keytool(1) keytool(1) (NAME) keytool - () X.509 (SYNOPSIS) keytool [] . : o o -gencert o -genkeypair o -genseckey o -importcert o -importpassword o o -importkeystore o o -certreq o o -exportcert o o -list o -printcert o -printcertreq o -printcrl o o -storepasswd o -keypasswd o -delete o -changealias o o -help (DESCRIPTION) keytool . / ( ) . keytool ( ) () . ( ) ( ) . ( .) . . keytool (DES) . keytool (keystore) . . (COMMAND AND OPTION NOTES) . o (-) . o . o . o . . -v -rfc -J . . o . -keypass keytool / . keytool / . o ( ) . -printcert : keytool -printcert {-file cert_file} {-v} -printcert cert_file : keytool -printcert -file VScert.cer o (space) () . o -help . keytool keytool -help . (OPTION DEFAULTS) . -alias "mykey" -keyalg "DSA" ( -genkeypair) "DES" ( -genseckey) -keysize 2048 ( -genkeypair "RSA" -keyalg) 1024 ( -genkeypair "DSA" -keyalg) 256 ( -genkeypair "EC" -keyalg) 56 ( -genseckey "DES" -keyalg) 168 ( -genseckey "DESede" -keyalg) -validity 90 -keystore < .keystore > -storetype < "keystore.type" getDefaultType java.security.KeyStore > -file stdin ( ) stdout ( ) -protected false / ( -sigalg) : o DSA -sigalg SHA1withDSA . o RSA -sigalg SHA256withRSA . o EC -sigalg SHA256withECDSA . -keyalg -sigalg (JCA) : http://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec.html#AppA (COMMON OPTIONS) -v -help . -v (verbose) . -Jjavaoption . -Jjavaoption javaoption . . . java -h java -X . : -storetype storetype . -keystore keystore . storetype JKS keytool . keytool -genkeypair -keystore .keystore . -keystore ks_file ks_file . storetype JKS . -keystore KeyStore.load . NONE URL (null) KeyStore.load . NONE . -storepass[:env| :file] argument . env file argument . : o env: argument. o file: argument. : -keypass -srckeypass -destkeypass -srcstorepass -deststorepass env file . (:) . . -storepass . . . -providerName provider_name . -providerClass provider_class_name . -providerArg provider_arg -providerClass provider_class_name . -protected true false. true . -importkeystore -srcprotected -destprotected . -ext {name{:critical} {=value}} X.509 . -genkeypair -gencert -certreq . . name ( ) OID . value . value . :critical isCritical true false . :critical :c . (NAMED EXTENSIONS) keytool . . BC BasicContraints : : ca:{true|false}[,pathlen:] ca:true,pathlen: . ca:true . KU KeyUsage : usage(,usage)* usage digitalSignature nonRepudiation ( contentCommitment) keyEncipherment dataEncipherment keyAgreement keyCertSign cRLSign encipherOnly decipherOnly . usage (dig digitalSignature) (dS digitalSignature cRLS cRLSign) . usage . EKU ExtendedKeyUsage : usage(,usage)* usage anyExtendedKeyUsage serverAuth clientAuth codeSigning emailProtection timeStamping OCSPSigning OID . usage . usage . SAN SubjectAlternativeName : type:value(,type:value)* type EMAIL URI DNS IP OID . value type . IAN IssuerAlternativeName : SubjectAlternativeName. SIA SubjectInfoAccess : method:location-type:location-value (,method:location-type:location-value)* method timeStamping caRepository OID . location-type location- value type:value SubjectAlternativeName . AIA AuthorityInfoAccess : SubjectInfoAccess. method ocsp caIssuers OID . name OID DER extnValue OCTET STRING . (0-9, a-f, A-F) . 01:02:03:04 01020304 . . honored -gencert . all ( ) name{:[critical|non-critical]} ( isCritical ) -name ( all ) . . -ext honored -ext OID . ( OID) honored . subjectKeyIdentifier . authorityKeyIdentifier . : ( ) . . (COMMANDS) -gencert {-rfc} {-infile infile} {-outfile outfile} {-alias alias} {-sigalg sigalg} {-dname dname} {-startdate startdate {-ext ext}* {-validity valDays} [-keypass keypass] {-keystore keystore} [-storepass storepass] {-storetype storetype} {-providername provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} ( keytool -certreq ) . infile ( ) alias X.509 outfile ( ) . -rfc PEM Base64 DER . sigalg . startdate . valDays . dname (subject) . . ext X.509 . -ext . -gencert . e1 . ca ca1 ca2 e1 : keytool -alias ca -dname CN=CA -genkeypair keytool -alias ca1 -dname CN=CA -genkeypair keytool -alias ca2 -dname CN=CA -genkeypair keytool -alias e1 -dname CN=E1 -genkeypair ca ca1 ca1 ca2 : keytool -alias ca1 -certreq | keytool -alias ca -gencert -ext san=dns:ca1 | keytool -alias ca1 -importcert keytool -alias ca2 -certreq | $KT -alias ca1 -gencert -ext san=dns:ca2 | $KT -alias ca2 -importcert e1 e1.cert ca2 . e1 ca ca1 ca2 : keytool -alias e1 -certreq | keytool -alias ca2 -gencert > e1.cert -genkeypair {-alias alias} {-keyalg keyalg} {-keysize keysize} {-sigalg sigalg} [-dname dname] [-keypass keypass] {-startdate value} {-ext ext}* {-validity valDays} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} ( ) . X.509 . alias . keyalg keysize . sigalg . keyalg . dname (Distinguished Name) X.500 alias (issuer) (subject) . . keypass . . (Enter) . keypass . startdate "Not Before" (Validity) X.509 . : ([+-]nnn[ymdHMS])+ [yyyy/mm/dd] [HH:MM:SS] . . (+) (-) . nnn ( y m d H M S ). java.util.GregorianCalendar.add(int field, int amount) . : Calendar c = new GregorianCalendar(); c.add(Calendar.YEAR, -1); c.add(Calendar.MONTH, 1); c.add(Calendar.DATE, -1); return c.getTime() : // :: ( ). ( ) . ( 0 ). ( ) . . . . valDays ( -startdate -startdate ) . -genkey . . -genkeypair . -genseckey {-alias alias} {-keyalg keyalg} {-keysize keysize} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} (secret key) KeyStore.SecretKeyEntry alias . keyalg keysize . keypass . . Enter . keypass . -importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} {-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} ( PKCS#7 X.509 ) cert_file alias . stdin . keytool X.509 PKCS#7 . ( Base64) RFC 1421 . -----BEGIN -----END . : (CA) CA ( -certreq ). -alias . (alias) keytool . . keytool . keytool . -importpassword {-alias alias} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} KeyStore.SecretKeyEntry alias . . keypass . . Enter . keypass . -importkeystore {-srcstoretype srcstoretype} {-deststoretype deststoretype} [-srcstorepass srcstorepass] [-deststorepass deststorepass] {-srcprotected} {-destprotected} {-srcalias srcalias {-destalias destalias} [-srckeypass srckeypass]} [-destkeypass destkeypass] {-noprompt} {-srcProviderName src_provider_name} {-destProviderName dest_provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} . -srcalias . destalias srcalias . srckeypass . srckeypass keytool srcstorepass . srcstorepass . destkeypass . destkeypass . storepass keypass PKCS #12 . PKCS #12 -destkeypass -deststorepass . -srcalias . . srcstorepass . srcstorepass . . . . -noprompt . . . -printcertreq {-file file} PKCS #10 keytool -certreq . . . -certreq {-alias alias} {-dname dname} {-sigalg sigalg} {-file certreq_file} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} (CSR) PKCS #10 . CSR (CA) . ( ) ( ) . alias PKCS #10 . . keypass . dname (subject) CSR . X.500 alias . sigalg CSR . CSR certreq_file . CSR stdout . importcert CA . -exportcert {-alias alias} {-file cert_file} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-rfc} {-v} {-protected} {-Jjavaoption} alias cert_file . stdout . . -rfc RFC 1421 . alias . alias . . alias . -export . . -exportcert . -list {-alias alias} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v | -rfc} {-protected} {-Jjavaoption} alias stdout . alias . SHA1 . -v . -rfc RFC 1421 . -v -rfc . -printcert {-file cert_file | -sslserver host[:port]} {-jarfile JAR_file {-rfc} {-v} {-Jjavaoption} cert_file SSL host:port JAR JAR_file ( -jarfile) . HTTPS 443 . -sslserver -file . stdin . -rfc keytool PEM RFC 1421 . RFC 1421 . stdin RFC 1421 . SSL () -J- Dhttps.proxyHost=proxyhost -J-Dhttps.proxyPort=proxyport . (JSSE) : http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html : . -printcrl -file crl_ {-v} (CRL) crl_ . CRL . crl_ . : . -storepasswd [-new new_storepass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption} . new_storepass . -keypasswd {-alias alias} [-keypass old_keypass] [-new new_keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption} / alias old_keypass new_keypass . -keypass . -new . -delete [-alias alias] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} alias . . -changealias {-alias alias} [-destalias destalias] [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption} alias destalias . . -keypass . storepass ( ) . . -help . command_name : keytool -command_name -help. (EXAMPLES) / . (GENERATE THE KEY PAIR) . : keytool -genkeypair -dname "cn=Mark Jones, ou=Java, o=Oracle, c=US" -alias business -keypass -keystore /working/mykeystore -storepass -validity 180 mykeystore ( ) . / Mark Jones Java Oracle US . DSA . SHA1withDSA . business . . . . . : keytool -genkeypair mykey . .keystore . . . -genkeypair -genkeypair ( cn=Mark Jones, ou=Java, o=Oracle, c=US). CA (REQUEST A SIGNED CERTIFICATE FROM A CA) . (CA) . CA (CSR) : keytool -certreq -file MarkJ.csr CSR mykey MarkJ.csr . CA VeriSign . CA () . CA . CA (IMPORT A CERTIFICATE FOR THE CA) CA . CA cacerts . -importcert . o CA CA . o CA ( ) . CA . cacerts CA VeriSign VeriSign . CA CA cacerts CA . CA CA CA . ABC, Inc. CA ABCCA.cer ABC CA . . keytool -printcert keytool -importcert -noprompt . . ( ) . . : keytool -importcert -alias abc -file ABCCA.cer ABCCA.cer abc . CA (IMPORT THE CERTIFICATE REPLY FROM THE CA) CA ( cacerts) . CA ( CA ) ( CA ) cacerts . VeriSign VSMarkJ.cer : keytool -importcert -trustcacerts -file VSMarkJ.cer (EXPORT A CERTIFICATE THAT AUTHENTICATES THE PUBLIC KEY) jarsigner (JAR) . . . MJ.cer mykey : keytool -exportcert -alias mykey -file MJ.cer JAR jarsigner . (IMPORT KEYSTORE) importkeystore . . ( ) . keytool . keytool . JKS key.jks PKCS #11 : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass -deststorepass importkeystore . . -srcalias / . : keytool -importkeystore -srckeystore key.jks -destkeystore NONE -srcstoretype JKS -deststoretype PKCS11 -srcstorepass -deststorepass -srcalias myprivatekey -destalias myoldprivatekey -srckeypass -destkeypass -noprompt SSL (GENERATE CERTIFICATES FOR AN SSL SERVER) keytool : CA (root) CA (ca) SSL (server). . RSA . keytool -genkeypair -keystore root.jks -alias root -ext bc:c keytool -genkeypair -keystore ca.jks -alias ca -ext bc:c keytool -genkeypair -keystore server.jks -alias server keytool -keystore root.jks -alias root -exportcert -rfc > root.pem keytool -storepass -keystore ca.jks -certreq -alias ca | keytool -storepass -keystore root.jks -gencert -alias root -ext BC=0 -rfc > ca.pem keytool -keystore ca.jks -importcert -alias ca -file ca.pem keytool -storepass -keystore server.jks -certreq -alias server | keytool -storepass -keystore ca.jks -gencert -alias ca -ext ku:c=dig,kE -rfc > server.pem cat root.pem ca.pem server.pem | keytool -keystore server.jks -importcert -alias server (TERMS) (Keystore) . (Keystore entries) . keytool : (Key entries): . . . keytool jarsigner . (Trusted certificate entries): . () . . (KeyStore aliases) ( ) (alias) . -genseckey -genkeypair ( ) -importcert . keytool . duke / . . keytool -genkeypair -alias duke -keypass dukekeypasswd dukekeypasswd duke . Duke : keytool -keypasswd -alias duke -keypass dukekeypasswd -new newpass dukekeypasswd newpass . . . (KeyStore implementation) KeyStore java.security . . (keytool jarsigner) Policy Tool . KeyStore (public) . Oracle . () JKS . ( ) . (Provider) . KeyStore (SPI) . KeystoreSpi java.security SPI . API . KeystoreSpi : http://docs.oracle.com/javase/8/docs/technotes/guides/security/crypto/HowToImplAProvider.html getInstance KeyStore . / . . keytool . FileInputStream . jarsigner policytool URL . keytool jarsigner -storetype . Policy Tool Keystore . keystore.type . java.security : java.home\lib\security java.home/lib/security Oracle Solaris java.home ( jre SDK JRE). keystore.type . . KeyStore getDefaultType keystore.type . keystore.type : KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType()); jks Oracle . : keystore.type=jks . pkcs12 : keystore.type=pkcs12 : . JKS jks . (Certificate) ( ) ( issuer) ( subject) . : (Public Keys): . . (Digitally Signed): . . (Identity): . UID X.509 . (Signature): . (Issuer) . (Private Keys): ( ). . DSA . . / (Entity): . . . . (CA) . CA . CA . VeriSign Thawte Entrust . Microsoft Certificate Server Entrust CA . keytool . . keytool X.509 . X.509 (X.509 Certificates) X.509 ( ) . ASN.1/DER . (ASN.1) (DER) . X.509 : (Version): X.509 . . keytool . X.509 . X.509 . . . X.509 () (Extensions) . : KeyUsage ( signing-only) AlternativeNames ( DNS IP ). (Critical) . KeyUsage keyCertSign SSL SSL. (Serial number): . (CRL) . (Signature algorithm identifier): CA . (Issuer name): X.500 . X.500 . CA . . CA . (Validity period): . . . . (Subject name): . X.500 . (DN) . X.500 . : CN=Java Duke, OU=Java Software Division, O=Oracle Corporation, C=US (CN) (OU) (O) (C) . (Subject public key information): . (Certificate Chains) keytool . . . -genkeypair . () . . -genkeypair / . (CSR) -certreq (CA) CA -importcert . -certreq -importcert . () CA . CA . CA . CA . ( CA ) CA CA CSR . CA . ( ) . CA ( CA ). . ( PKCS #7) . keytool . ( ) CA . . VeriSign . CA . CA . CA -printcert CA . cacerts (The cacerts Certificates File) cacerts : java.home\lib\security java.home/lib/security Oracle Solaris java.home ( jre SDK JRE). cacerts CA . keytool jks . cacerts CA . : keytool -list -keystore java.home/lib/security/cacerts cacerts changeit . SDK . : cacerts . CA cacerts cacerts . cacerts CA . CA cacerts . CA cacerts delete keytool . cacerts JRE . . RFC 1421 (Internet RFC 1421 Certificate Encoding Standard) RFC 1421 . Base64 . -importcert -printcert . -exportcert -rfc . -list SHA1 . -v . -rfc . : -----BEGIN CERTIFICATE----- . -----END CERTIFICATE----- X.500 (X.500 Distinguished Names) X.500 subject issuer () X.509 . keytool : commonName: Susan Jones. organizationUnit: ( ) Purchasing. localityName: Palo Alto. stateName: California. country: CH. -dname ( -genkeypair) : CN=cName, OU=orgUnit, O=org, L=city, S=state, C=countryCode : CN=commonName OU=organizationUnit O=organizationName L=localityName S=stateName C=country : CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US : keytool -genkeypair -dname "CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US" -alias mark . CN cn Cn . . : CN=Steve Meier, OU=Java, O=Oracle, C=US (\) : cn=Peter Schuster, ou=Java\, Product Development, o=Oracle, c=US . . (\) . (WARNINGS) (IMPORTING TRUSTED CERTIFICATES WARNING) : . : -printcert -importcert -noprompt . . \tmp\cert . -printcert : keytool -printcert -file \tmp\cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Sep 25 18:01:13 PDT 1997 until: Wed Dec 24 17:01:13 PST 1997 Certificate Fingerprints: MD5: 11:81:AD:92:C8:E5:0E:A2:01:2E:D4:7A:D7:5F:07:6F SHA1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 Oracle Solaris: -printcert -importcert -noprompt . . /tmp/cert . -printcert : keytool -printcert -file /tmp/cert Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll Serial Number: 59092b34 Valid from: Thu Sep 25 18:01:13 PDT 1997 until: Wed Dec 24 17:01:13 PST 1997 Certificate Fingerprints: MD5: 11:81:AD:92:C8:E5:0E:A2:01:2E:D4:7A:D7:5F:07:6F SHA1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE SHA256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90: 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4 . . JAR . : -printcert . -importcert . . -importcert -noprompt . -noprompt . (PASSWORDS WARNING) . / . -storepass -keypass . . . (CERTIFICATE CONFORMANCE WARNING) RFC 5280 X.509 . : http://tools.ietf.org/rfc/rfc5280.txt keytool . JRE . -dname -ext . (NOTES) (IMPORT A NEW TRUSTED CERTIFICATE) keytool ( CA) . -trustcacerts cacerts . keytool ( cacerts) ( ) . . . . -noprompt . (IMPORT A CERTIFICATE REPLY) -trustcacerts cacerts . cacerts . : o X.509 keytool ( CA) . . . keytool . o PKCS #7 X.509 CA . CA -trustcacerts keytool cacerts . CA -trustcacerts keytool cacerts . -noprompt . alias . keypass . . -import . -importcert . (SEE ALSO) o jar(1) o jarsigner(1) o Java SE http://docs.oracle.com/javase/tutorial/security/index.html JDK 8 03 March 2015 keytool(1)