• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

  • Buy SSL Certificates
  • Blog
  • OpenSSL
  • Keytool
  • SSL Tools
  • Donate

How to create SSL certificate with Java keytool

January 20, 2020 by Mister PKI Leave a Comment

What is Java keytool?

The Java keytool is a command-line utility used to manage keystores in different formats containing keys and certificates. You can use the java keytool to create an SSL certificate via a response from a Certificate Signing Request (CSR). In many respects, the java keytool is a competing utility with openssl for keystore, key, and certificate management.

Use case for creating an SSL certificate from a CSR.

When operating a local Certification Authority (CA) Java keytool can be used to accept CSR’s and create and sign a certificate as the response. It is also useful when creating the certificate chain within the same keystore. Again, while this is not how commercial CA’s will operate, it can be useful, convenient, and effective when operating a local CA.

What keytool command do I use to create SSL certificate?

When using the java keytool, there are two prerequisites:

  1. Generate a key pair
  2. Generate a Certificate Signing Request (CSR) and save it to a file.

After successfully creating the SSL certificate, you will then need to import it into your keystore.

Use this command to create an SSL certificate using the java keytool. The result will be a keystore containing a signed SSL certificate.

keytool -gencert \
 -rfc \
 -infile example.csr \
 -outfile example.crt \
 -alias example \
 -sigalg SHA256withRSA \
 -dname CN=example \
 -startdate "2019/01/19 00:00:00" \
 -validity 365 \
 -keypass changeit \
 -keystore example.p12 \
 -storepass changeit \
 -storetype PKCS12 \
 -v

Java keytool options:

-rfc – Output certificate file in PEM format.

-infile – The Certificate Signing Request (CSR) to be signed.

-outfile – The signed certificate.

-alias – The alias of the entry encapsulated in the keystore. The chosen value should enhance the readability of the keystore entries, especially when the keystore contains multiple entries.

-sigalg – This value is generally derived from the algorithm of the private key, but may be specified for clarity. Supported signature algorithms include SHA1withDSA, SHA256withRSA, and SHA256withECDSA.

-dname – This is the distinguished name, also know as the subject of the certificate.

-startdate – The not_before value of the generated certificate. It can be specified in two parts, the date and the time. If both parts are specified, it must be surrounded by quotes.

-validity – The validity period in days. This value will compute the not_after value from the not_before value.

-keypass – The private key password specified by the alias. If not entered, you will either prompted or it will default to the -storepass value if set.

-keystore – The filename of the keystore.

-storepass – The current keystore password. We recommend leaving this option off and letting keytool prompt you instead of writing your password in plain text here.

-storetype – Recommended keystore types include PKCS12 and JKS. In this case, the keystore was of type PKCS12.

-v – Verbose output.

create ssl certificate keytool
create ssl certificate keytool

https://docs.oracle.com/javase/10/tools/keytool.htm#GUID-5990A2E4-78E3-47B7-AE75-6D1826259549__CREATEORADDDATATOTHEKEYSTORE-507D49D2

Read all of our blog content.

keytool

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Popular Posts

PKCS12

openssl s_client

Keytool

Keytool list

ECDSA vs RSA

OpenSSL

PKCS7

Certificate Decoder

Training Courses

Top online courses in IT & Software

Cyber Security Training

Udemy - The Complete Internet Security Privacy Course icon

Buy SSL Certificates

The SSL Store

Comodo Store

Sectigo Store

RapidSSL

Recent Posts

  • pfx password
  • pkcs12
  • Sendmail vs Postfix – Mail Transfer Agent Comparison
  • Python mock datetime now
  • Python get SSL Certificate

Footer

  • Twitter
  • YouTube

Pages

  • About Mister PKI
  • Blog
  • Compare and Buy Affordable PKI Certificates
  • Contact Us
  • Full Disclosure
  • Privacy Policy
  • SSL Tools – Certificate Decoder and Certificate Checker

Copyright © 2022