"keytool -certreq" - Generate CSR (Certificate Signing Request)

PKI Certificate Tutorials - Herong's Tutorial Examples

∟Java "keytool" Commands and KeyStore Files

∟"keytool -certreq" - Generate CSR (Certificate Signing Request)

This section provides a tutorial example on how to use the 'keytool -certreq' command to generate a CSR from a given private/public key pair with a self-signed certificate stored in a KeyStore file.

In the this tutorial, I want to generate a Generate CSR (Certificate Signing Request) from my self-signed certificate and its private/public key pair.

1. Generate a CSR from a given key entry in a KeyStore file.

herong$ keytool -certreq -alias my_home -file my_home.csr \
  -keystore herong.jks -storepass HerongJKS

2. Look at the CSR.

herong$ more my_home.csr 

-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBlDCCARsCAQAwbDELMAkGA1UEBhMCVVMxETAPBgNVBAgTCE15IFN0YXRlMRAw
DgYDVQQHEwdNeSBDaXR5MRAwDgYDVQQKEwdNeSBIb21lMRAwDgYDVQQLEwdNeSBV
...
KB3l6UEs8bGXLB65R/2NpiSbwlkRogMB
-----END NEW CERTIFICATE REQUEST-----

3. Print out information from the CSR.

herong$ keytool -printcertreq -file my_home.csr

PKCS #10 Certificate Request (Version 1.0)
Subject: CN=Herong Yang, O=My Home, L=My City, ST=My State, C=US
Format: X.509
Public Key: 384-bit EC (secp384r1) key
Signature algorithm: SHA384withECDSA

Extension Request:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 38 B5 80 C8 FD 32 A1 FC   DB 3F 3C 88 63 45 3D D1  
0010: 42 2D 2E AC                                        
]
]