1 '\" t

     1 .\"t

     2 .\" Copyright (c) 1998, 2015, Oracle and/or its affiliates. All rights reserved.

     2 .\" Copyright (c) 1994, 2019, Oracle and/or its affiliates. All rights reserved.

    23 .\"     Arch: generic

    23 .\" Automatically generated by Pandoc 2.3.1

    24 .\"     Software: JDK 8

    25 .\"     Date: 03 March 2015

    26 .\"     SectDesc: Security Tools

    27 .\"     Title: keytool.1

    29 .if n .pl 99999

    25 .TH "KEYTOOL" "1" "2019" "JDK 13" "JDK Commands"

    30 .TH keytool 1 "03 March 2015" "JDK 8" "Security Tools"

    26 .hy

    31 .\" -----------------------------------------------------------------

    27 .SH NAME

    32 .\" * Define some portability stuff

    28 .PP

    33 .\" -----------------------------------------------------------------

    29 keytool \- a key and certificate management utility

    34 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    30 .SH SYNOPSIS

    35 .\" http://bugs.debian.org/507673

    31 .PP

    36 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html

    32 \f[CB]keytool\f[R] [\f[I]commands\f[R]]

    37 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    33 .TP

    38 .ie \n(.g .ds Aq \(aq

    34 .B \f[I]commands\f[R]

    39 .el       .ds Aq '

    35 Commands for \f[CB]keytool\f[R] include the following:

    40 .\" -----------------------------------------------------------------

    36 .RS

    41 .\" * set default formatting

    37 .IP \[bu] 2

    42 .\" -----------------------------------------------------------------

    38 \f[CB]\-certreq\f[R]: Generates a certificate request

    43 .\" disable hyphenation

    39 .IP \[bu] 2

    44 .nh

    40 \f[CB]\-changealias\f[R]: Changes an entry\[aq]s alias

    45 .\" disable justification (adjust text to left margin only)

    41 .IP \[bu] 2

    46 .ad l

    42 \f[CB]\-delete\f[R]: Deletes an entry

    47 .\" -----------------------------------------------------------------

    43 .IP \[bu] 2

    48 .\" * MAIN CONTENT STARTS HERE *

    44 \f[CB]\-exportcert\f[R]: Exports certificate

    49 .\" -----------------------------------------------------------------

    45 .IP \[bu] 2

    46 \f[CB]\-genkeypair\f[R]: Generates a key pair

    47 .IP \[bu] 2

    48 \f[CB]\-genseckey\f[R]: Generates a secret key

    49 .IP \[bu] 2

    50 \f[CB]\-gencert\f[R]: Generates a certificate from a certificate request

    51 .IP \[bu] 2

    52 \f[CB]\-importcert\f[R]: Imports a certificate or a certificate chain

    53 .IP \[bu] 2

    54 \f[CB]\-importpass\f[R]: Imports a password

    55 .IP \[bu] 2

    56 \f[CB]\-importkeystore\f[R]: Imports one or all entries from another

    57 keystore

    58 .IP \[bu] 2

    59 \f[CB]\-keypasswd\f[R]: Changes the key password of an entry

    60 .IP \[bu] 2

    61 \f[CB]\-list\f[R]: Lists entries in a keystore

    62 .IP \[bu] 2

    63 \f[CB]\-printcert\f[R]: Prints the content of a certificate

    64 .IP \[bu] 2

    65 \f[CB]\-printcertreq\f[R]: Prints the content of a certificate request

    66 .IP \[bu] 2

    67 \f[CB]\-printcrl\f[R]: Prints the content of a Certificate Revocation List

    68 (CRL) file

    69 .IP \[bu] 2

    70 \f[CB]\-storepasswd\f[R]: Changes the store password of a keystore

    71 .IP \[bu] 2

    72 \f[CB]\-showinfo\f[R]: Displays security\-related information

    73 .PP

    74 See \f[B]Commands and Options\f[R] for a description of these commands

    75 with their options.

    76 .RE

    77 .SH DESCRIPTION

    78 .PP

    79 The \f[CB]keytool\f[R] command is a key and certificate management

    80 utility.

    81 It enables users to administer their own public/private key pairs and

    82 associated certificates for use in self\-authentication (where a user

    83 authenticates themselves to other users and services) or data integrity

    84 and authentication services, by using digital signatures.

    85 The \f[CB]keytool\f[R] command also enables users to cache the public keys

    86 (in the form of certificates) of their communicating peers.

    87 .PP

    88 A certificate is a digitally signed statement from one entity (person,

    89 company, and so on), which says that the public key (and some other

    90 information) of some other entity has a particular value.

    91 When data is digitally signed, the signature can be verified to check

    92 the data integrity and authenticity.

    93 Integrity means that the data hasn\[aq]t been modified or tampered with,

    94 and authenticity means that the data comes from the individual who

    95 claims to have created and signed it.

    96 .PP

    97 The \f[CB]keytool\f[R] command also enables users to administer secret

    98 keys and passphrases used in symmetric encryption and decryption (Data

    99 Encryption Standard).

   100 It can also display other security\-related information.

   101 .PP

   102 The \f[CB]keytool\f[R] command stores the keys and certificates in a

   103 keystore.

   104 .SH COMMAND AND OPTION NOTES

   105 .PP

   106 The following notes apply to the descriptions in \f[B]Commands and

   107 Options\f[R]:

   108 .IP \[bu] 2

   109 All command and option names are preceded by a hyphen sign

   110 (\f[CB]\-\f[R]).

   111 .IP \[bu] 2

   112 Only one command can be provided.

   113 .IP \[bu] 2

   114 Options for each command can be provided in any order.

   115 .IP \[bu] 2

   116 There are two kinds of options, one is single\-valued which should be

   117 only provided once.

   118 If a single\-valued option is provided multiple times, the value of the

   119 last one is used.

   120 The other type is multi\-valued, which can be provided multiple times

   121 and all values are used.

   122 The only multi\-valued option currently supported is the \f[CB]\-ext\f[R]

   123 option used to generate X.509v3 certificate extensions.

   124 .IP \[bu] 2

   125 All items not italicized or in braces ({ }) or brackets ([ ]) are

   126 required to appear as is.

   127 .IP \[bu] 2

   128 Braces surrounding an option signify that a default value is used when

   129 the option isn\[aq]t specified on the command line.

   130 Braces are also used around the \f[CB]\-v\f[R], \f[CB]\-rfc\f[R], and

   131 \f[CB]\-J\f[R] options, which have meaning only when they appear on the

   132 command line.

   133 They don\[aq]t have any default values.

   134 .IP \[bu] 2

   135 Brackets surrounding an option signify that the user is prompted for the

   136 values when the option isn\[aq]t specified on the command line.

   137 For the \f[CB]\-keypass\f[R] option, if you don\[aq]t specify the option

   138 on the command line, then the \f[CB]keytool\f[R] command first attempts to

   139 use the keystore password to recover the private/secret key.

   140 If this attempt fails, then the \f[CB]keytool\f[R] command prompts you for

   141 the private/secret key password.

   142 .IP \[bu] 2

   143 Items in italics (option values) represent the actual values that must

   144 be supplied.

   145 For example, here is the format of the \f[CB]\-printcert\f[R] command:

   146 .RS 2

   147 .RS

   148 .PP

   149 \f[CB]keytool\ \-printcert\f[R] {\f[CB]\-file\f[R] \f[I]cert_file\f[R]}

   150 {\f[CB]\-v\f[R]}

   151 .RE

   152 .PP

   153 When you specify a \f[CB]\-printcert\f[R] command, replace

   154 \f[I]cert_file\f[R] with the actual file name, as follows:

   155 \f[CB]keytool\ \-printcert\ \-file\ VScert.cer\f[R]

   156 .RE

   157 .IP \[bu] 2

   158 Option values must be enclosed in quotation marks when they contain a

   159 blank (space).

   160 .SH COMMANDS AND OPTIONS

   161 .PP

   162 The keytool commands and their options can be grouped by the tasks that

   163 they perform.

   164 .PP

   165 \f[B]Commands for Creating or Adding Data to the Keystore\f[R]:

   166 .IP \[bu] 2

   167 \f[CB]\-gencert\f[R]

   168 .IP \[bu] 2

   169 \f[CB]\-genkeypair\f[R]

   170 .IP \[bu] 2

   171 \f[CB]\-genseckey\f[R]

   172 .IP \[bu] 2

   173 \f[CB]\-importcert\f[R]

   174 .IP \[bu] 2

   175 \f[CB]\-importpass\f[R]

   176 .PP

   177 \f[B]Commands for Importing Contents from Another Keystore\f[R]:

   178 .IP \[bu] 2

   179 \f[CB]\-importkeystore\f[R]

   180 .PP

   181 \f[B]Commands for Generating a Certificate Request\f[R]:

   182 .IP \[bu] 2

   183 \f[CB]\-certreq\f[R]

   184 .PP

   185 \f[B]Commands for Exporting Data\f[R]:

   186 .IP \[bu] 2

   187 \f[CB]\-exportcert\f[R]

   188 .PP

   189 \f[B]Commands for Displaying Data\f[R]:

   190 .IP \[bu] 2

   191 \f[CB]\-list\f[R]

   192 .IP \[bu] 2

   193 \f[CB]\-printcert\f[R]

   194 .IP \[bu] 2

   195 \f[CB]\-printcertreq\f[R]

   196 .IP \[bu] 2

   197 \f[CB]\-printcrl\f[R]

   198 .PP

   199 \f[B]Commands for Managing the Keystore\f[R]:

   200 .IP \[bu] 2

   201 \f[CB]\-storepasswd\f[R]

   202 .IP \[bu] 2

   203 \f[CB]\-keypasswd\f[R]

   204 .IP \[bu] 2

   205 \f[CB]\-delete\f[R]

   206 .IP \[bu] 2

   207 \f[CB]\-changealias\f[R]

   208 .PP

   209 \f[B]Commands for Displaying Security\-related Information\f[R]:

   210 .IP \[bu] 2

   211 \f[CB]\-showinfo\f[R]

   212 .SH COMMANDS FOR CREATING OR ADDING DATA TO THE KEYSTORE

   213 .TP

   214 .B \f[CB]\-gencert\f[R]

   215 The following are the available options for the \f[CB]\-gencert\f[R]

   216 command:

   217 .RS

   218 .IP \[bu] 2

   219 {\f[CB]\-rfc\f[R]}: Output in RFC (Request For Comment) style

   220 .IP \[bu] 2

   221 {\f[CB]\-infile\f[R] \f[I]infile\f[R]}: Input file name

   222 .IP \[bu] 2

   223 {\f[CB]\-outfile\f[R] \f[I]outfile\f[R]}: Output file name

   224 .IP \[bu] 2

   225 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   226 .IP \[bu] 2

   227 {\f[CB]\-sigalg\f[R] \f[I]sigalg\f[R]}: Signature algorithm name

   228 .IP \[bu] 2

   229 {\f[CB]\-dname\f[R] \f[I]dname\f[R]}: Distinguished name

   230 .IP \[bu] 2

   231 {\f[CB]\-startdate\f[R] \f[I]startdate\f[R]}: Certificate validity start

   232 date and time

   233 .IP \[bu] 2

   234 {\f[CB]\-ext\f[R] \f[I]ext\f[R]}*: X.509 extension

   235 .IP \[bu] 2

   236 {\f[CB]\-validity\f[R] \f[I]days\f[R]}: Validity number of days

   237 .IP \[bu] 2

   238 [\f[CB]\-keypass\f[R] \f[I]arg\f[R]]: Key password

   239 .IP \[bu] 2

   240 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   241 .IP \[bu] 2

   242 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   243 .IP \[bu] 2

   244 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   245 .IP \[bu] 2

   246 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   247 .IP \[bu] 2

   248 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   249 \f[I]arg\f[R]]}: Adds a security provider by name (such as SunPKCS11)

   250 with an optional configure argument.

   251 The value of the security provider is the name of a security provider

   252 that is defined in a module.

   253 .RS 2

   254 .PP

   255 For example,

   256 .RS

   257 .PP

   258 \f[CB]keytool\ \-addprovider\ SunPKCS11\ \-providerarg\ some.cfg\ ...\f[R]

   259 .RE

   260 .PP

   261 \f[B]Note:\f[R]

   262 .PP

   263 For compatibility reasons, the SunPKCS11 and OracleUcrypto providers can

   264 still be loaded with

   265 \f[CB]\-providerclass\ sun.security.pkcs11.SunPKCS11\f[R] and

   266 \f[CB]\-providerclass\ com.oracle.security.crypto.UcryptoProvider\f[R]

   267 even if they are now defined in modules.

   268 These are the only modules included in JDK that need a configuration,

   269 and therefore the most widely used with the \f[CB]\-providerclass\f[R]

   270 option.

   271 For legacy security providers located on classpath and loaded by

   272 reflection, \f[CB]\-providerclass\f[R] should still be used.

   273 .RE

   274 .IP \[bu] 2

   275 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   276 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

   277 an optional configure argument.

   278 .RS 2

   279 .PP

   280 For example, if \f[CB]MyProvider\f[R] is a legacy provider loaded via

   281 reflection,

   282 .RS

   283 .PP

   284 \f[CB]keytool\ \-providerclass\ com.example.MyProvider\ ...\f[R]

   285 .RE

   286 .RE

   287 .IP \[bu] 2

   288 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   289 .IP \[bu] 2

   290 {\f[CB]\-v\f[R]}: Verbose output

   291 .IP \[bu] 2

   292 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   293 .PP

   294 Use the \f[CB]\-gencert\f[R] command to generate a certificate as a

   295 response to a certificate request file (which can be created by the

   296 \f[CB]keytool\ \-certreq\f[R] command).

   297 The command reads the request either from \f[I]infile\f[R] or, if

   298 omitted, from the standard input, signs it by using the alias\[aq]s

   299 private key, and outputs the X.509 certificate into either

   300 \f[I]outfile\f[R] or, if omitted, to the standard output.

   301 When \f[CB]\-rfc\f[R] is specified, the output format is Base64\-encoded

   302 PEM; otherwise, a binary DER is created.

   303 .PP

   304 The \f[CB]\-sigalg\f[R] value specifies the algorithm that should be used

   305 to sign the certificate.

   306 The \f[I]startdate\f[R] argument is the start time and date that the

   307 certificate is valid.

   308 The \f[I]days\f[R] argument tells the number of days for which the

   309 certificate should be considered valid.

   310 .PP

   311 When \f[I]dname\f[R] is provided, it is used as the subject of the

   312 generated certificate.

   313 Otherwise, the one from the certificate request is used.

   314 .PP

   315 The \f[CB]\-ext\f[R] value shows what X.509 extensions will be embedded in

   316 the certificate.

   317 Read \f[B]Common Command Options\f[R] for the grammar of \f[CB]\-ext\f[R].

   318 .PP

   319 The \f[CB]\-gencert\f[R] option enables you to create certificate chains.

   320 The following example creates a certificate, \f[CB]e1\f[R], that contains

   321 three certificates in its certificate chain.

   322 .PP

   323 The following commands creates four key pairs named \f[CB]ca\f[R],

   324 \f[CB]ca1\f[R], \f[CB]ca2\f[R], and \f[CB]e1\f[R]:

   325 .IP

   326 .nf

   327 \f[CB]

   328 keytool\ \-alias\ ca\ \-dname\ CN=CA\ \-genkeypair

   329 keytool\ \-alias\ ca1\ \-dname\ CN=CA\ \-genkeypair

   330 keytool\ \-alias\ ca2\ \-dname\ CN=CA\ \-genkeypair

   331 keytool\ \-alias\ e1\ \-dname\ CN=E1\ \-genkeypair

   332 \f[R]

   333 .fi

   334 .PP

   335 The following two commands create a chain of signed certificates;

   336 \f[CB]ca\f[R] signs \f[CB]ca1\f[R] and \f[CB]ca1\f[R] signs \f[CB]ca2\f[R], all

   337 of which are self\-issued:

   338 .IP

   339 .nf

   340 \f[CB]

   341 keytool\ \-alias\ ca1\ \-certreq\ |

   342 \ \ \ \ keytool\ \-alias\ ca\ \-gencert\ \-ext\ san=dns:ca1\ |

   343 \ \ \ \ keytool\ \-alias\ ca1\ \-importcert

    51 .SH NAME    

   345 keytool\ \-alias\ ca2\ \-certreq\ |

    52 keytool \- Manages a keystore (database) of cryptographic keys, X\&.509 certificate chains, and trusted certificates\&.

   346 \ \ \ \ keytool\ \-alias\ ca1\ \-gencert\ \-ext\ san=dns:ca2\ |

    53 .SH SYNOPSIS    

   347 \ \ \ \ keytool\ \-alias\ ca2\ \-importcert

    54 .sp     

   348 \f[R]

    55 .nf     

   349 .fi

   350 .PP

   351 The following command creates the certificate \f[CB]e1\f[R] and stores it

   352 in the \f[CB]e1.cert\f[R] file, which is signed by \f[CB]ca2\f[R].

   353 As a result, \f[CB]e1\f[R] should contain \f[CB]ca\f[R], \f[CB]ca1\f[R], and

   354 \f[CB]ca2\f[R] in its certificate chain:

   355 .RS

   356 .PP

   357 \f[CB]keytool\ \-alias\ e1\ \-certreq\ |\ keytool\ \-alias\ ca2\ \-gencert\ >\ e1.cert\f[R]

   358 .RE

   359 .RE

   360 .TP

   361 .B \f[CB]\-genkeypair\f[R]

   362 The following are the available options for the \f[CB]\-genkeypair\f[R]

   363 command:

   364 .RS

   365 .IP \[bu] 2

   366 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   367 .IP \[bu] 2

   368 {\f[CB]\-keyalg\f[R] \f[I]alg\f[R]}: Key algorithm name

   369 .IP \[bu] 2

   370 {\f[CB]\-keysize\f[R] \f[I]size\f[R]}: Key bit size

   371 .IP \[bu] 2

   372 {\f[CB]\-groupname\f[R] \f[I]name\f[R]}: Group name.

   373 For example, an Elliptic Curve name.

   374 .IP \[bu] 2

   375 {\f[CB]\-sigalg\f[R] \f[I]alg\f[R]}: Signature algorithm name

   376 .IP \[bu] 2

   377 [\f[CB]\-dname\f[R] \f[I]name\f[R]]: Distinguished name

   378 .IP \[bu] 2

   379 {\f[CB]\-startdate\f[R] \f[I]date\f[R]}: Certificate validity start date

   380 and time

   381 .IP \[bu] 2

   382 [\f[CB]\-ext\f[R] \f[I]value\f[R]}*: X.509 extension

   383 .IP \[bu] 2

   384 {\f[CB]\-validity\f[R] \f[I]days\f[R]}: Validity number of days

   385 .IP \[bu] 2

   386 [\f[CB]\-keypass\f[R] \f[I]arg\f[R]]: Key password

   387 .IP \[bu] 2

   388 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   389 .IP \[bu] 2

   390 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   391 .IP \[bu] 2

   392 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   393 .IP \[bu] 2

   394 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   395 .IP \[bu] 2

   396 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   397 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   398 an optional configure argument.

   399 .IP \[bu] 2

   400 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   401 \f[I]arg\f[R]] }: Add security provider by fully qualified class name

   402 with an optional configure argument.

   403 .IP \[bu] 2

   404 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   405 .IP \[bu] 2

   406 {\f[CB]\-v\f[R]}: Verbose output

   407 .IP \[bu] 2

   408 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   409 .PP

   410 Use the \f[CB]\-genkeypair\f[R] command to generate a key pair (a public

   411 key and associated private key).

   412 Wraps the public key in an X.509 v3 self\-signed certificate, which is

   413 stored as a single\-element certificate chain.

   414 This certificate chain and the private key are stored in a new keystore

   415 entry that is identified by its alias.

   416 .PP

   417 The \f[CB]\-keyalg\f[R] value specifies the algorithm to be used to

   418 generate the key pair, and the \f[CB]\-keysize\f[R] value specifies the

   419 size of each key to be generated.

   420 The \f[CB]\-sigalg\f[R] value specifies the algorithm that should be used

   421 to sign the self\-signed certificate.

   422 This algorithm must be compatible with the \f[CB]\-keyalg\f[R] value.

   423 .PP

   424 The \f[CB]\-groupname\f[R] value specifies the named group (for example,

   425 the standard or predefined name of an Elliptic Curve) of the key to be

   426 generated.

   427 Only one of \f[CB]\-groupname\f[R] and \f[CB]\-keysize\f[R] can be

   428 specified.

   429 .PP

   430 The \f[CB]\-dname\f[R] value specifies the X.500 Distinguished Name to be

   431 associated with the value of \f[CB]\-alias\f[R], and is used as the issuer

   432 and subject fields in the self\-signed certificate.

   433 If a distinguished name is not provided at the command line, then the

   434 user is prompted for one.

   435 .PP

   436 The value of \f[CB]\-keypass\f[R] is a password used to protect the

   437 private key of the generated key pair.

   438 If a password is not provided, then the user is prompted for it.

   439 If you press the \f[B]Return\f[R] key at the prompt, then the key

   440 password is set to the same password as the keystore password.

   441 The \f[CB]\-keypass\f[R] value must have at least six characters.

   442 .PP

   443 The value of \f[CB]\-startdate\f[R] specifies the issue time of the

   444 certificate, also known as the "Not Before" value of the X.509

   445 certificate\[aq]s Validity field.

   446 .PP

   447 The option value can be set in one of these two forms:

   448 .PP

   449 ([\f[CB]+\-\f[R]]\f[I]nnn\f[R][\f[CB]ymdHMS\f[R]])+

   450 .PP

   451 [\f[I]yyyy\f[R]\f[CB]/\f[R]\f[I]mm\f[R]\f[CB]/\f[R]\f[I]dd\f[R]]

   452 [\f[I]HH\f[R]\f[CB]:\f[R]\f[I]MM\f[R]\f[CB]:\f[R]\f[I]SS\f[R]]

   453 .PP

   454 With the first form, the issue time is shifted by the specified value

   455 from the current time.

   456 The value is a concatenation of a sequence of subvalues.

   457 Inside each subvalue, the plus sign (+) means shift forward, and the

   458 minus sign (\-) means shift backward.

   459 The time to be shifted is \f[I]nnn\f[R] units of years, months, days,

   460 hours, minutes, or seconds (denoted by a single character of \f[CB]y\f[R],

   461 \f[CB]m\f[R], \f[CB]d\f[R], \f[CB]H\f[R], \f[CB]M\f[R], or \f[CB]S\f[R]

   462 respectively).

   463 The exact value of the issue time is calculated by using the

   464 \f[CB]java.util.GregorianCalendar.add(int\ field,\ int\ amount)\f[R]

   465 method on each subvalue, from left to right.

   466 For example, the issue time can be specified by:

   467 .IP

   468 .nf

   469 \f[CB]

   470 Calendar\ c\ =\ new\ GregorianCalendar();

   471 c.add(Calendar.YEAR,\ \-1);

   472 c.add(Calendar.MONTH,\ 1);

   473 c.add(Calendar.DATE,\ \-1);

   474 return\ c.getTime()

   475 \f[R]

   476 .fi

   477 .PP

   478 With the second form, the user sets the exact issue time in two parts,

   479 year/month/day and hour:minute:second (using the local time zone).

   480 The user can provide only one part, which means the other part is the

   481 same as the current date (or time).

   482 The user must provide the exact number of digits shown in the format

   483 definition (padding with 0 when shorter).

   484 When both date and time are provided, there is one (and only one) space

   485 character between the two parts.

   486 The hour should always be provided in 24\-hour format.

   487 .PP

   488 When the option isn\[aq]t provided, the start date is the current time.

   489 The option can only be provided one time.

   490 .PP

   491 The value of \f[I]date\f[R] specifies the number of days (starting at the

   492 date specified by \f[CB]\-startdate\f[R], or the current date when

   493 \f[CB]\-startdate\f[R] isn\[aq]t specified) for which the certificate

   494 should be considered valid.

   495 .RE

   496 .TP

   497 .B \f[CB]\-genseckey\f[R]

   498 The following are the available options for the \f[CB]\-genseckey\f[R]

   499 command:

   500 .RS

   501 .IP \[bu] 2

   502 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   503 .IP \[bu] 2

   504 [\f[CB]\-keypass\f[R] \f[I]arg\f[R]]: Key password

   505 .IP \[bu] 2

   506 {\f[CB]\-keyalg\f[R] \f[I]alg\f[R]}: Key algorithm name

   507 .IP \[bu] 2

   508 {\f[CB]\-keysize\f[R] \f[I]size\f[R]}: Key bit size

   509 .IP \[bu] 2

   510 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   511 .IP \[bu] 2

   512 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   513 .IP \[bu] 2

   514 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   515 .IP \[bu] 2

   516 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   517 .IP \[bu] 2

   518 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   519 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   520 an optional configure argument.

   521 .IP \[bu] 2

   522 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   523 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

   524 an optional configure argument.

   525 .IP \[bu] 2

   526 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   527 .IP \[bu] 2

   528 {\f[CB]\-v\f[R]}: Verbose output

   529 .IP \[bu] 2

   530 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   531 .PP

   532 Use the \f[CB]\-genseckey\f[R] command to generate a secret key and store

   533 it in a new \f[CB]KeyStore.SecretKeyEntry\f[R] identified by

   534 \f[CB]alias\f[R].

   535 .PP

   536 The value of \f[CB]\-keyalg\f[R] specifies the algorithm to be used to

   537 generate the secret key, and the value of \f[CB]\-keysize\f[R] specifies

   538 the size of the key that is generated.

   539 The \f[CB]\-keypass\f[R] value is a password that protects the secret key.

   540 If a password is not provided, then the user is prompted for it.

   541 If you press the \f[B]Return\f[R] key at the prompt, then the key

   542 password is set to the same password that is used for the

   543 \f[CB]\-keystore\f[R].

   544 The \f[CB]\-keypass\f[R] value must contain at least six characters.

   545 .RE

   546 .TP

   547 .B \f[CB]\-importcert\f[R]

   548 The following are the available options for the \f[CB]\-importcert\f[R]

   549 command:

   550 .RS

   551 .IP \[bu] 2

   552 {\f[CB]\-noprompt\f[R]}: Do not prompt

   553 .IP \[bu] 2

   554 {\f[CB]\-trustcacerts\f[R]}: Trust certificates from cacerts

   555 .IP \[bu] 2

   556 {\f[CB]\-protected\f[R]}: Password is provided through protected mechanism

   557 .IP \[bu] 2

   558 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   559 .IP \[bu] 2

   560 {\f[CB]\-file\f[R] \f[I]file\f[R]}: Input file name

   561 .IP \[bu] 2

   562 [\f[CB]\-keypass\f[R] \f[I]arg\f[R]]: Key password

   563 .IP \[bu] 2

   564 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   565 .IP \[bu] 2

   566 {\f[CB]\-cacerts\f[R]}: Access the cacerts keystore

   567 .IP \[bu] 2

   568 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   569 .IP \[bu] 2

   570 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   571 .IP \[bu] 2

   572 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   573 .IP \[bu] 2

   574 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   575 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   576 an optional configure argument.

   577 .IP \[bu] 2

   578 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   579 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

   580 an optional configure argument.

   581 .IP \[bu] 2

   582 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   583 .IP \[bu] 2

   584 {\f[CB]\-v\f[R]}: Verbose output

   585 .PP

   586 Use the \f[CB]\-importcert\f[R] command to read the certificate or

   587 certificate chain (where the latter is supplied in a PKCS#7 formatted

   588 reply or in a sequence of X.509 certificates) from \f[CB]\-file\f[R]

   589 \f[I]file\f[R], and store it in the \f[CB]keystore\f[R] entry identified by

   590 \f[CB]\-alias\f[R].

   591 If \f[CB]\-file\f[R] \f[I]file\f[R] is not specified, then the certificate

   592 or certificate chain is read from \f[CB]stdin\f[R].

   593 .PP

   594 The \f[CB]keytool\f[R] command can import X.509 v1, v2, and v3

   595 certificates, and PKCS#7 formatted certificate chains consisting of

   596 certificates of that type.

   597 The data to be imported must be provided either in binary encoding

   598 format or in printable encoding format (also known as Base64 encoding)

   599 as defined by the Internet RFC 1421 standard.

   600 In the latter case, the encoding must be bounded at the beginning by a

   601 string that starts with \f[CB]\-\-\-\-\-BEGIN\f[R], and bounded at the end

   602 by a string that starts with \f[CB]\-\-\-\-\-END\f[R].

   603 .PP

   604 You import a certificate for two reasons: To add it to the list of

   605 trusted certificates, and to import a certificate reply received from a

   606 certificate authority (CA) as the result of submitting a Certificate

   607 Signing Request (CSR) to that CA.

   608 See the \f[CB]\-certreq\f[R] command in \f[B]Commands for Generating a

   609 Certificate Request\f[R].

   610 .PP

   611 The type of import is indicated by the value of the \f[CB]\-alias\f[R]

   612 option.

   613 If the alias doesn\[aq]t point to a key entry, then the \f[CB]keytool\f[R]

   614 command assumes you are adding a trusted certificate entry.

   615 In this case, the alias shouldn\[aq]t already exist in the keystore.

   616 If the alias does exist, then the \f[CB]keytool\f[R] command outputs an

   617 error because a trusted certificate already exists for that alias, and

   618 doesn\[aq]t import the certificate.

   619 If \f[CB]\-alias\f[R] points to a key entry, then the \f[CB]keytool\f[R]

   620 command assumes that you\[aq]re importing a certificate reply.

   621 .RE

   622 .TP

   623 .B \f[CB]\-importpass\f[R]

   624 The following are the available options for the \f[CB]\-importpass\f[R]

   625 command:

   626 .RS

   627 .IP \[bu] 2

   628 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   629 .IP \[bu] 2

   630 [\f[CB]\-keypass\f[R] \f[I]arg\f[R]]: Key password

   631 .IP \[bu] 2

   632 {\f[CB]\-keyalg\f[R] \f[I]alg\f[R]}: Key algorithm name

   633 .IP \[bu] 2

   634 {\f[CB]\-keysize\f[R] \f[I]size\f[R]}: Key bit size

   635 .IP \[bu] 2

   636 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   637 .IP \[bu] 2

   638 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   639 .IP \[bu] 2

   640 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   641 .IP \[bu] 2

   642 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   643 .IP \[bu] 2

   644 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   645 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   646 an optional configure argument.

   647 .IP \[bu] 2

   648 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   649 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

   650 an optional configure argument.

   651 .IP \[bu] 2

   652 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   653 .IP \[bu] 2

   654 {\f[CB]\-v\f[R]}: Verbose output

   655 .IP \[bu] 2

   656 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   657 .PP

   658 Use the \f[CB]\-importpass\f[R] command to imports a passphrase and store

   659 it in a new \f[CB]KeyStore.SecretKeyEntry\f[R] identified by

   660 \f[CB]\-alias\f[R].

   661 The passphrase may be supplied via the standard input stream; otherwise

   662 the user is prompted for it.

   663 The \f[CB]\-keypass\f[R] option provides a password to protect the

   664 imported passphrase.

   665 If a password is not provided, then the user is prompted for it.

   666 If you press the \f[B]Return\f[R] key at the prompt, then the key

   667 password is set to the same password as that used for the

   668 \f[CB]keystore\f[R].

   669 The \f[CB]\-keypass\f[R] value must contain at least six characters.

   670 .RE

   671 .SH COMMANDS FOR IMPORTING CONTENTS FROM ANOTHER KEYSTORE

   672 .TP

   673 .B \f[CB]\-importkeystore\f[R]

   674 The following are the available options for the

   675 \f[CB]\-importkeystore\f[R] command:

   676 .RS

   677 .IP \[bu] 2

   678 {\f[CB]\-srckeystore\f[R] \f[I]keystore\f[R]}: Source keystore name

   679 .IP \[bu] 2

   680 {\f[CB]\-destkeystore\f[R] \f[I]keystore\f[R]}: Destination keystore name

   681 .IP \[bu] 2

   682 {\f[CB]\-srcstoretype\f[R] \f[I]type\f[R]}: Source keystore type

   683 .IP \[bu] 2

   684 {\f[CB]\-deststoretype\f[R] \f[I]type\f[R]}: Destination keystore type

   685 .IP \[bu] 2

   686 [\f[CB]\-srcstorepass\f[R] \f[I]arg\f[R]]: Source keystore password

   687 .IP \[bu] 2

   688 [\f[CB]\-deststorepass\f[R] \f[I]arg\f[R]]: Destination keystore password

   689 .IP \[bu] 2

   690 {\f[CB]\-srcprotected\f[R]}: Source keystore password protected

   691 .IP \[bu] 2

   692 {\f[CB]\-destprotected\f[R]}: Destination keystore password protected

   693 .IP \[bu] 2

   694 {\f[CB]\-srcprovidername\f[R] \f[I]name\f[R]}: Source keystore provider

   695 name

   696 .IP \[bu] 2

   697 {\f[CB]\-destprovidername\f[R] \f[I]name\f[R]}: Destination keystore

   698 provider name

   699 .IP \[bu] 2

   700 {\f[CB]\-srcalias\f[R] \f[I]alias\f[R]}: Source alias

   701 .IP \[bu] 2

   702 {\f[CB]\-destalias\f[R] \f[I]alias\f[R]}: Destination alias

   703 .IP \[bu] 2

   704 [\f[CB]\-srckeypass\f[R] \f[I]arg\f[R]]: Source key password

   705 .IP \[bu] 2

   706 [\f[CB]\-destkeypass\f[R] \f[I]arg\f[R]]: Destination key password

   707 .IP \[bu] 2

   708 {\f[CB]\-noprompt\f[R]}: Do not prompt

   709 .IP \[bu] 2

   710 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   711 \f[I]arg\f[R]]: Add security provider by name (such as SunPKCS11) with an

   712 optional configure argument.

   713 .IP \[bu] 2

   714 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   715 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

   716 an optional configure argument

   717 .IP \[bu] 2

   718 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   719 .IP \[bu] 2

   720 {\f[CB]\-v\f[R]}: Verbose output

   721 .PP

   722 \f[B]Note:\f[R]

   723 .PP

   724 This is the first line of all options:

   725 .RS

   726 .PP

   727 \f[CB]\-srckeystore\f[R] \f[I]keystore\f[R] \f[CB]\-destkeystore\f[R]

   728 \f[I]keystore\f[R]

   729 .RE

   730 .PP

   731 Use the \f[CB]\-importkeystore\f[R] command to import a single entry or

   732 all entries from a source keystore to a destination keystore.

   733 .PP

   734 \f[B]Note:\f[R]

   735 .PP

   736 If you do not specify \f[CB]\-destkeystore\f[R] when using the

   737 \f[CB]keytool\ \-importkeystore\f[R] command, then the default keystore

   738 used is \f[CB]$HOME/.keystore\f[R].

   739 .PP

   740 When the \f[CB]\-srcalias\f[R] option is provided, the command imports the

   741 single entry identified by the alias to the destination keystore.

   742 If a destination alias isn\[aq]t provided with \f[CB]\-destalias\f[R],

   743 then \f[CB]\-srcalias\f[R] is used as the destination alias.

   744 If the source entry is protected by a password, then

   745 \f[CB]\-srckeypass\f[R] is used to recover the entry.

   746 If \f[CB]\-srckeypass\f[R] isn\[aq]t provided, then the \f[CB]keytool\f[R]

   747 command attempts to use \f[CB]\-srcstorepass\f[R] to recover the entry.

   748 If \f[CB]\-srcstorepass\f[R] is not provided or is incorrect, then the

   749 user is prompted for a password.

   750 The destination entry is protected with \f[CB]\-destkeypass\f[R].

   751 If \f[CB]\-destkeypass\f[R] isn\[aq]t provided, then the destination entry

   752 is protected with the source entry password.

   753 For example, most third\-party tools require \f[CB]storepass\f[R] and

   754 \f[CB]keypass\f[R] in a PKCS #12 keystore to be the same.

   755 To create a PKCS#12 keystore for these tools, always specify a

   756 \f[CB]\-destkeypass\f[R] that is the same as \f[CB]\-deststorepass\f[R].

   757 .PP

   758 If the \f[CB]\-srcalias\f[R] option isn\[aq]t provided, then all entries

   759 in the source keystore are imported into the destination keystore.

   760 Each destination entry is stored under the alias from the source entry.

   761 If the source entry is protected by a password, then

   762 \f[CB]\-srcstorepass\f[R] is used to recover the entry.

   763 If \f[CB]\-srcstorepass\f[R] is not provided or is incorrect, then the

   764 user is prompted for a password.

   765 If a source keystore entry type isn\[aq]t supported in the destination

   766 keystore, or if an error occurs while storing an entry into the

   767 destination keystore, then the user is prompted either to skip the entry

   768 and continue or to quit.

   769 The destination entry is protected with the source entry password.

   770 .PP

   771 If the destination alias already exists in the destination keystore,

   772 then the user is prompted either to overwrite the entry or to create a

   773 new entry under a different alias name.

   774 .PP

   775 If the \f[CB]\-noprompt\f[R] option is provided, then the user isn\[aq]t

   776 prompted for a new destination alias.

   777 Existing entries are overwritten with the destination alias name.

   778 Entries that can\[aq]t be imported are skipped and a warning is

   779 displayed.

   780 .RE

   781 .SH COMMANDS FOR GENERATING A CERTIFICATE REQUEST

   782 .TP

   783 .B \f[CB]\-certreq\f[R]

   784 The following are the available options for the \f[CB]\-certreq\f[R]

   785 command:

   786 .RS

   787 .IP \[bu] 2

   788 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   789 .IP \[bu] 2

   790 {\f[CB]\-sigalg\f[R] \f[I]alg\f[R]}: Signature algorithm name

   791 .IP \[bu] 2

   792 {\f[CB]\-file\f[R] \f[I]file\f[R]}: Output file name

   793 .IP \[bu] 2

   794 [ \f[CB]\-keypass\f[R] \f[I]arg\f[R]]: Key password

   795 .IP \[bu] 2

   796 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   797 .IP \[bu] 2

   798 {\f[CB]\-dname\f[R] \f[I]name\f[R]}: Distinguished name

   799 .IP \[bu] 2

   800 {\f[CB]\-ext\f[R] \f[I]value\f[R]}: X.509 extension

   801 .IP \[bu] 2

   802 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   803 .IP \[bu] 2

   804 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   805 .IP \[bu] 2

   806 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   807 .IP \[bu] 2

   808 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   809 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   810 an optional configure argument.

   811 .IP \[bu] 2

   812 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   813 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

   814 an optional configure argument.

   815 .IP \[bu] 2

   816 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   817 .IP \[bu] 2

   818 {\f[CB]\-v\f[R]}: Verbose output

   819 .IP \[bu] 2

   820 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   821 .PP

   822 Use the \f[CB]\-certreq\f[R] command to generate a Certificate Signing

   823 Request (CSR) using the PKCS #10 format.

   824 .PP

   825 A CSR is intended to be sent to a CA.

   826 The CA authenticates the certificate requestor (usually offline) and

   827 returns a certificate or certificate chain to replace the existing

   828 certificate chain (initially a self\-signed certificate) in the

   829 keystore.

   830 .PP

   831 The private key associated with \f[I]alias\f[R] is used to create the

   832 PKCS #10 certificate request.

   833 To access the private key, the correct password must be provided.

   834 If \f[CB]\-keypass\f[R] isn\[aq]t provided at the command line and is

   835 different from the password used to protect the integrity of the

   836 keystore, then the user is prompted for it.

   837 If \f[CB]\-dname\f[R] is provided, then it is used as the subject in the

   838 CSR.

   839 Otherwise, the X.500 Distinguished Name associated with alias is used.

   840 .PP

   841 The \f[CB]\-sigalg\f[R] value specifies the algorithm that should be used

   842 to sign the CSR.

   843 .PP

   844 The CSR is stored in the \f[CB]\-file\f[R] \f[I]file\f[R].

   845 If a file is not specified, then the CSR is output to \f[CB]\-stdout\f[R].

   846 .PP

   847 Use the \f[CB]\-importcert\f[R] command to import the response from the

   848 CA.

   849 .RE

   850 .SH COMMANDS FOR EXPORTING DATA

   851 .TP

   852 .B \f[CB]\-exportcert\f[R]

   853 The following are the available options for the \f[CB]\-exportcert\f[R]

   854 command:

   855 .RS

   856 .IP \[bu] 2

   857 {\f[CB]\-rfc\f[R]}: Output in RFC style

   858 .IP \[bu] 2

   859 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   860 .IP \[bu] 2

   861 {\f[CB]\-file\f[R] \f[I]file\f[R]}: Output file name

   862 .IP \[bu] 2

   863 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   864 .IP \[bu] 2

   865 {\f[CB]\-cacerts\f[R]}: Access the cacerts keystore

   866 .IP \[bu] 2

   867 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   868 .IP \[bu] 2

   869 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   870 .IP \[bu] 2

   871 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   872 .IP \[bu] 2

   873 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   874 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   875 an optional configure argument.

   876 .IP \[bu] 2

   877 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   878 \f[I]arg\f[R]] }: Add security provider by fully qualified class name

   879 with an optional configure argument.

   880 .IP \[bu] 2

   881 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   882 .IP \[bu] 2

   883 {\f[CB]\-v\f[R]}: Verbose output

   884 .IP \[bu] 2

   885 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   886 .PP

   887 Use the \f[CB]\-exportcert\f[R] command to read a certificate from the

   888 keystore that is associated with \f[CB]\-alias\f[R] \f[I]alias\f[R] and

   889 store it in the \f[CB]\-file\f[R] \f[I]file\f[R].

   890 When a file is not specified, the certificate is output to

   891 \f[CB]stdout\f[R].

   892 .PP

   893 By default, the certificate is output in binary encoding.

   894 If the \f[CB]\-rfc\f[R] option is specified, then the output in the

   895 printable encoding format defined by the Internet RFC 1421 Certificate

   896 Encoding Standard.

   897 .PP

   898 If \f[CB]\-alias\f[R] refers to a trusted certificate, then that

   899 certificate is output.

   900 Otherwise, \f[CB]\-alias\f[R] refers to a key entry with an associated

   901 certificate chain.

   902 In that case, the first certificate in the chain is returned.

   903 This certificate authenticates the public key of the entity addressed by

   904 \f[CB]\-alias\f[R].

   905 .RE

   906 .SH COMMANDS FOR DISPLAYING DATA

   907 .TP

   908 .B \f[CB]\-list\f[R]

   909 The following are the available options for the \f[CB]\-list\f[R] command:

   910 .RS

   911 .IP \[bu] 2

   912 {\f[CB]\-rfc\f[R]}: Output in RFC style

   913 .IP \[bu] 2

   914 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

   915 .IP \[bu] 2

   916 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

   917 .IP \[bu] 2

   918 {\f[CB]\-cacerts\f[R]}: Access the cacerts keystore

   919 .IP \[bu] 2

   920 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

   921 .IP \[bu] 2

   922 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

   923 .IP \[bu] 2

   924 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

   925 .IP \[bu] 2

   926 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

   927 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

   928 an optional configure argument.

   929 .IP \[bu] 2

   930 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

   931 \f[I]arg\f[R]] }: Add security provider by fully qualified class name

   932 with an optional configure argument.

   933 .IP \[bu] 2

   934 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

   935 .IP \[bu] 2

   936 {\f[CB]\-v\f[R]}: Verbose output

   937 .IP \[bu] 2

   938 {\f[CB]\-protected\f[R]}: Password provided through a protected mechanism

   939 .PP

   940 Use the \f[CB]\-list\f[R] command to print the contents of the keystore

   941 entry identified by \f[CB]\-alias\f[R] to \f[CB]stdout\f[R].

   942 If \f[CB]\-alias\f[R] \f[I]alias\f[R] is not specified, then the contents

   943 of the entire keystore are printed.

   944 .PP

   945 By default, this command prints the SHA\-256 fingerprint of a

   946 certificate.

   947 If the \f[CB]\-v\f[R] option is specified, then the certificate is printed

   948 in human\-readable format, with additional information such as the

   949 owner, issuer, serial number, and any extensions.

   950 If the \f[CB]\-rfc\f[R] option is specified, then the certificate contents

   951 are printed by using the printable encoding format, as defined by the

   952 Internet RFC 1421 Certificate Encoding Standard.

   953 .PP

   954 \f[B]Note:\f[R]

   955 .PP

   956 You can\[aq]t specify both \f[CB]\-v\f[R] and \f[CB]\-rfc\f[R] in the same

   957 command.

   958 Otherwise, an error is reported.

   959 .RE

   960 .TP

   961 .B \f[CB]\-printcert\f[R]

   962 The following are the available options for the \f[CB]\-printcert\f[R]

   963 command:

   964 .RS

   965 .IP \[bu] 2

   966 {\f[CB]\-rfc\f[R]}: Output in RFC style

   967 .IP \[bu] 2

   968 {\f[CB]\-file\f[R] \f[I]cert_file\f[R]}: Input file name

   969 .IP \[bu] 2

   970 {\f[CB]\-sslserver\f[R] \f[I]server\f[R][\f[CB]:\f[R]\f[I]port\f[R]]}:: Secure

   971 Sockets Layer (SSL) server host and port

   972 .IP \[bu] 2

   973 {\f[CB]\-jarfile\f[R] \f[I]JAR_file\f[R]}: Signed \f[CB]\&.jar\f[R] file

   974 .IP \[bu] 2

   975 {\f[CB]\-v\f[R]}: Verbose output

   976 .PP

   977 Use the \f[CB]\-printcert\f[R] command to read and print the certificate

   978 from \f[CB]\-file\f[R] \f[I]cert_file\f[R], the SSL server located at

   979 \f[CB]\-sslserver\f[R] \f[I]server\f[R][\f[CB]:\f[R]\f[I]port\f[R]], or the

   980 signed JAR file specified by \f[CB]\-jarfile\f[R] \f[I]JAR_file\f[R].

   981 It prints its contents in a human\-readable format.

   982 When a port is not specified, the standard HTTPS port 443 is assumed.

   983 .PP

   984 \f[B]Note:\f[R]

   985 .PP

   986 The \f[CB]\-sslserver\f[R] and \f[CB]\-file\f[R] options can\[aq]t be

   987 provided in the same command.

   988 Otherwise, an error is reported.

   989 If you don\[aq]t specify either option, then the certificate is read

   990 from \f[CB]stdin\f[R].

   991 .PP

   992 When\f[CB]\-rfc\f[R] is specified, the \f[CB]keytool\f[R] command prints the

   993 certificate in PEM mode as defined by the Internet RFC 1421 Certificate

   994 Encoding standard.

   995 .PP

   996 If the certificate is read from a file or \f[CB]stdin\f[R], then it might

   997 be either binary encoded or in printable encoding format, as defined by

   998 the RFC 1421 Certificate Encoding standard.

   999 .PP

  1000 If the SSL server is behind a firewall, then the

  1001 \f[CB]\-J\-Dhttps.proxyHost=proxyhost\f[R] and

  1002 \f[CB]\-J\-Dhttps.proxyPort=proxyport\f[R] options can be specified on the

  1003 command line for proxy tunneling.

  1004 .PP

  1005 \f[B]Note:\f[R]

  1006 .PP

  1007 This option can be used independently of a keystore.

  1008 .RE

  1009 .TP

  1010 .B \f[CB]\-printcertreq\f[R]

  1011 The following are the available options for the \f[CB]\-printcertreq\f[R]

  1012 command:

  1013 .RS

  1014 .IP \[bu] 2

  1015 {\f[CB]\-file\f[R] \f[I]file\f[R]}: Input file name

  1016 .IP \[bu] 2

  1017 {\f[CB]\-v\f[R]}: Verbose output

  1018 .PP

  1019 Use the \f[CB]\-printcertreq\f[R] command to print the contents of a PKCS

  1020 #10 format certificate request, which can be generated by the

  1021 \f[CB]keytool\ \-certreq\f[R] command.

  1022 The command reads the request from file.

  1023 If there is no file, then the request is read from the standard input.

  1024 .RE

  1025 .TP

  1026 .B \f[CB]\-printcrl\f[R]

  1027 The following are the available options for the \f[CB]\-printcrl\f[R]

  1028 command:

  1029 .RS

  1030 .IP \[bu] 2

  1031 \f[CB]\-file\ crl\f[R]: Input file name

  1032 .IP \[bu] 2

  1033 {\f[CB]\-v\f[R]}: Verbose output

  1034 .PP

  1035 Use the \f[CB]\-printcrl\f[R] command to read the Certificate Revocation

  1036 List (CRL) from \f[CB]\-file\ crl\f[R] .

  1037 A CRL is a list of the digital certificates that were revoked by the CA

  1038 that issued them.

  1039 The CA generates the \f[CB]crl\f[R] file.

  1040 .PP

  1041 \f[B]Note:\f[R]

  1042 .PP

  1043 This option can be used independently of a keystore.

  1044 .RE

  1045 .SH COMMANDS FOR MANAGING THE KEYSTORE

  1046 .TP

  1047 .B \f[CB]\-storepasswd\f[R]

  1048 The following are the available options for the \f[CB]\-storepasswd\f[R]

  1049 command:

  1050 .RS

  1051 .IP \[bu] 2

  1052 [\f[CB]\-new\f[R] \f[I]arg\f[R]]: New password

  1053 .IP \[bu] 2

  1054 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

  1055 .IP \[bu] 2

  1056 {\f[CB]\-cacerts\f[R]}: Access the cacerts keystore

  1057 .IP \[bu] 2

  1058 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

  1059 .IP \[bu] 2

  1060 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

  1061 .IP \[bu] 2

  1062 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

  1063 .IP \[bu] 2

  1064 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

  1065 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

  1066 an optional configure argument.

  1067 .IP \[bu] 2

  1068 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

  1069 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

  1070 an optional configure argument.

  1071 .IP \[bu] 2

  1072 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

  1073 .IP \[bu] 2

  1074 {\f[CB]\-v\f[R]}: Verbose output

  1075 .PP

  1076 Use the \f[CB]\-storepasswd\f[R] command to change the password used to

  1077 protect the integrity of the keystore contents.

  1078 The new password is set by \f[CB]\-new\f[R] \f[I]arg\f[R] and must contain

  1079 at least six characters.

  1080 .RE

  1081 .TP

  1082 .B \f[CB]\-keypasswd\f[R]

  1083 The following are the available options for the \f[CB]\-keypasswd\f[R]

  1084 command:

  1085 .RS

  1086 .IP \[bu] 2

  1087 {\f[CB]\-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process

  1088 .IP \[bu] 2

  1089 [\f[CB]\-keypass\f[R] \f[I]old_keypass\f[R]]: Key password

  1090 .IP \[bu] 2

  1091 [\f[CB]\-new\f[R] \f[I]new_keypass\f[R]]: New password

  1092 .IP \[bu] 2

  1093 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

  1094 .IP \[bu] 2

  1095 {\f[CB]\-storepass\f[R] \f[I]arg\f[R]}: Keystore password

  1096 .IP \[bu] 2

  1097 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type

  1098 .IP \[bu] 2

  1099 {\f[CB]\-providername\f[R] \f[I]name\f[R]}: Provider name

  1100 .IP \[bu] 2

  1101 {\f[CB]\-addprovider\f[R] \f[I]name\f[R] [\f[CB]\-providerarg\f[R]

  1102 \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with

  1103 an optional configure argument.

  1104 .IP \[bu] 2

  1105 {\f[CB]\-providerclass\f[R] \f[I]class\f[R] [\f[CB]\-providerarg\f[R]

  1106 \f[I]arg\f[R]]}: Add security provider by fully qualified class name with

  1107 an optional configure argument.

  1108 .IP \[bu] 2

  1109 {\f[CB]\-providerpath\f[R] \f[I]list\f[R]}: Provider classpath

  1110 .IP \[bu] 2

  1111 {\f[CB]\-v\f[R]}: Verbose output

  1112 .PP

  1113 Use the \f[CB]\-keypasswd\f[R] command to change the password (under which

  1114 private/secret keys identified by \f[CB]\-alias\f[R] are protected) from

  1115 \f[CB]\-keypass\f[R] \f[I]old_keypass\f[R] to \f[CB]\-new\f[R]

  1116 \f[I]new_keypass\f[R].

  1117 The password value must contain at least six characters.

  1118 .PP

  1119 If the \f[CB]\-keypass\f[R] option isn\[aq]t provided at the command line

  1120 and the \f[CB]\-keypass\f[R] password is different from the keystore

  1121 password (\f[CB]\-storepass\f[R] \f[I]arg\f[R]), then the user is prompted

  1122 for it.

  1123 .PP

  1124 If the \f[CB]\-new\f[R] option isn\[aq]t provided at the command line,

  1125 then the user is prompted for it.

  1126 .RE

  1127 .TP

  1128 .B \f[CB]\-delete\f[R]

  1129 The following are the available options for the \f[CB]\-delete\f[R]

  1130 command:

  1131 .RS

  1132 .IP \[bu] 2

  1133 [\f[CB]\-alias\f[R] \f[I]alias\f[R]]: Alias name of the entry to process

  1134 .IP \[bu] 2

  1135 {\f[CB]\-keystore\f[R] \f[I]keystore\f[R]}: Keystore name

  1136 .IP \[bu] 2

  1137 {\f[CB]\-cacerts\f[R]}: Access the cacerts keystore

  1138 .IP \[bu] 2

  1139 [\f[CB]\-storepass\f[R] \f[I]arg\f[R]]: Keystore password

  1140 .IP \[bu] 2

  1141 {\f[CB]\-storetype\f[R] \f[I]type\f[R]}: Keystore type