JCA - Certificates, 'keytool' and 'keystore'

Part:   1  2   3 

(Continued from previous part...)

"keytool" - Key and Certificate Management Tool

"keytool" is command line tool introduced in JDK 1.2 to manage keys and certificates using "keystore". "keytool" replaces the same functions offered by "javakey" in JDK 1.1. "keytool" offers a number functions through the following major command options:

• "-genkey": Generates a key pair and stores it as a key entry in the keystore.
• "-list": Lists all entries in the keystore.
• "-export": Exports the certificate of the specified key entry or certificate entry out of the keystore to a certificate file.
• "-printcert": Prints summary information of a certificate from a certificate file.
• "-import": Imports the certificate from a certificate file as a certificate entry into the keystore.
• "-keyclone": Creates a new key entry by copying an existing key entry.
• "-selfcert": Replaces the certificate in a key entry with a new self-signed certificate.
• "-delete": Deletes the entry of the specified alias name.

"keytool" Example - Generating Key Pairs and Self-Signed Certificates

In the first example, I want to try the "-genkey" command option using JDK 1.3.1:

keytool -genkey -alias my_home -keystore herong.jks
Enter keystore password:  HerongJKS
What is your first and last name?
  [Unknown]:  Herong Yang
What is the name of your organizational unit?
  [Unknown]:  My Unit
What is the name of your organization?
  [Unknown]:  My Home
What is the name of your City or Locality?
  [Unknown]:  My City
What is the name of your State or Province?
  [Unknown]:  My State
What is the two-letter country code for this unit?
  [Unknown]:  US
Is <CN=Herong Yang, OU=My Unit, O=My Home, L=My City, ST=My State, 
   C=US> correct?
  [no]:  yes
Enter key password for <my_home>
        (RETURN if same as keystore password):  My1stKey

Based on the documentation, the above example command should do the following for me:

• Create a "keystore" file, herong.jks, in JKS format, with password of "HerongJKS".
• Generate a pair of private key and public key for me using the default implementation of the default security package.
• Generate a certificate chain with a single self-signed certificate of my public key.
• Insert a key entry into the keystore with my private key and the certificate chain.

The following command shows that we do have a key entry in the keystore file:

keytool -list -keystore herong.jks -storepass HerongJKS

Keystore type: jks
Keystore provider: SUN

Your keystore contains 1 entry:

my_home, Sat Jun 1 07:15:16 EDT 2002, keyEntry,
Certificate fingerprint 
   (MD5): BE:D2:AF:4E:A7:44:13:08:16:4C:68:3B:D1:99:79:55

(Continued on next part...)

Part:   1  2   3