The Java keytool is a command line utility provided with Java, and this article will guide you through the process of how to install keytool on both Windows and Linux. Keytool is used to manage keystores, symmetric and asymmetric keys, and certificates. Many applications and application servers use keystores in the form of the Java Keystore (JKS) or PKCS12 keystore, which can be maintained by the Java keytool.
The most important thing to understand is that keytool is not usually installed as a separate product. In most cases, to install keytool, you simply install a Java Development Kit (JDK). Once Java is installed and available in your PATH, the keytool command should be available as well.
This guide covers how to install keytool on Windows, Ubuntu, RHEL, and Rocky Linux. It also covers how to verify the installation, how to configure PATH and JAVA_HOME, and how to troubleshoot common issues such as keytool is not recognized or command not found.
If you are looking for more examples of how to use keytool after installation, visit our posts on how to use the java keytool.
Table of contents
- What is keytool?
- Install keytool on Windows
- Install keytool on Linux
- Set JAVA_HOME and PATH
- Verify the keytool installation
- Troubleshooting install keytool
- Frequently asked questions
What is keytool?
Keytool is the Java command line utility used to manage keys and certificates. It can create keystores, generate key pairs, list certificates, import trusted certificates, export certificates, and work with both JKS and PKCS12 keystore formats. If you manage Java applications, Tomcat, Spring Boot services, application servers, or TLS certificates for Java workloads, keytool is one of the most important Java security utilities to know.
Because keytool ships with Java, the process to install keytool is really the process of installing a JDK and making sure the Java binaries are accessible from your shell.
Install Keytool Windows
This example demonstrates how to install keytool on Windows. The same general process works on modern Windows versions, including Windows 10 and Windows 11.
If your Windows machine already has Java installed, you may already have keytool available. Open a command prompt and run the following command:
keytool --helpIf the command works, keytool is already installed and available in your PATH. If not, install a JDK first.
You can install the Java vendor of your choice. In your original example you used Amazon Corretto, which is a valid choice, but the broader concept is the same regardless of vendor: install a JDK, then verify that Java and keytool are available. For a vendor-neutral starting point, you can also refer to the official Java documentation for the keytool utility:
If you choose to install Amazon Corretto on Windows, download the installer package for your preferred version and run the installation wizard. Your existing screenshot is still useful here because it shows the type of installation flow users should expect.
Follow the installation wizard to complete the Java installation on Windows. After Java is installed, verify whether the installer automatically set the required environment variables. Some installers add Java to the PATH for you, while others may require manual configuration.
To verify Java was installed, run the following command:
java -versionThen verify keytool:
keytool --helpIf both commands work, your keytool install on Windows is complete.
Set JAVA_HOME on Windows
If Java installed successfully but keytool is still not recognized, check whether JAVA_HOME and the system PATH are configured correctly.
A typical JAVA_HOME value on Windows might look similar to this:
C:\Program Files\Java\jdk-21Or if you are using another JDK vendor, the path may reflect that vendor’s install location.
After setting JAVA_HOME, make sure the Java bin directory is also in your PATH. For example:
%JAVA_HOME%\binAfter updating environment variables, open a new command prompt and run java -version and keytool --help again.
Install Keytool Linux
This section demonstrates how to install keytool on Linux, specifically on Ubuntu, RHEL, and Rocky Linux. The main difference between Linux distributions is the package manager and package name used for the Java installation.
If your Linux machine already has Java installed, you may already have keytool available. Start by checking:
keytool --help
If the command works, keytool is already installed and available. If not, install a JDK using your package manager.
Install keytool on Ubuntu
On Ubuntu, a simple vendor-neutral way to install keytool is to install the default JDK:
sudo apt update
sudo apt install default-jdkIf you prefer a specific JDK vendor, you can install that vendor’s package instead, but for general Linux usage the default JDK is the most universal starting point.
Install keytool on RHEL and Rocky Linux
On RHEL and Rocky Linux, install an OpenJDK development package. For example:
sudo dnf install java-21-openjdk-develIf your environment standardizes on another supported Java version, adjust the package name accordingly.
After the package installation completes, verify Java:
java --versionThen verify keytool:
keytool --helpIf both commands work, keytool is installed and ready to use.
Optional example output
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
default-jdk is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.The exact output will vary by distribution and package version, but the goal is the same: confirm that Java is installed before trying to use keytool.
Set JAVA_HOME and PATH
In some environments, Java installs successfully but the shell still cannot find keytool. That usually means the PATH is not set correctly, or the expected Java installation is not the active one.
Check JAVA_HOME on Linux
You can inspect the current value of JAVA_HOME with:
echo $JAVA_HOMEIf it is not set, you can export it temporarily in your shell profile. For example:
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk
export PATH=$JAVA_HOME/bin:$PATHThe exact path may differ depending on your Linux distribution and JDK vendor. After updating your shell profile, open a new terminal and run java --version and keytool --help again.
Find the keytool binary directly
If you are unsure where keytool is installed, search for it directly.
Windows
where keytoolLinux
which keytoolIf the binary is found but not in your normal shell path, update PATH accordingly.
Verify the keytool installation
Once Java is installed, there are two simple checks to confirm your keytool install worked:
- Verify Java itself with
java -versionorjava --version - Verify keytool with
keytool --help
If those commands run successfully, you can begin using keytool commands such as listing keystore entries, importing certificates, exporting certificates, and creating key pairs.
For example, after installation you might continue with related tutorials such as listing keystore contents or working with PKCS12 files. Since PKCS12 is commonly used alongside keytool, your existing PKCS12 article is a strong related resource.
Troubleshooting install keytool
keytool is not recognized on Windows
If you receive an error such as keytool is not recognized as an internal or external command, Java is either not installed, or the Java bin directory is not in your PATH.
Check these items:
- Verify Java is installed with
java -version - Confirm
JAVA_HOMEpoints to the correct JDK directory - Confirm
%JAVA_HOME%\binis in PATH - Open a new command prompt after changing environment variables
keytool command not found on Linux
If Linux returns keytool: command not found, a JDK may not be installed, or the shell may not be using the expected Java location.
Check these items:
- Verify Java is installed with
java --version - Check the path to the binary with
which keytool - Set or correct
JAVA_HOME - Update PATH to include the active Java
bindirectory
Java is installed but keytool is missing
This usually happens when a runtime-only package is installed instead of a full JDK. If you installed only a JRE, install a JDK and test again.
Multiple Java versions are installed
On systems with more than one Java version installed, the active Java in your PATH may not be the one you expect. In that case, verify JAVA_HOME, verify the path returned by where keytool or which keytool, and make sure your shell is using the correct Java installation.
Related keytool resources
Frequently asked questions
How do I install keytool?
To install keytool, install a Java Development Kit. Keytool is usually included with the JDK, so you generally do not install it as a separate package.
Is keytool included with Java?
Yes. Keytool is included with standard JDK installations and is used to manage keystores, certificates, and keys.
How do I install keytool on Ubuntu?
Install a JDK package such as default-jdk, then verify the installation with java --version and keytool --help.
How do I install keytool on RHEL or Rocky Linux?
Install a JDK package such as java-21-openjdk-devel, then verify the installation by running java --version and keytool --help.
Why is keytool not recognized?
If keytool is not recognized, Java may not be installed, the wrong Java package may be installed, or PATH and JAVA_HOME may not be configured correctly.
Conclusion
This article demonstrated how to install keytool on both Windows and Linux, including Ubuntu, RHEL, and Rocky Linux. The main idea is simple: install a JDK, verify Java, and then verify the keytool command. Once that is working, you can begin managing keystores, certificates, and PKCS12 files with keytool.
If you would like to see more examples of how to install and use the Java keytool, let us know in the comments. Until then, visit all of our posts on how to use the java keytool for more examples.
Leave a Reply