jdk/src/bsd/doc/man/keytool.1
author dsamersoff
Thu, 15 Jan 2015 12:02:55 +0000
changeset 28620 0e23eb51d29e
parent 21743 3d979da7bdf0
child 31876 91b22707521a
permissions -rw-r--r--
Merge
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     1
'\" t
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     2
.\"  Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     3
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     4
.\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     5
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     6
.\" This code is free software; you can redistribute it and/or modify it
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     7
.\" under the terms of the GNU General Public License version 2 only, as
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     8
.\" published by the Free Software Foundation.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
     9
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    10
.\" This code is distributed in the hope that it will be useful, but WITHOUT
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    11
.\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    12
.\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    13
.\" version 2 for more details (a copy is included in the LICENSE file that
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    14
.\" accompanied this code).
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    15
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    16
.\" You should have received a copy of the GNU General Public License version
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    17
.\" 2 along with this work; if not, write to the Free Software Foundation,
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    18
.\" Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    19
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    20
.\" Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    21
.\" or visit www.oracle.com if you need additional information or have any
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    22
.\" questions.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    23
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    24
.\"     Arch: generic
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    25
.\"     Software: JDK 8
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    26
.\"     Date: 6 August 2013
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    27
.\"     SectDesc: Security Tools
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    28
.\"     Title: keytool.1
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    29
.\"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    30
.if n .pl 99999
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    31
.TH keytool 1 "6 August 2013" "JDK 8" "Security Tools"
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    32
.\" -----------------------------------------------------------------
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    33
.\" * Define some portability stuff
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    34
.\" -----------------------------------------------------------------
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    35
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    36
.\" http://bugs.debian.org/507673
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    37
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    38
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    39
.ie \n(.g .ds Aq \(aq
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    40
.el       .ds Aq '
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    41
.\" -----------------------------------------------------------------
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    42
.\" * set default formatting
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    43
.\" -----------------------------------------------------------------
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    44
.\" disable hyphenation
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    45
.nh
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    46
.\" disable justification (adjust text to left margin only)
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    47
.ad l
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    48
.\" -----------------------------------------------------------------
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    49
.\" * MAIN CONTENT STARTS HERE *
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    50
.\" -----------------------------------------------------------------
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
    51
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    52
.SH NAME    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    53
keytool \- Manages a keystore (database) of cryptographic keys, X\&.509 certificate chains, and trusted certificates\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    54
.SH SYNOPSIS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    55
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    56
.nf     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
    57
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    58
\fBkeytool\fR [\fIcommands\fR]
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    59
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    60
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    61
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    62
\fIcommands\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    63
See Commands\&. These commands are categorized by task as follows:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    64
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    65
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    66
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    67
Create or Add Data to the Keystore
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    68
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    69
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    70
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    71
-gencert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    72
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    73
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    74
-genkeypair
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    75
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    76
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    77
-genseckey
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    78
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    79
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    80
-importcert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    81
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    82
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    83
-importpassword
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    84
.RE     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    85
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    86
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    87
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    88
Import Contents From Another Keystore
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    89
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    90
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    91
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    92
-importkeystore
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    93
.RE     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    94
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    95
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    96
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    97
Generate Certificate Request
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    98
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
    99
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   100
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   101
-certreq
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   102
.RE     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   103
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   104
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   105
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   106
Export Data
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   107
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   108
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   109
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   110
-exportcert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   111
.RE     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   112
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   113
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   114
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   115
Display Data
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   116
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   117
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   118
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   119
-list
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   120
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   121
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   122
-printcert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   123
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   124
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   125
-printcertreq
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   126
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   127
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   128
-printcrl
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   129
.RE     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   130
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   131
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   132
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   133
Manage the Keystore
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   134
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   135
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   136
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   137
-storepasswd
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   138
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   139
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   140
-keypasswd
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   141
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   142
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   143
-delete
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   144
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   145
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   146
-changealias
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   147
.RE     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   148
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   149
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   150
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   151
Get Help
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   152
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   153
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   154
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   155
-help
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   156
.RE     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   157
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   158
.RE     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   159
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   160
.SH DESCRIPTION    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   161
The \f3keytool\fR command is a key and certificate management utility\&. It enables users to administer their own public/private key pairs and associated certificates for use in self-authentication (where the user authenticates himself or herself to other users and services) or data integrity and authentication services, using digital signatures\&. The \f3keytool\fR command also enables users to cache the public keys (in the form of certificates) of their communicating peers\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   162
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   163
A certificate is a digitally signed statement from one entity (person, company, and so on\&.), that says that the public key (and some other information) of some other entity has a particular value\&. (See Certificate\&.) When data is digitally signed, the signature can be verified to check the data integrity and authenticity\&. Integrity means that the data has not been modified or tampered with, and authenticity means the data comes from whoever claims to have created and signed it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   164
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   165
The \f3keytool\fR command also enables users to administer secret keys and passphrases used in symmetric encryption and decryption (DES)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   166
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   167
The \f3keytool\fR command stores the keys and certificates in a keystore\&. See KeyStore aliases\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   168
.SH COMMAND\ AND\ OPTION\ NOTES    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   169
See Commands for a listing and description of the various commands\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   170
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   171
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   172
All command and option names are preceded by a minus sign (-)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   173
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   174
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   175
The options for each command can be provided in any order\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   176
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   177
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   178
All items not italicized or in braces or brackets are required to appear as is\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   179
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   180
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   181
Braces surrounding an option signify that a default value will be used when the option is not specified on the command line\&. See Option Defaults\&. Braces are also used around the \f3-v\fR, \f3-rfc\fR, and \f3-J\fR options, which only have meaning when they appear on the command line\&. They do not have any default values other than not existing\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   182
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   183
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   184
Brackets surrounding an option signify that the user is prompted for the values when the option is not specified on the command line\&. For the \f3-keypass\fR option, if you do not specify the option on the command line, then the \f3keytool\fR command first attempts to use the keystore password to recover the private/secret key\&. If this attempt fails, then the \f3keytool\fR command prompts you for the private/secret key password\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   185
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   186
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   187
Items in italics (option values) represent the actual values that must be supplied\&. For example, here is the format of the \f3-printcert\fR command:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   188
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   189
\f3keytool -printcert {-file cert_file} {-v}\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   190
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   191
When you specify a \f3-printcert\fR command, replace \f3cert_file\fR with the actual file name, as follows: \f3keytool -printcert -file VScert\&.cer\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   192
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   193
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   194
Option values must be put in quotation marks when they contain a blank (space)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   195
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   196
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   197
The \f3-help\fR option is the default\&. The \f3keytool\fR command is the same as \f3keytool -help\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   198
.SH OPTION\ DEFAULTS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   199
The following examples show the defaults for various option values\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   200
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   201
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   202
\f3\-alias "mykey"\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   203
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   204
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   205
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   206
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   207
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   208
\f3\-keyalg\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   209
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   210
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   211
\f3    "DSA" (when using \-genkeypair)\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   212
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   213
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   214
\f3    "DES" (when using \-genseckey)\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   215
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   216
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   217
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   218
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   219
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   220
\f3\-keysize\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   221
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   222
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   223
\f3    2048 (when using \-genkeypair and \-keyalg is "RSA")\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   224
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   225
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   226
\f3    1024 (when using \-genkeypair and \-keyalg is "DSA")\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   227
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   228
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   229
\f3    256 (when using \-genkeypair and \-keyalg is "EC")\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   230
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   231
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   232
\f3    56 (when using \-genseckey and \-keyalg is "DES")\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   233
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   234
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   235
\f3    168 (when using \-genseckey and \-keyalg is "DESede")\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   236
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   237
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   238
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   239
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   240
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   241
\f3\-validity 90\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   242
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   243
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   244
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   245
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   246
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   247
\f3\-keystore <the file named \&.keystore in the user\&'s home directory>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   248
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   249
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   250
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   251
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   252
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   253
\f3\-storetype <the value of the "keystore\&.type" property in the\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   254
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   255
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   256
\f3    security properties file, which is returned by the static\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   257
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   258
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   259
\f3    getDefaultType method in java\&.security\&.KeyStore>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   260
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   261
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   262
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   263
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   264
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   265
\f3\-file\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   266
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   267
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   268
\f3    stdin (if reading)\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   269
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   270
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   271
\f3    stdout (if writing)\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   272
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   273
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   274
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   275
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   276
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   277
\f3\-protected false\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   278
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   279
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   280
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   281
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   282
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   283
In generating a public/private key pair, the signature algorithm (\f3-sigalg\fR option) is derived from the algorithm of the underlying private key:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   284
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   285
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   286
If the underlying private key is of type DSA, then the \f3-sigalg\fR option defaults to SHA1withDSA\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   287
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   288
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   289
If the underlying private key is of type RSA, then the \f3-sigalg\fR option defaults to SHA256withRSA\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   290
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   291
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   292
If the underlying private key is of type EC, then the \f3-sigalg\fR option defaults to SHA256withECDSA\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   293
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   294
For a full list of \f3-keyalg\fR and \f3-sigalg\fR arguments, see Java Cryptography Architecture (JCA) Reference Guide at http://docs\&.oracle\&.com/javase/8/docs/technotes/guides/security/crypto/CryptoSpec\&.html#AppA
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   295
.SH COMMON\ OPTIONS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   296
The \f3-v\fR option can appear for all commands except \f3-help\fR\&. When the \f3-v\fR option appears, it signifies verbose mode, which means that more information is provided in the output\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   297
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   298
There is also a \f3-Jjavaoption\fR argument that can appear for any command\&. When the \f3-Jjavaoption\fR appears, the specified \f3javaoption\fR string is passed directly to the Java interpreter\&. This option does not contain any spaces\&. It is useful for adjusting the execution environment or memory usage\&. For a list of possible interpreter options, type \f3java -h\fR or \f3java -X\fR at the command line\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   299
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   300
These options can appear for all commands operating on a keystore:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   301
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   302
-storetype \fIstoretype\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   303
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   304
This qualifier specifies the type of keystore to be instantiated\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   305
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   306
-keystore \fIkeystore\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   307
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   308
The keystore location\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   309
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   310
If the JKS \f3storetype\fR is used and a keystore file does not yet exist, then certain \f3keytool\fR commands can result in a new keystore file being created\&. For example, if \f3keytool -genkeypair\fR is called and the \f3-keystore\fR option is not specified, the default keystore file named \f3\&.keystore\fR in the user\&'s home directory is created when it does not already exist\&. Similarly, if the \f3-keystore ks_file\fR option is specified but ks_file does not exist, then it is created\&. For more information on the JKS \f3storetype\fR, see the \fIKeyStore Implementation\fR section in KeyStore aliases\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   311
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   312
Note that the input stream from the \f3-keystore\fR option is passed to the \f3KeyStore\&.load\fR method\&. If \f3NONE\fR is specified as the URL, then a null stream is passed to the \f3KeyStore\&.load\fR method\&. \f3NONE\fR should be specified if the keystore is not file-based\&. For example, when it resides on a hardware token device\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   313
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   314
-storepass[:\fIenv\fR| :\fIfile\fR] argument
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   315
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   316
The password that is used to protect the integrity of the keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   317
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   318
If the modifier \f3env\fR or \f3file\fR is not specified, then the password has the \f3value\fR argument, which must be at least 6 characters long\&. Otherwise, the password is retrieved as follows:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   319
.RS     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   320
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   321
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   322
\f3env\fR: Retrieve the password from the environment variable named \f3argument\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   323
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   324
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   325
\f3file\fR: Retrieve the password from the file named argument\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   326
.RE     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   327
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   328
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   329
\fINote:\fR All other options that require passwords, such as \f3-keypass\fR, \f3-srckeypass\fR, -\f3destkeypass\fR, \f3-srcstorepass\fR, and \f3-deststorepass\fR, accept the \fIenv\fR and \fIfile\fR modifiers\&. Remember to separate the password option and the modifier with a colon (:)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   330
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   331
The password must be provided to all commands that access the keystore contents\&. For such commands, when the \f3-storepass\fR option is not provided at the command line, the user is prompted for it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   332
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   333
When retrieving information from the keystore, the password is optional\&. If no password is specified, then the integrity of the retrieved information cannot be verified and a warning is displayed\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   334
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   335
-providerName \fIprovider_name\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   336
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   337
Used to identify a cryptographic service provider\&'s name when listed in the security properties file\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   338
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   339
-providerClass \fIprovider_class_name\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   340
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   341
Used to specify the name of a cryptographic service provider\&'s master class file when the service provider is not listed in the security properties file\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   342
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   343
-providerArg \fIprovider_arg\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   344
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   345
Used with the \f3-providerClass\fR option to represent an optional string input argument for the constructor of \f3provider_class_name\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   346
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   347
-protected
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   348
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   349
Either \f3true\fR or \f3false\fR\&. This value should be specified as \f3true\fR when a password must be specified by way of a protected authentication path such as a dedicated PIN reader\&.Because there are two keystores involved in the \f3-importkeystore\fR command, the following two options \f3-srcprotected\fR and -\f3destprotected\fR are provided for the source keystore and the destination keystore respectively\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   350
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   351
-ext \fI{name{:critical} {=value}}\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   352
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   353
Denotes an X\&.509 certificate extension\&. The option can be used in \f3-genkeypair\fR and \f3-gencert\fR to embed extensions into the certificate generated, or in \f3-certreq\fR to show what extensions are requested in the certificate request\&. The option can appear multiple times\&. The \f3name\fR argument can be a supported extension name (see Named Extensions) or an arbitrary OID number\&. The \f3value\fR argument, when provided, denotes the argument for the extension\&. When \fIvalue\fR is omitted, that means that the default value of the extension or the extension requires no argument\&. The \f3:critical\fR modifier, when provided, means the extension\&'s \f3isCritical\fR attribute is \f3true\fR; otherwise, it is \f3false\fR\&. You can use \f3:c\fR in place of \f3:critical\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   354
.SH NAMED\ EXTENSIONS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   355
The \f3keytool\fR command supports these named extensions\&. The names are not case-sensitive)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   356
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   357
BC or BasicContraints
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   358
\fIValues\fR: The full form is: \f3ca:{true|false}[,pathlen:<len>]\fR or \f3<len>\fR, which is short for \f3ca:true,pathlen:<len>\fR\&. When <\f3len\fR> is omitted, you have \f3ca:true\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   359
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   360
KU or KeyUsage
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   361
\fIValues\fR: \f3usage\fR(,\f3usage\fR)*, where \fIusage\fR can be one of \f3digitalSignature\fR, \f3nonRepudiation\fR (contentCommitment), \f3keyEncipherment\fR, \f3dataEncipherment\fR, \f3keyAgreement\fR, \f3keyCertSign\fR, \f3cRLSign\fR, \f3encipherOnly\fR, \f3decipherOnly\fR\&. The \fIusage\fR argument can be abbreviated with the first few letters (\f3dig\fR for \f3digitalSignature\fR) or in camel-case style (\f3dS\fR for \f3digitalSignature\fR or \f3cRLS\fR for \f3cRLSign\fR), as long as no ambiguity is found\&. The \f3usage\fR values are case-sensitive\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   362
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   363
EKU or ExtendedKeyUsage
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   364
\fIValues\fR: \f3usage\fR(,\f3usage\fR)*, where \fIusage\fR can be one of \f3anyExtendedKeyUsage\fR, \f3serverAuth\fR, \f3clientAuth\fR, \f3codeSigning\fR, \f3emailProtection\fR, \f3timeStamping\fR, \f3OCSPSigning\fR, or any \fIOID string\fR\&. The \fIusage\fR argument can be abbreviated with the first few letters or in camel-case style, as long as no ambiguity is found\&. The \f3usage\fR values are case-sensitive\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   365
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   366
SAN or SubjectAlternativeName
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   367
\fIValues\fR: \f3type\fR:\f3value\fR(,t\f3ype:value\fR)*, where \f3type\fR can be \f3EMAIL\fR, \f3URI\fR, \f3DNS\fR, \f3IP\fR, or \f3OID\fR\&. The \f3value\fR argument is the string format value for the \f3type\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   368
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   369
IAN or IssuerAlternativeName
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   370
\fIValues\fR: Same as \f3SubjectAlternativeName\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   371
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   372
SIA or SubjectInfoAccess
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   373
\fIValues\fR: \f3method\fR:\f3location-type\fR:\f3location-value\fR (,\f3method:location-type\fR:\f3location-value\fR)*, where \f3method\fR can be \f3timeStamping\fR, \f3caRepository\fR or any OID\&. The \f3location-type\fR and \f3location-value\fR arguments can be any \f3type\fR:\f3value\fR supported by the \f3SubjectAlternativeName\fR extension\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   374
.TP     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   375
AIA or AuthorityInfoAccess
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   376
\fIValues\fR: Same as \f3SubjectInfoAccess\fR\&. The \f3method\fR argument can be \f3ocsp\fR,\f3caIssuers\fR, or any OID\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   377
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   378
When \f3name\fR is OID, the value is the hexadecimal dumped DER encoding of the \f3extnValue\fR for the extension excluding the OCTET STRING type and length bytes\&. Any extra character other than standard hexadecimal numbers (0-9, a-f, A-F) are ignored in the HEX string\&. Therefore, both 01:02:03:04 and 01020304 are accepted as identical values\&. When there is no value, the extension has an empty value field\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   379
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   380
A special name \f3honored\fR, used in \f3-gencert\fR only, denotes how the extensions included in the certificate request should be honored\&. The value for this name is a comma separated list of \f3all\fR (all requested extensions are honored), \f3name{:[critical|non-critical]}\fR (the named extension is honored, but using a different \f3isCritical\fR attribute) and \f3-name\fR (used with \f3all\fR, denotes an exception)\&. Requested extensions are not honored by default\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   381
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   382
If, besides the\f3-ext honored\fR option, another named or OID \f3-ext\fR option is provided, this extension is added to those already honored\&. However, if this name (or OID) also appears in the honored value, then its value and criticality overrides the one in the request\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   383
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   384
The \f3subjectKeyIdentifier\fR extension is always created\&. For non-self-signed certificates, the \f3authorityKeyIdentifier\fR is created\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   385
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   386
\fINote:\fR Users should be aware that some combinations of extensions (and other certificate fields) may not conform to the Internet standard\&. See Certificate Conformance Warning\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   387
.SH COMMANDS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   388
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   389
-gencert
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   390
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   391
\f3{-rfc} {-infile infile} {-outfile outfile} {-alias alias} {-sigalg sigalg} {-dname dname} {-startdate startdate {-ext ext}* {-validity valDays} [-keypass keypass] {-keystore keystore} [-storepass storepass] {-storetype storetype} {-providername provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   392
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   393
Generates a certificate as a response to a certificate request file (which can be created by the \f3keytool\fR\f3-certreq\fR command)\&. The command reads the request from \fIinfile\fR (if omitted, from the standard input), signs it using alias\&'s private key, and outputs the X\&.509 certificate into \fIoutfile\fR (if omitted, to the standard output)\&. When\f3-rfc\fR is specified, the output format is Base64-encoded PEM; otherwise, a binary DER is created\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   394
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   395
The \f3sigalg\fR value specifies the algorithm that should be used to sign the certificate\&. The \f3startdate\fR argument is the start time and date that the certificate is valid\&. The \f3valDays\fR argument tells the number of days for which the certificate should be considered valid\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   396
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   397
When \f3dname\fR is provided, it is used as the subject of the generated certificate\&. Otherwise, the one from the certificate request is used\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   398
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   399
The \f3ext\fR value shows what X\&.509 extensions will be embedded in the certificate\&. Read Common Options for the grammar of \f3-ext\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   400
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   401
The \f3-gencert\fR option enables you to create certificate chains\&. The following example creates a certificate, \f3e1\fR, that contains three certificates in its certificate chain\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   402
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   403
The following commands creates four key pairs named \f3ca\fR, \f3ca1\fR, \f3ca2\fR, and \f3e1\fR:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   404
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   405
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   406
\f3keytool \-alias ca \-dname CN=CA \-genkeypair\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   407
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   408
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   409
\f3keytool \-alias ca1 \-dname CN=CA \-genkeypair\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   410
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   411
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   412
\f3keytool \-alias ca2 \-dname CN=CA \-genkeypair\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   413
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   414
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   415
\f3keytool \-alias e1 \-dname CN=E1 \-genkeypair\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   416
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   417
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   418
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   419
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   420
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   421
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   422
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   423
The following two commands create a chain of signed certificates; \f3ca\fR signs \f3ca1\fR and \f3ca1\fR signs \f3ca2\fR, all of which are self-issued:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   424
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   425
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   426
\f3keytool \-alias ca1 \-certreq |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   427
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   428
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   429
\f3    keytool \-alias ca \-gencert \-ext san=dns:ca1 |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   430
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   431
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   432
\f3    keytool \-alias ca1 \-importcert\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   433
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   434
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   435
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   436
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   437
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   438
\f3keytool \-alias ca2 \-certreq |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   439
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   440
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   441
\f3    $KT \-alias ca1 \-gencert \-ext san=dns:ca2 |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   442
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   443
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   444
\f3    $KT \-alias ca2 \-importcert\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   445
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   446
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   447
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   448
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   449
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   450
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   451
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   452
The following command creates the certificate \f3e1\fR and stores it in the file \f3e1\&.cert\fR, which is signed by \f3ca2\fR\&. As a result, \f3e1\fR should contain \f3ca\fR, \f3ca1\fR, and \f3ca2\fR in its certificate chain:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   453
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   454
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   455
\f3keytool \-alias e1 \-certreq | keytool \-alias ca2 \-gencert > e1\&.cert\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   456
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   457
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   458
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   459
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   460
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   461
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   462
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   463
-genkeypair
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   464
.br
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   465
\f3{-alias alias} {-keyalg keyalg} {-keysize keysize} {-sigalg sigalg} [-dname dname] [-keypass keypass] {-startdate value} {-ext ext}* {-validity valDays} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   466
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   467
Generates a key pair (a public key and associated private key)\&. Wraps the public key into an X\&.509 v3 self-signed certificate, which is stored as a single-element certificate chain\&. This certificate chain and the private key are stored in a new keystore entry identified by alias\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   468
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   469
The \f3keyalg\fR value specifies the algorithm to be used to generate the key pair, and the \f3keysize\fR value specifies the size of each key to be generated\&. The \f3sigalg\fR value specifies the algorithm that should be used to sign the self-signed certificate\&. This algorithm must be compatible with the \f3keyalg\fR value\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   470
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   471
The \f3dname\fR value specifies the X\&.500 Distinguished Name to be associated with the value of \f3alias\fR, and is used as the issuer and subject fields in the self-signed certificate\&. If no distinguished name is provided at the command line, then the user is prompted for one\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   472
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   473
The value of \f3keypass\fR is a password used to protect the private key of the generated key pair\&. If no password is provided, then the user is prompted for it\&. If you press \fIthe Return key\fR at the prompt, then the key password is set to the same password as the keystore password\&. The \f3keypass\fR value must be at least 6 characters\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   474
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   475
The value of \f3startdate\fR specifies the issue time of the certificate, also known as the "Not Before" value of the X\&.509 certificate\&'s Validity field\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   476
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   477
The option value can be set in one of these two forms:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   478
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   479
\f3([+-]nnn[ymdHMS])+\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   480
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   481
\f3[yyyy/mm/dd] [HH:MM:SS]\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   482
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   483
With the first form, the issue time is shifted by the specified value from the current time\&. The value is a concatenation of a sequence of subvalues\&. Inside each subvalue, the plus sign (+) means shift forward, and the minus sign (-) means shift backward\&. The time to be shifted is \f3nnn\fR units of years, months, days, hours, minutes, or seconds (denoted by a single character of \f3y\fR, \f3m\fR, \f3d\fR, \f3H\fR, \f3M\fR, or \f3S\fR respectively)\&. The exact value of the issue time is calculated using the \f3java\&.util\&.GregorianCalendar\&.add(int field, int amount)\fR method on each subvalue, from left to right\&. For example, by specifying, the issue time will be:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   484
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   485
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   486
\f3Calendar c = new GregorianCalendar();\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   487
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   488
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   489
\f3c\&.add(Calendar\&.YEAR, \-1);\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   490
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   491
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   492
\f3c\&.add(Calendar\&.MONTH, 1);\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   493
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   494
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   495
\f3c\&.add(Calendar\&.DATE, \-1);\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   496
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   497
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   498
\f3return c\&.getTime()\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   499
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   500
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   501
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   502
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   503
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   504
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   505
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   506
With the second form, the user sets the exact issue time in two parts, year/month/day and hour:minute:second (using the local time zone)\&. The user can provide only one part, which means the other part is the same as the current date (or time)\&. The user must provide the exact number of digits as shown in the format definition (padding with 0 when shorter)\&. When both the date and time are provided, there is one (and only one) space character between the two parts\&. The hour should always be provided in 24 hour format\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   507
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   508
When the option is not provided, the start date is the current time\&. The option can be provided at most once\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   509
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   510
The value of \f3valDays\fR specifies the number of days (starting at the date specified by \f3-startdate\fR, or the current date when \f3-startdate\fR is not specified) for which the certificate should be considered valid\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   511
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   512
This command was named \f3-genkey\fR in earlier releases\&. The old name is still supported in this release\&. The new name, \f3-genkeypair\fR, is preferred going forward\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   513
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   514
-genseckey
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   515
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   516
\f3-genseckey {-alias alias} {-keyalg keyalg} {-keysize keysize} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   517
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   518
Generates a secret key and stores it in a new \f3KeyStore\&.SecretKeyEntry\fR identified by \f3alias\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   519
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   520
The value of \f3keyalg\fR specifies the algorithm to be used to generate the secret key, and the value of \f3keysize\fR specifies the size of the key to be generated\&. The \f3keypass\fR value is a password that protects the secret key\&. If no password is provided, then the user is prompted for it\&. If you press the Return key at the prompt, then the key password is set to the same password that is used for the \f3keystore\fR\&. The \f3keypass\fR value must be at least 6 characters\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   521
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   522
-importcert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   523
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   524
\f3-importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} {-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   525
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   526
Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or a sequence of X\&.509 certificates) from the file \f3cert_file\fR, and stores it in the \f3keystore\fR entry identified by \f3alias\fR\&. If no file is specified, then the certificate or certificate chain is read from \f3stdin\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   527
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   528
The \f3keytool\fR command can import X\&.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type\&. The data to be imported must be provided either in binary encoding format or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard\&. In the latter case, the encoding must be bounded at the beginning by a string that starts with \f3-\fR\f3----BEGIN\fR, and bounded at the end by a string that starts with \f3-----END\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   529
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   530
You import a certificate for two reasons: To add it to the list of trusted certificates, and to import a certificate reply received from a certificate authority (CA) as the result of submitting a Certificate Signing Request to that CA (see the \f3-certreq\fR option in Commands)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   531
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   532
Which type of import is intended is indicated by the value of the \f3-alias\fR option\&. If the alias does not point to a key entry, then the \f3keytool\fR command assumes you are adding a trusted certificate entry\&. In this case, the alias should not already exist in the keystore\&. If the alias does already exist, then the \f3keytool\fR command outputs an error because there is already a trusted certificate for that alias, and does not import the certificate\&. If the alias points to a key entry, then the \f3keytool\fR command assumes you are importing a certificate reply\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   533
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   534
-importpassword
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   535
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   536
\f3{-alias alias} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   537
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   538
Imports a passphrase and stores it in a new \f3KeyStore\&.SecretKeyEntry\fR identified by \f3alias\fR\&. The passphrase may be supplied via the standard input stream; otherwise the user is prompted for it\&. \f3keypass\fR is a password used to protect the imported passphrase\&. If no password is provided, the user is prompted for it\&. If you press the Return key at the prompt, the key password is set to the same password as that used for the \f3keystore\fR\&. \f3keypass\fR must be at least 6 characters long\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   539
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   540
-importkeystore
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   541
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   542
\f3{-srcstoretype srcstoretype} {-deststoretype deststoretype} [-srcstorepass srcstorepass] [-deststorepass deststorepass] {-srcprotected} {-destprotected} {-srcalias srcalias {-destalias destalias} [-srckeypass srckeypass] } [-destkeypass destkeypass] {-noprompt} {-srcProviderName src_provider_name} {-destProviderName dest_provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   543
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   544
Imports a single entry or all entries from a source keystore to a destination keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   545
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   546
When the \f3-srcalias\fR option is provided, the command imports the single entry identified by the alias to the destination keystore\&. If a destination alias is not provided with \f3destalias\fR, then \f3srcalias\fR is used as the destination alias\&. If the source entry is protected by a password, then \f3srckeypass\fR is used to recover the entry\&. If \fIsrckeypass\fR is not provided, then the \f3keytool\fR command attempts to use \f3srcstorepass\fR to recover the entry\&. If \f3srcstorepass\fR is either not provided or is incorrect, then the user is prompted for a password\&. The destination entry is protected with \f3destkeypass\fR\&. If \f3destkeypass\fR is not provided, then the destination entry is protected with the source entry password\&. For example, most third-party tools require \f3storepass\fR and \f3keypass\fR in a PKCS #12 keystore to be the same\&. In order to create a PKCS #12 keystore for these tools, always specify a \f3-destkeypass\fR to be the same as \f3-deststorepass\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   547
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   548
If the \f3-srcalias\fR option is not provided, then all entries in the source keystore are imported into the destination keystore\&. Each destination entry is stored under the alias from the source entry\&. If the source entry is protected by a password, then \f3srcstorepass\fR is used to recover the entry\&. If \f3srcstorepass\fR is either not provided or is incorrect, then the user is prompted for a password\&. If a source keystore entry type is not supported in the destination keystore, or if an error occurs while storing an entry into the destination keystore, then the user is prompted whether to skip the entry and continue or to quit\&. The destination entry is protected with the source entry password\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   549
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   550
If the destination alias already exists in the destination keystore, then the user is prompted to either overwrite the entry or to create a new entry under a different alias name\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   551
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   552
If the \f3-noprompt\fR option is provided, then the user is not prompted for a new destination alias\&. Existing entries are overwritten with the destination alias name\&. Entries that cannot be imported are skipped and a warning is displayed\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   553
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   554
-printcertreq
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   555
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   556
\f3{-file file}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   557
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   558
Prints the content of a PKCS #10 format certificate request, which can be generated by the \f3keytool\fR\f3-certreq\fR command\&. The command reads the request from file\&. If there is no file, then the request is read from the standard input\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   559
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   560
-certreq
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   561
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   562
\f3{-alias alias} {-dname dname} {-sigalg sigalg} {-file certreq_file} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   563
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   564
Generates a Certificate Signing Request (CSR) using the PKCS #10 format\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   565
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   566
A CSR is intended to be sent to a certificate authority (CA)\&. The CA authenticates the certificate requestor (usually off-line) and will return a certificate or certificate chain, used to replace the existing certificate chain (which initially consists of a self-signed certificate) in the keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   567
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   568
The private key associated with alias is used to create the PKCS #10 certificate request\&. To access the private key, the correct password must be provided\&. If \f3keypass\fR is not provided at the command line and is different from the password used to protect the integrity of the keystore, then the user is prompted for it\&. If \f3dname\fR is provided, then it is used as the subject in the CSR\&. Otherwise, the X\&.500 Distinguished Name associated with alias is used\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   569
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   570
The \f3sigalg\fR value specifies the algorithm that should be used to sign the CSR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   571
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   572
The CSR is stored in the file certreq_file\&. If no file is specified, then the CSR is output to \f3stdout\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   573
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   574
Use the \f3importcert\fR command to import the response from the CA\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   575
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   576
-exportcert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   577
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   578
\f3{-alias alias} {-file cert_file} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-rfc} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   579
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   580
Reads from the keystore the certificate associated with \fIalias\fR and stores it in the cert_file file\&. When no file is specified, the certificate is output to \f3stdout\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   581
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   582
The certificate is by default output in binary encoding\&. If the \f3-rfc\fR option is specified, then the output in the printable encoding format defined by the Internet RFC 1421 Certificate Encoding Standard\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   583
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   584
If \f3alias\fR refers to a trusted certificate, then that certificate is output\&. Otherwise, \f3alias\fR refers to a key entry with an associated certificate chain\&. In that case, the first certificate in the chain is returned\&. This certificate authenticates the public key of the entity addressed by \f3alias\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   585
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   586
This command was named \f3-export\fR in earlier releases\&. The old name is still supported in this release\&. The new name, \f3-exportcert\fR, is preferred going forward\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   587
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   588
-list
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   589
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   590
\f3{-alias alias} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v | -rfc} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   591
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   592
Prints to \f3stdout\fR the contents of the keystore entry identified by \f3alias\fR\&. If no \f3alias\fR is specified, then the contents of the entire keystore are printed\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   593
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   594
This command by default prints the SHA1 fingerprint of a certificate\&. If the \f3-v\fR option is specified, then the certificate is printed in human-readable format, with additional information such as the owner, issuer, serial number, and any extensions\&. If the \f3-rfc\fR option is specified, then the certificate contents are printed using the printable encoding format, as defined by the Internet RFC 1421 Certificate Encoding Standard\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   595
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   596
You cannot specify both \f3-v\fR and \f3-rfc\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   597
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   598
-printcert
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   599
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   600
\f3{-file cert_file | -sslserver host[:port]} {-jarfile JAR_file {-rfc} {-v} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   601
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   602
Reads the certificate from the file cert_file, the SSL server located at host:port, or the signed JAR file \f3JAR_file\fR (with the \f3-jarfile\fR option and prints its contents in a human-readable format\&. When no port is specified, the standard HTTPS port 443 is assumed\&. Note that \f3-sslserver\fR and -file options cannot be provided at the same time\&. Otherwise, an error is reported\&. If neither option is specified, then the certificate is read from \f3stdin\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   603
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   604
When\f3-rfc\fR is specified, the \f3keytool\fR command prints the certificate in PEM mode as defined by the Internet RFC 1421 Certificate Encoding standard\&. See Internet RFC 1421 Certificate Encoding Standard\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   605
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   606
If the certificate is read from a file or \f3stdin\fR, then it might be either binary encoded or in printable encoding format, as defined by the RFC 1421 Certificate Encoding standard\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   607
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   608
If the SSL server is behind a firewall, then the \f3-J-Dhttps\&.proxyHost=proxyhost\fR and \f3-J-Dhttps\&.proxyPort=proxyport\fR options can be specified on the command line for proxy tunneling\&. See Java Secure Socket Extension (JSSE) Reference Guide at http://docs\&.oracle\&.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide\&.html
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   609
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   610
\fINote:\fR This option can be used independently of a keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   611
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   612
-printcrl
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   613
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   614
\f3-file crl_ {-v}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   615
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   616
Reads the Certificate Revocation List (CRL) from the file \f3crl_\fR\&. A CRL is a list of digital certificates that were revoked by the CA that issued them\&. The CA generates the \f3crl_\fR file\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   617
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   618
\fINote:\fR This option can be used independently of a keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   619
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   620
-storepasswd
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   621
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   622
\f3[-new new_storepass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   623
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   624
Changes the password used to protect the integrity of the keystore contents\&. The new password is \f3new_storepass\fR, which must be at least 6 characters\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   625
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   626
-keypasswd
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   627
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   628
\f3{-alias alias} [-keypass old_keypass] [-new new_keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   629
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   630
Changes the password under which the private/secret key identified by \f3alias\fR is protected, from \f3old_keypass\fR to \f3new_keypass\fR, which must be at least 6 characters\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   631
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   632
If the \f3-keypass\fR option is not provided at the command line, and the key password is different from the keystore password, then the user is prompted for it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   633
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   634
If the \f3-new\fR option is not provided at the command line, then the user is prompted for it
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   635
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   636
-delete
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   637
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   638
\f3[-alias alias] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   639
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   640
Deletes from the keystore the entry identified by \f3alias\fR\&. The user is prompted for the alias, when no alias is provided at the command line\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   641
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   642
-changealias
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   643
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   644
\f3{-alias alias} [-destalias destalias] [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   645
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   646
Move an existing keystore entry from the specified \f3alias\fR to a new alias, \f3destalias\fR\&. If no destination alias is provided, then the command prompts for one\&. If the original entry is protected with an entry password, then the password can be supplied with the \f3-keypass\fR option\&. If no key password is provided, then the \f3storepass\fR (if provided) is attempted first\&. If the attempt fails, then the user is prompted for a password\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   647
.TP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   648
-help
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   649
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   650
Lists the basic commands and their options\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   651
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   652
For more information about a specific command, enter the following, where \f3command_name\fR is the name of the command: \f3keytool -command_name -help\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   653
.SH EXAMPLES    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   654
This example walks through the sequence of steps to create a keystore for managing public/private key pair and certificates from trusted entities\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   655
.SS GENERATE\ THE\ KEY\ PAIR    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   656
First, create a keystore and generate the key pair\&. You can use a command such as the following typed as a single line:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   657
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   658
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   659
\f3keytool \-genkeypair \-dname "cn=Mark Jones, ou=Java, o=Oracle, c=US"\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   660
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   661
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   662
\f3    \-alias business \-keypass <new password for private key>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   663
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   664
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   665
\f3    \-keystore /working/mykeystore\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   666
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   667
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   668
\f3    \-storepass <new password for keystore> \-validity 180\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   669
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   670
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   671
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   672
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   673
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   674
The command creates the keystore named \f3mykeystore\fR in the working directory (assuming it does not already exist), and assigns it the password specified by \f3<new password for keystore>\fR\&. It generates a public/private key pair for the entity whose distinguished name has a common name of Mark Jones, organizational unit of Java, organization of Oracle and two-letter country code of US\&. It uses the default DSA key generation algorithm to create the keys; both are 1024 bits\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   675
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   676
The command uses the default SHA1withDSA signature algorithm to create a self-signed certificate that includes the public key and the distinguished name information\&. The certificate is valid for 180 days, and is associated with the private key in a keystore entry referred to by the alias \f3business\fR\&. The private key is assigned the password specified by \f3<new password for private key>\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   677
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   678
The command is significantly shorter when the option defaults are accepted\&. In this case, no options are required, and the defaults are used for unspecified options that have default values\&. You are prompted for any required values\&. You could have the following:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   679
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   680
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   681
\f3keytool \-genkeypair\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   682
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   683
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   684
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   685
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   686
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   687
In this case, a keystore entry with the alias \f3mykey\fR is created, with a newly generated key pair and a certificate that is valid for 90 days\&. This entry is placed in the keystore named \f3\&.keystore\fR in your home directory\&. The keystore is created when it does not already exist\&. You are prompted for the distinguished name information, the keystore password, and the private key password\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   688
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   689
The rest of the examples assume you executed the \f3-genkeypair\fR command without options specified, and that you responded to the prompts with values equal to those specified in the first \f3-genkeypair\fR command\&. For example, a distinguished name of \f3cn=Mark Jones\fR, \f3ou=Java\fR, \f3o=Oracle\fR, \f3c=US\fR)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   690
.SS REQUEST\ A\ SIGNED\ CERTIFICATE\ FROM\ A\ CA    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   691
Generating the key pair created a self-signed certificate\&. A certificate is more likely to be trusted by others when it is signed by a Certification Authority (CA)\&. To get a CA signature, first generate a Certificate Signing Request (CSR), as follows:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   692
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   693
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   694
\f3keytool \-certreq \-file MarkJ\&.csr\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   695
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   696
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   697
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   698
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   699
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   700
This creates a CSR for the entity identified by the default alias \f3mykey\fR and puts the request in the file named MarkJ\&.csr\&. Submit this file to a CA, such as VeriSign\&. The CA authenticates you, the requestor (usually off-line), and returns a certificate, signed by them, authenticating your public key\&. In some cases, the CA returns a chain of certificates, each one authenticating the public key of the signer of the previous certificate in the chain\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   701
.SS IMPORT\ A\ CERTIFICATE\ FOR\ THE\ CA    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   702
You now need to replace the self-signed certificate with a certificate chain, where each certificate in the chain authenticates the public key of the signer of the previous certificate in the chain, up to a root CA\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   703
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   704
Before you import the certificate reply from a CA, you need one or more trusted certificates in your keystore or in the \f3cacerts\fR keystore file\&. See \f3-importcert\fR in Commands\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   705
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   706
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   707
If the certificate reply is a certificate chain, then you need the top certificate of the chain\&. The root CA certificate that authenticates the public key of the CA\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   708
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   709
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   710
If the certificate reply is a single certificate, then you need a certificate for the issuing CA (the one that signed it)\&. If that certificate is not self-signed, then you need a certificate for its signer, and so on, up to a self-signed root CA certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   711
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   712
The \f3cacerts\fR keystore file ships with several VeriSign root CA certificates, so you probably will not need to import a VeriSign certificate as a trusted certificate in your keystore\&. But if you request a signed certificate from a different CA, and a certificate authenticating that CA\&'s public key was not added to \f3cacerts\fR, then you must import a certificate from the CA as a trusted certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   713
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   714
A certificate from a CA is usually either self-signed or signed by another CA, in which case you need a certificate that authenticates that CA\&'s public key\&. Suppose company ABC, Inc\&., is a CA, and you obtain a file named A\f3BCCA\&.cer\fR that is supposed to be a self-signed certificate from ABC, that authenticates that CA\&'s public key\&. Be careful to ensure the certificate is valid before you import it as a trusted certificate\&. View it first with the \f3keytool -printcert\fR command or the \f3keytool -importcert\fR command without the \f3-noprompt\fR option, and make sure that the displayed certificate fingerprints match the expected ones\&. You can call the person who sent the certificate, and compare the fingerprints that you see with the ones that they show or that a secure public key repository shows\&. Only when the fingerprints are equal is it guaranteed that the certificate was not replaced in transit with somebody else\&'s (for example, an attacker\&'s) certificate\&. If such an attack takes place, and you did not check the certificate before you imported it, then you would be trusting anything the attacker has signed\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   715
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   716
If you trust that the certificate is valid, then you can add it to your keystore with the following command:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   717
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   718
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   719
\f3keytool \-importcert \-alias abc \-file ABCCA\&.cer\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   720
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   721
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   722
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   723
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   724
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   725
This command creates a trusted certificate entry in the keystore, with the data from the file ABCCA\&.cer, and assigns the alias \f3abc\fR to the entry\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   726
.SS IMPORT\ THE\ CERTIFICATE\ REPLY\ FROM\ THE\ CA    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   727
After you import a certificate that authenticates the public key of the CA you submitted your certificate signing request to (or there is already such a certificate in the cacerts file), you can import the certificate reply and replace your self-signed certificate with a certificate chain\&. This chain is the one returned by the CA in response to your request (when the CA reply is a chain), or one constructed (when the CA reply is a single certificate) using the certificate reply and trusted certificates that are already available in the keystore where you import the reply or in the \f3cacerts\fR keystore file\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   728
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   729
For example, if you sent your certificate signing request to VeriSign, then you can import the reply with the following, which assumes the returned certificate is named VSMarkJ\&.cer:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   730
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   731
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   732
\f3keytool \-importcert \-trustcacerts \-file VSMarkJ\&.cer\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   733
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   734
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   735
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   736
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   737
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   738
.SS EXPORT\ A\ CERTIFICATE\ THAT\ AUTHENTICATES\ THE\ PUBLIC\ KEY    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   739
If you used the \f3jarsigner\fR command to sign a Java Archive (JAR) file, then clients that want to use the file will want to authenticate your signature\&. One way the clients can authenticate you is by first importing your public key certificate into their keystore as a trusted entry\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   740
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   741
You can export the certificate and supply it to your clients\&. As an example, you can copy your certificate to a file named MJ\&.cer with the following command that assumes the entry has an alias of \f3mykey\fR:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   742
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   743
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   744
\f3keytool \-exportcert \-alias mykey \-file MJ\&.cer\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   745
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   746
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   747
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   748
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   749
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   750
With the certificate and the signed JAR file, a client can use the \f3jarsigner\fR command to authenticate your signature\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   751
.SS IMPORT\ KEYSTORE    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   752
The command \f3importkeystore\fR is used to import an entire keystore into another keystore, which means all entries from the source keystore, including keys and certificates, are all imported to the destination keystore within a single command\&. You can use this command to import entries from a different type of keystore\&. During the import, all new entries in the destination keystore will have the same alias names and protection passwords (for secret keys and private keys)\&. If the \f3keytool\fR command cannot recover the private keys or secret keys from the source keystore, then it prompts you for a password\&. If it detects alias duplication, then it asks you for a new alias, and you can specify a new alias or simply allow the \f3keytool\fR command to overwrite the existing one\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   753
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   754
For example, to import entries from a typical JKS type keystore key\&.jks into a PKCS #11 type hardware-based keystore, use the command:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   755
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   756
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   757
\f3keytool \-importkeystore\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   758
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   759
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   760
\f3    \-srckeystore key\&.jks \-destkeystore NONE\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   761
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   762
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   763
\f3    \-srcstoretype JKS \-deststoretype PKCS11\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   764
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   765
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   766
\f3    \-srcstorepass <src keystore password>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   767
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   768
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   769
\f3    \-deststorepass <destination keystore pwd>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   770
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   771
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   772
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   773
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   774
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   775
The \f3importkeystore\fR command can also be used to import a single entry from a source keystore to a destination keystore\&. In this case, besides the options you see in the previous example, you need to specify the alias you want to import\&. With the \f3-srcalias\fR option specified, you can also specify the destination alias name in the command line, as well as protection password for a secret/private key and the destination protection password you want\&. The following command demonstrates this:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   776
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   777
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   778
\f3keytool \-importkeystore\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   779
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   780
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   781
\f3    \-srckeystore key\&.jks \-destkeystore NONE\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   782
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   783
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   784
\f3    \-srcstoretype JKS \-deststoretype PKCS11\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   785
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   786
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   787
\f3    \-srcstorepass <src keystore password>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   788
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   789
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   790
\f3    \-deststorepass <destination keystore pwd>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   791
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   792
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   793
\f3    \-srcalias myprivatekey \-destalias myoldprivatekey\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   794
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   795
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   796
\f3    \-srckeypass <source entry password>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   797
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   798
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   799
\f3    \-destkeypass <destination entry password>\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   800
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   801
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   802
\f3    \-noprompt\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   803
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   804
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   805
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   806
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   807
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   808
.SS GENERATE\ CERTIFICATES\ FOR\ AN\ SSL\ SERVER    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   809
The following are \f3keytool\fR commands to generate key pairs and certificates for three entities: Root CA (\f3root\fR), Intermediate CA (\f3ca\fR), and SSL server (\f3server\fR)\&. Ensure that you store all the certificates in the same keystore\&. In these examples, RSA is the recommended the key algorithm\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   810
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   811
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   812
\f3keytool \-genkeypair \-keystore root\&.jks \-alias root \-ext bc:c\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   813
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   814
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   815
\f3keytool \-genkeypair \-keystore ca\&.jks \-alias ca \-ext bc:c\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   816
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   817
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   818
\f3keytool \-genkeypair \-keystore server\&.jks \-alias server\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   819
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   820
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   821
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   822
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   823
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   824
\f3keytool \-keystore root\&.jks \-alias root \-exportcert \-rfc > root\&.pem\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   825
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   826
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   827
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   828
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   829
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   830
\f3keytool \-storepass <storepass> \-keystore ca\&.jks \-certreq \-alias ca |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   831
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   832
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   833
\f3    keytool \-storepass <storepass> \-keystore root\&.jks\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   834
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   835
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   836
\f3    \-gencert \-alias root \-ext BC=0 \-rfc > ca\&.pem\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   837
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   838
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   839
\f3keytool \-keystore ca\&.jks \-importcert \-alias ca \-file ca\&.pem\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   840
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   841
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   842
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   843
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   844
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   845
\f3keytool \-storepass <storepass> \-keystore server\&.jks \-certreq \-alias server |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   846
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   847
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   848
\f3    keytool \-storepass <storepass> \-keystore ca\&.jks \-gencert \-alias ca\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   849
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   850
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   851
\f3    \-ext ku:c=dig,kE \-rfc > server\&.pem\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   852
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   853
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   854
\f3cat root\&.pem ca\&.pem server\&.pem |\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   855
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   856
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   857
\f3    keytool \-keystore server\&.jks \-importcert \-alias server\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   858
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   859
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   860
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   861
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   862
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   863
.SH TERMS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   864
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   865
Keystore
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   866
A keystore is a storage facility for cryptographic keys and certificates\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   867
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   868
Keystore entries
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   869
Keystores can have different types of entries\&. The two most applicable entry types for the \f3keytool\fR command include the following:
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   870
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   871
\fIKey entries\fR: Each entry holds very sensitive cryptographic key information, which is stored in a protected format to prevent unauthorized access\&. Typically, a key stored in this type of entry is a secret key, or a private key accompanied by the certificate chain for the corresponding public key\&. See Certificate Chains\&. The \f3keytool\fR command can handle both types of entries, while the \f3jarsigner\fR tool only handles the latter type of entry, that is private keys and their associated certificate chains\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   872
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   873
\fITrusted certificate entries\fR: Each entry contains a single public key certificate that belongs to another party\&. The entry is called a trusted certificate because the keystore owner trusts that the public key in the certificate belongs to the identity identified by the subject (owner) of the certificate\&. The issuer of the certificate vouches for this, by signing the certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   874
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   875
KeyStore aliases
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   876
All keystore entries (key and trusted certificate entries) are accessed by way of unique aliases\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   877
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   878
An alias is specified when you add an entity to the keystore with the \f3-genseckey\fR command to generate a secret key, the \f3-genkeypair\fR command to generate a key pair (public and private key), or the \f3-importcert\fR command to add a certificate or certificate chain to the list of trusted certificates\&. Subsequent \f3keytool\fR commands must use this same alias to refer to the entity\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   879
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   880
For example, you can use the alias \f3duke\fR to generate a new public/private key pair and wrap the public key into a self-signed certificate with the following command\&. See Certificate Chains\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   881
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   882
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   883
\f3keytool \-genkeypair \-alias duke \-keypass dukekeypasswd\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   884
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   885
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   886
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   887
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   888
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   889
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   890
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   891
This example specifies an initial password of \f3dukekeypasswd\fR required by subsequent commands to access the private key associated with the alias \f3duke\fR\&. If you later want to change Duke\&'s private key password, use a command such as the following:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   892
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   893
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   894
\f3keytool \-keypasswd \-alias duke \-keypass dukekeypasswd \-new newpass\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   895
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   896
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   897
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   898
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   899
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   900
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   901
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   902
This changes the password from \f3dukekeypasswd\fR to \f3newpass\fR\&. A password should not be specified on a command line or in a script unless it is for testing purposes, or you are on a secure system\&. If you do not specify a required password option on a command line, then you are prompted for it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   903
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   904
KeyStore implementation
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   905
The \f3KeyStore\fR class provided in the \f3java\&.security\fR package supplies well-defined interfaces to access and modify the information in a keystore\&. It is possible for there to be multiple different concrete implementations, where each implementation is that for a particular type of keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   906
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   907
Currently, two command-line tools (\f3keytool\fR and \f3jarsigner\fR) and a GUI-based tool named Policy Tool make use of keystore implementations\&. Because the \f3KeyStore\fR class is \f3public\fR, users can write additional security applications that use it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   908
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   909
There is a built-in default implementation, provided by Oracle\&. It implements the keystore as a file with a proprietary keystore type (format) named JKS\&. It protects each private key with its individual password, and also protects the integrity of the entire keystore with a (possibly different) password\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   910
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   911
Keystore implementations are provider-based\&. More specifically, the application interfaces supplied by \f3KeyStore\fR are implemented in terms of a Service Provider Interface (SPI)\&. That is, there is a corresponding abstract \f3KeystoreSpi\fR class, also in the \f3java\&.security package\fR, which defines the Service Provider Interface methods that providers must implement\&. The term \fIprovider\fR refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API\&. To provide a keystore implementation, clients must implement a provider and supply a \f3KeystoreSpi\fR subclass implementation, as described in How to Implement a Provider in the Java Cryptography Architecture at http://docs\&.oracle\&.com/javase/8/docs/technotes/guides/security/crypto/HowToImplAProvider\&.html
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   912
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   913
Applications can choose different types of keystore implementations from different providers, using the \f3getInstance\fR factory method supplied in the \f3KeyStore\fR class\&. A keystore type defines the storage and data format of the keystore information, and the algorithms used to protect private/secret keys in the keystore and the integrity of the keystore\&. Keystore implementations of different types are not compatible\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   914
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   915
The \f3keytool\fR command works on any file-based keystore implementation\&. It treats the keystore location that is passed to it at the command line as a file name and converts it to a \f3FileInputStream\fR, from which it loads the keystore information\&.)The \f3jarsigner\fR and \f3policytool\fR commands can read a keystore from any location that can be specified with a URL\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   916
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   917
For \f3keytool\fR and \f3jarsigner\fR, you can specify a keystore type at the command line, with the \f3-storetype\fR option\&. For Policy Tool, you can specify a keystore type with the \fIKeystore\fR menu\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   918
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   919
If you do not explicitly specify a keystore type, then the tools choose a keystore implementation based on the value of the \f3keystore\&.type\fR property specified in the security properties file\&. The security properties file is called \f3java\&.security\fR, and resides in the security properties directory, \f3java\&.home\elib\esecurity\fR on Windows and \f3java\&.home/lib/security\fR on Oracle Solaris, where \f3java\&.home\fR is the runtime environment directory\&. The \f3jre\fR directory in the SDK or the top-level directory of the Java Runtime Environment (JRE)\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   920
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   921
Each tool gets the \f3keystore\&.type\fR value and then examines all the currently installed providers until it finds one that implements a keystores of that type\&. It then uses the keystore implementation from that provider\&.The \f3KeyStore\fR class defines a static method named \f3getDefaultType\fR that lets applications and applets retrieve the value of the \f3keystore\&.type\fR property\&. The following line of code creates an instance of the default keystore type as specified in the \f3keystore\&.type\fR property:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   922
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   923
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   924
\f3KeyStore keyStore = KeyStore\&.getInstance(KeyStore\&.getDefaultType());\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   925
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   926
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   927
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   928
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   929
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   930
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   931
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   932
The default keystore type is \f3jks\fR, which is the proprietary type of the keystore implementation provided by Oracle\&. This is specified by the following line in the security properties file:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   933
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   934
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   935
\f3keystore\&.type=jks\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   936
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   937
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   938
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   939
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   940
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   941
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   942
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   943
To have the tools utilize a keystore implementation other than the default, you can change that line to specify a different keystore type\&. For example, if you have a provider package that supplies a keystore implementation for a keystore type called \f3pkcs12\fR, then change the line to the following:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   944
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   945
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   946
\f3keystore\&.type=pkcs12\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   947
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   948
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   949
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   950
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   951
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   952
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   953
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   954
\fINote:\fR Case does not matter in keystore type designations\&. For example, JKS would be considered the same as jks\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   955
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   956
Certificate
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   957
A certificate (or public-key certificate) is a digitally signed statement from one entity (the issuer), saying that the public key and some other information of another entity (the subject) has some specific value\&. The following terms are related to certificates:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   958
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   959
\fIPublic Keys\fR: These are numbers associated with a particular entity, and are intended to be known to everyone who needs to have trusted interactions with that entity\&. Public keys are used to verify signatures\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   960
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   961
\fIDigitally Signed\fR: If some data is digitally signed, then it is stored with the identity of an entity and a signature that proves that entity knows about the data\&. The data is rendered unforgeable by signing with the entity\&'s private key\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   962
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   963
\fIIdentity\fR: A known way of addressing an entity\&. In some systems, the identity is the public key, and in others it can be anything from an Oracle Solaris UID to an email address to an X\&.509 distinguished name\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   964
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   965
\fISignature\fR: A signature is computed over some data using the private key of an entity\&. The signer, which in the case of a certificate is also known as the issuer\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   966
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   967
\fIPrivate Keys\fR: These are numbers, each of which is supposed to be known only to the particular entity whose private key it is (that is, it is supposed to be kept secret)\&. Private and public keys exist in pairs in all public key cryptography systems (also referred to as public key crypto systems)\&. In a typical public key crypto system, such as DSA, a private key corresponds to exactly one public key\&. Private keys are used to compute signatures\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   968
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   969
\fIEntity\fR: An entity is a person, organization, program, computer, business, bank, or something else you are trusting to some degree\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   970
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   971
Public key cryptography requires access to users\&' public keys\&. In a large-scale networked environment, it is impossible to guarantee that prior relationships between communicating entities were established or that a trusted repository exists with all used public keys\&. Certificates were invented as a solution to this public key distribution problem\&. Now a Certification Authority (CA) can act as a trusted third party\&. CAs are entities such as businesses that are trusted to sign (issue) certificates for other entities\&. It is assumed that CAs only create valid and reliable certificates because they are bound by legal agreements\&. There are many public Certification Authorities, such as VeriSign, Thawte, Entrust, and so on\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
   972
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   973
You can also run your own Certification Authority using products such as Microsoft Certificate Server or the Entrust CA product for your organization\&. With the \f3keytool\fR command, it is possible to display, import, and export certificates\&. It is also possible to generate self-signed certificates\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   974
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   975
The \f3keytool\fR command currently handles X\&.509 certificates\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   976
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   977
X\&.509 Certificates
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   978
The X\&.509 standard defines what information can go into a certificate and describes how to write it down (the data format)\&. All the data in a certificate is encoded with two related standards called ASN\&.1/DER\&. Abstract Syntax Notation 1 describes data\&. The Definite Encoding Rules describe a single way to store and transfer that data\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   979
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   980
All X\&.509 certificates have the following data, in addition to the signature:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   981
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   982
\fIVersion\fR: This identifies which version of the X\&.509 standard applies to this certificate, which affects what information can be specified in it\&. Thus far, three versions are defined\&. The \f3keytool\fR command can import and export v1, v2, and v3 certificates\&. It generates v3 certificates\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   983
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   984
X\&.509 Version 1 has been available since 1988, is widely deployed, and is the most generic\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   985
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   986
X\&.509 Version 2 introduced the concept of subject and issuer unique identifiers to handle the possibility of reuse of subject or issuer names over time\&. Most certificate profile documents strongly recommend that names not be reused and that certificates should not make use of unique identifiers\&. Version 2 certificates are not widely used\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   987
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   988
X\&.509 Version 3 is the most recent (1996) and supports the notion of extensions where anyone can define an extension and include it in the certificate\&. Some common extensions are: KeyUsage (limits the use of the keys to particular purposes such as \f3signing-only\fR) and AlternativeNames (allows other identities to also be associated with this public key, for example\&. DNS names, email addresses, IP addresses)\&. Extensions can be marked critical to indicate that the extension should be checked and enforced or used\&. For example, if a certificate has the KeyUsage extension marked critical and set to \f3keyCertSign\fR, then when this certificate is presented during SSL communication, it should be rejected because the certificate extension indicates that the associated private key should only be used for signing certificates and not for SSL use\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   989
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   990
\fISerial number\fR: The entity that created the certificate is responsible for assigning it a serial number to distinguish it from other certificates it issues\&. This information is used in numerous ways\&. For example, when a certificate is revoked its serial number is placed in a Certificate Revocation List (CRL)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   991
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   992
\fISignature algorithm identifier\fR: This identifies the algorithm used by the CA to sign the certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   993
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   994
\fIIssuer name\fR: The X\&.500 Distinguished Name of the entity that signed the certificate\&. See X\&.500 Distinguished Names\&. This is typically a CA\&. Using this certificate implies trusting the entity that signed this certificate\&. In some cases, such as root or top-level CA certificates, the issuer signs its own certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   995
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   996
\fIValidity period\fR: Each certificate is valid only for a limited amount of time\&. This period is described by a start date and time and an end date and time, and can be as short as a few seconds or almost as long as a century\&. The validity period chosen depends on a number of factors, such as the strength of the private key used to sign the certificate, or the amount one is willing to pay for a certificate\&. This is the expected period that entities can rely on the public value, when the associated private key has not been compromised\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   997
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   998
\fISubject name\fR: The name of the entity whose public key the certificate identifies\&. This name uses the X\&.500 standard, so it is intended to be unique across the Internet\&. This is the X\&.500 Distinguished Name (DN) of the entity\&. See X\&.500 Distinguished Names\&. For example,
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
   999
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1000
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1001
\f3CN=Java Duke, OU=Java Software Division, O=Oracle Corporation, C=US\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1002
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1003
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1004
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1005
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1006
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1007
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1008
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1009
These refer to the subject\&'s common name (CN), organizational unit (OU), organization (O), and country (C)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1010
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1011
\fISubject public key information\fR: This is the public key of the entity being named with an algorithm identifier that specifies which public key crypto system this key belongs to and any associated key parameters\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1012
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1013
Certificate Chains
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1014
The \f3keytool\fR command can create and manage keystore key entries that each contain a private key and an associated certificate chain\&. The first certificate in the chain contains the public key that corresponds to the private key\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1015
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1016
When keys are first generated, the chain starts off containing a single element, a self-signed certificate\&. See \f3-genkeypair\fR in Commands\&. A self-signed certificate is one for which the issuer (signer) is the same as the subject\&. The subject is the entity whose public key is being authenticated by the certificate\&. Whenever the \f3-genkeypair\fR command is called to generate a new public/private key pair, it also wraps the public key into a self-signed certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1017
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1018
Later, after a Certificate Signing Request (CSR) was generated with the \f3-certreq\fR command and sent to a Certification Authority (CA), the response from the CA is imported with \f3-importcert\fR, and the self-signed certificate is replaced by a chain of certificates\&. See the \f3-certreq\fR and \f3-importcert\fR options in Commands\&. At the bottom of the chain is the certificate (reply) issued by the CA authenticating the subject\&'s public key\&. The next certificate in the chain is one that authenticates the CA\&'s public key\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1019
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1020
In many cases, this is a self-signed certificate, which is a certificate from the CA authenticating its own public key, and the last certificate in the chain\&. In other cases, the CA might return a chain of certificates\&. In this case, the bottom certificate in the chain is the same (a certificate signed by the CA, authenticating the public key of the key entry), but the second certificate in the chain is a certificate signed by a different CA that authenticates the public key of the CA you sent the CSR to\&. The next certificate in the chain is a certificate that authenticates the second CA\&'s key, and so on, until a self-signed root certificate is reached\&. Each certificate in the chain (after the first) authenticates the public key of the signer of the previous certificate in the chain\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1021
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1022
Many CAs only return the issued certificate, with no supporting chain, especially when there is a flat hierarchy (no intermediates CAs)\&. In this case, the certificate chain must be established from trusted certificate information already stored in the keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1023
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1024
A different reply format (defined by the PKCS #7 standard) includes the supporting certificate chain in addition to the issued certificate\&. Both reply formats can be handled by the \f3keytool\fR command\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1025
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1026
The top-level (root) CA certificate is self-signed\&. However, the trust into the root\&'s public key does not come from the root certificate itself, but from other sources such as a newspaper\&. This is because anybody could generate a self-signed certificate with the distinguished name of, for example, the VeriSign root CA\&. The root CA public key is widely known\&. The only reason it is stored in a certificate is because this is the format understood by most tools, so the certificate in this case is only used as a vehicle to transport the root CA\&'s public key\&. Before you add the root CA certificate to your keystore, you should view it with the \f3-printcert\fR option and compare the displayed fingerprint with the well-known fingerprint obtained from a newspaper, the root CA\&'s Web page, and so on\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1027
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1028
The cacerts Certificates File
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1029
A certificates file named \f3cacerts\fR resides in the security properties directory, \f3java\&.home\elib\esecurity\fR on Windows and \f3java\&.home/lib/security\fR on Oracle Solaris, where \f3java\&.home\fR is the runtime environment\&'s directory, which would be the \f3jre\fR directory in the SDK or the top-level directory of the JRE\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1030
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1031
The \f3cacerts\fR file represents a system-wide keystore with CA certificates\&. System administrators can configure and manage that file with the \f3keytool\fR command by specifying \f3jks\fR as the keystore type\&. The \f3cacerts\fR keystore file ships with a default set of root CA certificates\&. You can list the default certificates with the following command:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1032
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1033
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1034
\f3keytool \-list \-keystore java\&.home/lib/security/cacerts\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1035
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1036
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1037
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1038
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1039
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1040
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1041
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1042
The initial password of the \f3cacerts\fR keystore file is \f3changeit\fR\&. System administrators should change that password and the default access permission of that file upon installing the SDK\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1043
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1044
\fINote:\fR It is important to verify your \f3cacerts\fR file\&. Because you trust the CAs in the \f3cacerts\fR file as entities for signing and issuing certificates to other entities, you must manage the \f3cacerts\fR file carefully\&. The \f3cacerts\fR file should contain only certificates of the CAs you trust\&. It is your responsibility to verify the trusted root CA certificates bundled in the \f3cacerts\fR file and make your own trust decisions\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1045
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1046
To remove an untrusted CA certificate from the \f3cacerts\fR file, use the \f3delete\fR option of the \f3keytool\fR command\&. You can find the \f3cacerts\fR file in the JRE installation directory\&. Contact your system administrator if you do not have permission to edit this file
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1047
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1048
Internet RFC 1421 Certificate Encoding Standard
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1049
Certificates are often stored using the printable encoding format defined by the Internet RFC 1421 standard, instead of their binary encoding\&. This certificate format, also known as Base64 encoding, makes it easy to export certificates to other applications by email or through some other mechanism\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1050
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1051
Certificates read by the \f3-importcert\fR and \f3-printcert\fR commands can be in either this format or binary encoded\&. The \f3-exportcert\fR command by default outputs a certificate in binary encoding, but will instead output a certificate in the printable encoding format, when the \f3-rfc\fR option is specified\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1052
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1053
The \f3-list\fR command by default prints the SHA1 fingerprint of a certificate\&. If the \f3-v\fR option is specified, then the certificate is printed in human-readable format\&. If the \f3-rfc\fR option is specified, then the certificate is output in the printable encoding format\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1054
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1055
In its printable encoding format, the encoded certificate is bounded at the beginning and end by the following text:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1056
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1057
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1058
\f3\-\-\-\-\-BEGIN CERTIFICATE\-\-\-\-\-\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1059
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1060
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1061
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1062
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1063
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1064
\f3encoded certificate goes here\&. \fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1065
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1066
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1067
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1068
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1069
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1070
\f3\-\-\-\-\-END CERTIFICATE\-\-\-\-\-\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1071
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1072
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1073
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1074
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1075
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1076
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1077
.TP     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1078
X\&.500 Distinguished Names
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1079
X\&.500 Distinguished Names are used to identify entities, such as those that are named by the \f3subject\fR and \f3issuer\fR (signer) fields of X\&.509 certificates\&. The \f3keytool\fR command supports the following subparts:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1080
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1081
\fIcommonName\fR: The common name of a person such as Susan Jones\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1082
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1083
\fIorganizationUnit\fR: The small organization (such as department or division) name\&. For example, Purchasing\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1084
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1085
\fIlocalityName\fR: The locality (city) name, for example, Palo Alto\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1086
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1087
\fIstateName\fR: State or province name, for example, California\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1088
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1089
\fIcountry\fR: Two-letter country code, for example, CH\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1090
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1091
When you supply a distinguished name string as the value of a \f3-dname\fR option, such as for the \f3-genkeypair\fR command, the string must be in the following format:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1092
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1093
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1094
\f3CN=cName, OU=orgUnit, O=org, L=city, S=state, C=countryCode\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1095
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1096
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1097
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1098
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1099
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1100
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1101
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1102
All the italicized items represent actual values and the previous keywords are abbreviations for the following:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1103
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1104
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1105
\f3CN=commonName\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1106
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1107
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1108
\f3OU=organizationUnit\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1109
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1110
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1111
\f3O=organizationName\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1112
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1113
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1114
\f3L=localityName\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1115
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1116
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1117
\f3S=stateName\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1118
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1119
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1120
\f3C=country\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1121
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1122
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1123
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1124
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1125
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1126
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
  1127
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1128
A sample distinguished name string is:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1129
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1130
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1131
\f3CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino, S=California, C=US\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1132
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1133
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1134
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1135
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1136
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1137
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1138
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1139
A sample command using such a string is:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1140
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1141
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1142
\f3keytool \-genkeypair \-dname "CN=Mark Smith, OU=Java, O=Oracle, L=Cupertino,\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1143
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1144
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1145
\f3S=California, C=US" \-alias mark\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1146
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1147
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1148
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1149
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1150
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1151
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1152
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1153
Case does not matter for the keyword abbreviations\&. For example, CN, cn, and Cn are all treated the same\&.
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
  1154
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1155
Order matters; each subcomponent must appear in the designated order\&. However, it is not necessary to have all the subcomponents\&. You can use a subset, for example:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1156
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1157
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1158
\f3CN=Steve Meier, OU=Java, O=Oracle, C=US\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1159
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1160
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1161
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1162
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1163
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1164
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
  1165
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1166
If a distinguished name string value contains a comma, then the comma must be escaped by a backslash (\e) character when you specify the string on a command line, as in:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1167
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1168
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1169
\f3cn=Peter Schuster, ou=Java\e, Product Development, o=Oracle, c=US\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1170
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1171
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1172
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1173
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1174
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1175
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1176
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1177
It is never necessary to specify a distinguished name string on a command line\&. When the distinguished name is needed for a command, but not supplied on the command line, the user is prompted for each of the subcomponents\&. In this case, a comma does not need to be escaped by a backslash (\e)\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1178
.SH WARNINGS    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1179
.SS IMPORTING\ TRUSTED\ CERTIFICATES\ WARNING    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1180
\fIImportant\fR: Be sure to check a certificate very carefully before importing it as a trusted certificate\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1181
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1182
Windows Example:
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
  1183
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1184
View the certificate first with the \f3-printcert\fR command or the \f3-importcert\fR command without the \f3-noprompt\fR option\&. Ensure that the displayed certificate fingerprints match the expected ones\&. For example, suppose sends or emails you a certificate that you put it in a file named \f3\etmp\ecert\fR\&. Before you consider adding the certificate to your list of trusted certificates, you can execute a \f3-printcert\fR command to view its fingerprints, as follows:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1185
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1186
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1187
\f3  keytool \-printcert \-file \etmp\ecert\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1188
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1189
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1190
\f3    Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1191
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1192
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1193
\f3    Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1194
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1195
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1196
\f3    Serial Number: 59092b34\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1197
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1198
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1199
\f3    Valid from: Thu Sep 25 18:01:13 PDT 1997 until: Wed Dec 24 17:01:13 PST 1997\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1200
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1201
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1202
\f3    Certificate Fingerprints:\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1203
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1204
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1205
\f3         MD5:  11:81:AD:92:C8:E5:0E:A2:01:2E:D4:7A:D7:5F:07:6F\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1206
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1207
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1208
\f3         SHA1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1209
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1210
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1211
\f3         SHA256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90:\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1212
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1213
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1214
\f3                 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1215
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1216
.sp     
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
  1217
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1218
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1219
Oracle Solaris Example:
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents:
diff changeset
  1220
21743
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1221
View the certificate first with the \f3-printcert\fR command or the \f3-importcert\fR command without the \f3-noprompt\fR option\&. Ensure that the displayed certificate fingerprints match the expected ones\&. For example, suppose someone sends or emails you a certificate that you put it in a file named \f3/tmp/cert\fR\&. Before you consider adding the certificate to your list of trusted certificates, you can execute a \f3-printcert\fR command to view its fingerprints, as follows:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1222
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1223
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1224
\f3  keytool \-printcert \-file /tmp/cert\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1225
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1226
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1227
\f3    Owner: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1228
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1229
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1230
\f3    Issuer: CN=ll, OU=ll, O=ll, L=ll, S=ll, C=ll\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1231
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1232
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1233
\f3    Serial Number: 59092b34\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1234
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1235
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1236
\f3    Valid from: Thu Sep 25 18:01:13 PDT 1997 until: Wed Dec 24 17:01:13 PST 1997\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1237
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1238
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1239
\f3    Certificate Fingerprints:\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1240
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1241
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1242
\f3         MD5:  11:81:AD:92:C8:E5:0E:A2:01:2E:D4:7A:D7:5F:07:6F\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1243
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1244
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1245
\f3         SHA1: 20:B6:17:FA:EF:E5:55:8A:D0:71:1F:E8:D6:9D:C0:37:13:0E:5E:FE\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1246
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1247
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1248
\f3         SHA256: 90:7B:70:0A:EA:DC:16:79:92:99:41:FF:8A:FE:EB:90:\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1249
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1250
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1251
\f3                 17:75:E0:90:B2:24:4D:3A:2A:16:A6:E4:11:0F:67:A4\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1252
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1253
.nf     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1254
\f3\fP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1255
.fi     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1256
.sp     
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1257
Then call or otherwise contact the person who sent the certificate and compare the fingerprints that you see with the ones that they show\&. Only when the fingerprints are equal is it guaranteed that the certificate was not replaced in transit with somebody else\&'s certificate such as an attacker\&'s certificate\&. If such an attack took place, and you did not check the certificate before you imported it, then you would be trusting anything the attacker signed, for example, a JAR file with malicious class files inside\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1258
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1259
\fINote:\fR It is not required that you execute a \f3-printcert\fR command before importing a certificate\&. This is because before you add a certificate to the list of trusted certificates in the keystore, the \f3-importcert\fR command prints out the certificate information and prompts you to verify it\&. You can then stop the import operation\&. However, you can do this only when you call the \f3-importcert\fR command without the \f3-noprompt\fR option\&. If the \f3-noprompt\fR option is specified, then there is no interaction with the user\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1260
.SS PASSWORDS\ WARNING    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1261
Most commands that operate on a keystore require the store password\&. Some commands require a private/secret key password\&. Passwords can be specified on the command line in the \f3-storepass\fR and \f3-keypass\fR options\&. However, a password should not be specified on a command line or in a script unless it is for testing, or you are on a secure system\&. When you do not specify a required password option on a command line, you are prompted for it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1262
.SS CERTIFICATE\ CONFORMANCE\ WARNING    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1263
The Internet standard RFC 5280 has defined a profile on conforming X\&.509 certificates, which includes what values and value combinations are valid for certificate fields and extensions\&. See the standard at http://tools\&.ietf\&.org/rfc/rfc5280\&.txt
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1264
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1265
The \f3keytool\fR command does not enforce all of these rules so it can generate certificates that do not conform to the standard\&. Certificates that do not conform to the standard might be rejected by JRE or other applications\&. Users should ensure that they provide the correct options for \f3-dname\fR, \f3-ext\fR, and so on\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1266
.SH NOTES    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1267
.SS IMPORT\ A\ NEW\ TRUSTED\ CERTIFICATE    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1268
Before you add the certificate to the keystore, the \f3keytool\fR command verifies it by attempting to construct a chain of trust from that certificate to a self-signed certificate (belonging to a root CA), using trusted certificates that are already available in the keystore\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1269
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1270
If the \f3-trustcacerts\fR option was specified, then additional certificates are considered for the chain of trust, namely the certificates in a file named \f3cacerts\fR\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1271
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1272
If the \f3keytool\fR command fails to establish a trust path from the certificate to be imported up to a self-signed certificate (either from the keystore or the \f3cacerts\fR file), then the certificate information is printed, and the user is prompted to verify it by comparing the displayed certificate fingerprints with the fingerprints obtained from some other (trusted) source of information, which might be the certificate owner\&. Be very careful to ensure the certificate is valid before importing it as a trusted certificate\&. See Importing Trusted Certificates Warning\&. The user then has the option of stopping the import operation\&. If the \f3-noprompt\fR option is specified, then there is no interaction with the user\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1273
.SS IMPORT\ A\ CERTIFICATE\ REPLY    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1274
When you import a certificate reply, the certificate reply is validated with trusted certificates from the keystore, and optionally, the certificates configured in the \f3cacerts\fR keystore file when the \f3-trustcacert\fR\f3s\fR option is specified\&. See The cacerts Certificates File\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1275
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1276
The methods of determining whether the certificate reply is trusted are as follows:
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1277
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1278
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1279
If the reply is a single X\&.509 certificate, then the \f3keytool\fR command attempts to establish a trust chain, starting at the certificate reply and ending at a self-signed certificate (belonging to a root CA)\&. The certificate reply and the hierarchy of certificates is used to authenticate the certificate reply from the new certificate chain of aliases\&. If a trust chain cannot be established, then the certificate reply is not imported\&. In this case, the \f3keytool\fR command does not print the certificate and prompt the user to verify it, because it is very difficult for a user to determine the authenticity of the certificate reply\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1280
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1281
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1282
If the reply is a PKCS #7 formatted certificate chain or a sequence of X\&.509 certificates, then the chain is ordered with the user certificate first followed by zero or more CA certificates\&. If the chain ends with a self-signed root CA certificate and the\f3-trustcacerts\fR option was specified, the \f3keytool\fR command attempts to match it with any of the trusted certificates in the keystore or the \f3cacerts\fR keystore file\&. If the chain does not end with a self-signed root CA certificate and the \f3-trustcacerts\fR option was specified, the \f3keytool\fR command tries to find one from the trusted certificates in the keystore or the \f3cacerts\fR keystore file and add it to the end of the chain\&. If the certificate is not found and the \f3-noprompt\fR option is not specified, the information of the last certificate in the chain is printed, and the user is prompted to verify it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1283
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1284
If the public key in the certificate reply matches the user\&'s public key already stored with \f3alias\fR, then the old certificate chain is replaced with the new certificate chain in the reply\&. The old chain can only be replaced with a valid \f3keypass\fR, and so the password used to protect the private key of the entry is supplied\&. If no password is provided, and the private key password is different from the keystore password, the user is prompted for it\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1285
.PP
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1286
This command was named \f3-import\fR in earlier releases\&. This old name is still supported in this release\&. The new name, \f3-importcert\fR, is preferred going forward\&.
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1287
.SH SEE\ ALSO    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1288
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1289
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1290
jar(1)
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1291
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1292
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1293
jarsigner(1)
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1294
.TP 0.2i    
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1295
\(bu
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1296
Trail: Security Features in Java SE at http://docs\&.oracle\&.com/javase/tutorial/security/index\&.html
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1297
.RE
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1298
.br
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1299
'pl 8.5i
3d979da7bdf0 8029043: Update nroff files for JDK 8
rgallard
parents: 12047
diff changeset
  1300
'bp