . : keytool -list -cacerts cacerts changeit . SDK . : cacerts . CA cacerts cacerts . cacerts CA . CA cacerts . CA cacerts -delete keytool . cacerts $JAVA_HOME/lib/security . . RFC 1421 (Internet RFC 1421 Certificate Encoding Standard) RFC 1421 . Base64 . -importcert -printcert . -exportcert -rfc . -list SHA-256 . -v . -rfc . : -----BEGIN CERTIFICATE----- encoded certificate goes here. -----END CERTIFICATE----- X.500 (X.500 Distinguished Names) X.500 subject issuer () X.509 . keytool : o commonName: Susan Jones. o organizationUnit: ( ) Purchasing. o localityName: Palo Alto. o stateName: California. o country: CH. -dname ( -genkeypair) : CN=cName, OU=orgUnit, O=org, L=city, S=state, C=countryCode : CN=commonName OU=organizationUnit O=organizationName L=localityName S=stateName C=country : CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US : keytool -genkeypair -dname "CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US" -alias mark -keyalg rsa CN cn Cn . . : CN=Smith, OU=Java, O=Oracle, C=US (\) : cn=Jack, ou=Java Product Development, o=Oracle, c=US . . . (WARNINGS) (IMPORTING TRUSTED CERTIFICATES WARNING) : . : -printcert -importcert -noprompt . . \tmp\cert . -printcert : keytool -printcert -file \tmp\cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Jun 24 18:01:13 PDT 2016 until: Wed Jun 23 17:01:13 PST 2016 Certificate Fingerprints: SHA-1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA-256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 : -printcert -importcert -noprompt . . /tmp/cert . -printcert : keytool -printcert -file /tmp/cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Jun 24 18:01:13 PDT 2016 until: Wed Jun 23 17:01:13 PST 2016 Certificate Fingerprints: SHA-1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA-256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 . . JAR . : -printcert -importcert . . -importcert -noprompt . -noprompt . (PASSWORDS WARNING) . / . -storepass -keypass . . . (CERTIFICATE CONFORMANCE WARNING) (CRL) X.509 [https://tools.ietf.org/rfc/rfc5280.txt] X.509 . keytool . JDK . -dname -ext . (IMPORT A NEW TRUSTED CERTIFICATE) keytool ( CA) . -trustcacerts cacerts . keytool ( cacerts) ( ) . . . -noprompt . (IMPORT A CERTIFICATE REPLY) -trustcacerts cacerts . : o X.509 keytool ( CA) . . . keytool . o PKCS #7 X.509 CA . CA -trustcacerts keytool cacerts . CA -trustcacerts keytool cacerts . -noprompt . alias . keypass . . -import . -importcert . JDK 25.0.4.1 2026 KEYTOOL(1)