232 \-providerArg provider_arg |
233 \-providerArg provider_arg |
233 Used in conjunction with \f2\-providerClass\fP. Represents an optional string input argument for the constructor of \f2provider_class_name\fP. |
234 Used in conjunction with \f2\-providerClass\fP. Represents an optional string input argument for the constructor of \f2provider_class_name\fP. |
234 .TP 3 |
235 .TP 3 |
235 \-protected |
236 \-protected |
236 Either \f2true\fP or \f2false\fP. This value should be specified as \f2true\fP if a password must be given via a protected authentication path such as a dedicated PIN reader. |
237 Either \f2true\fP or \f2false\fP. This value should be specified as \f2true\fP if a password must be given via a protected authentication path such as a dedicated PIN reader. |
237 .RE |
238 .LP |
238 |
239 Note: Since there are two keystores involved in \f2\-importkeystore\fP command, two options, namely, \f2\-srcprotected\fP and \f2\-destprotected\fP are provided for the source keystore and the destination keystore respectively. |
239 .LP |
240 .TP 3 |
|
241 \-ext {name{:critical}{=value}} |
|
242 Denotes an X.509 certificate extension. The option can be used in \f2\-genkeypair\fP and \f2\-gencert\fP to embed extensions into the certificate generated, or in \f2\-certreq\fP to show what extensions are requested in the certificate request. The option can appear multiple times. name can be a supported extension name (see below) or an arbitrary OID number. value, if provided, denotes the parameter for the extension; if omitted, denotes the default value (if defined) of the extension or the extension requires no parameter. The \f2":critical"\fP modifier, if provided, means the extension's isCritical attribute is true; otherwise, false. |
|
243 .RS 3 |
|
244 |
|
245 .LP |
|
246 .LP |
|
247 Currently keytool supports these named extensions (case\-insensitive): |
|
248 .LP |
|
249 .LP |
|
250 .TS |
|
251 .if \n+(b.=1 .nr d. \n(.c-\n(c.-1 |
|
252 .de 35 |
|
253 .ps \n(.s |
|
254 .vs \n(.vu |
|
255 .in \n(.iu |
|
256 .if \n(.u .fi |
|
257 .if \n(.j .ad |
|
258 .if \n(.j=0 .na |
|
259 .. |
|
260 .nf |
|
261 .nr #~ 0 |
|
262 .if n .nr #~ 0.6n |
|
263 .ds #d .d |
|
264 .if \(ts\n(.z\(ts\(ts .ds #d nl |
|
265 .fc |
|
266 .nr 33 \n(.s |
|
267 .rm 80 81 |
|
268 .nr 34 \n(.lu |
|
269 .eo |
|
270 .am 81 |
|
271 .br |
|
272 .di a+ |
|
273 .35 |
|
274 .ft \n(.f |
|
275 .ll \n(34u*1u/3u |
|
276 .if \n(.l<\n(81 .ll \n(81u |
|
277 .in 0 |
|
278 The full form: "ca:{true|false}[,pathlen:<len>]"; or, <len>, a shorthand for "ca:true,pathlen:<len>"; or omitted, means "ca:true" |
|
279 .br |
|
280 .di |
|
281 .nr a| \n(dn |
|
282 .nr a- \n(dl |
|
283 .. |
|
284 .ec \ |
|
285 .eo |
|
286 .am 81 |
|
287 .br |
|
288 .di b+ |
|
289 .35 |
|
290 .ft \n(.f |
|
291 .ll \n(34u*1u/3u |
|
292 .if \n(.l<\n(81 .ll \n(81u |
|
293 .in 0 |
|
294 usage(,usage)*, usage can be one of digitalSignature, nonRepudiation (contentCommitment), keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly. Usage can be abbreviated with the first few letters (say, dig for digitalSignature) or in camel\-case style (say, dS for digitalSignature, cRLS for cRLSign), as long as no ambiguity is found. Usage is case\-insensitive. |
|
295 .br |
|
296 .di |
|
297 .nr b| \n(dn |
|
298 .nr b- \n(dl |
|
299 .. |
|
300 .ec \ |
|
301 .eo |
|
302 .am 81 |
|
303 .br |
|
304 .di c+ |
|
305 .35 |
|
306 .ft \n(.f |
|
307 .ll \n(34u*1u/3u |
|
308 .if \n(.l<\n(81 .ll \n(81u |
|
309 .in 0 |
|
310 usage(,usage)*, usage can be one of anyExtendedKeyUsage, serverAuth, clientAuth, codeSigning, emailProtection, timeStamping, OCSPSigning, or any OID string. Named usage can be abbreviated with the first few letters or in camel\-case style, as long as no ambiguity is found. Usage is case\-insensitive. |
|
311 .br |
|
312 .di |
|
313 .nr c| \n(dn |
|
314 .nr c- \n(dl |
|
315 .. |
|
316 .ec \ |
|
317 .eo |
|
318 .am 80 |
|
319 .br |
|
320 .di d+ |
|
321 .35 |
|
322 .ft \n(.f |
|
323 .ll \n(34u*1u/3u |
|
324 .if \n(.l<\n(80 .ll \n(80u |
|
325 .in 0 |
|
326 SAN or SubjectAlternativeName |
|
327 .br |
|
328 .di |
|
329 .nr d| \n(dn |
|
330 .nr d- \n(dl |
|
331 .. |
|
332 .ec \ |
|
333 .eo |
|
334 .am 81 |
|
335 .br |
|
336 .di e+ |
|
337 .35 |
|
338 .ft \n(.f |
|
339 .ll \n(34u*1u/3u |
|
340 .if \n(.l<\n(81 .ll \n(81u |
|
341 .in 0 |
|
342 type:value(,type:value)*, type can be EMAIL, URI, DNS, IP, or OID, value is the string format value for the type. |
|
343 .br |
|
344 .di |
|
345 .nr e| \n(dn |
|
346 .nr e- \n(dl |
|
347 .. |
|
348 .ec \ |
|
349 .eo |
|
350 .am 80 |
|
351 .br |
|
352 .di f+ |
|
353 .35 |
|
354 .ft \n(.f |
|
355 .ll \n(34u*1u/3u |
|
356 .if \n(.l<\n(80 .ll \n(80u |
|
357 .in 0 |
|
358 IAN or IssuerAlternativeName |
|
359 .br |
|
360 .di |
|
361 .nr f| \n(dn |
|
362 .nr f- \n(dl |
|
363 .. |
|
364 .ec \ |
|
365 .eo |
|
366 .am 81 |
|
367 .br |
|
368 .di g+ |
|
369 .35 |
|
370 .ft \n(.f |
|
371 .ll \n(34u*1u/3u |
|
372 .if \n(.l<\n(81 .ll \n(81u |
|
373 .in 0 |
|
374 same as SubjectAlternativeName |
|
375 .br |
|
376 .di |
|
377 .nr g| \n(dn |
|
378 .nr g- \n(dl |
|
379 .. |
|
380 .ec \ |
|
381 .eo |
|
382 .am 81 |
|
383 .br |
|
384 .di h+ |
|
385 .35 |
|
386 .ft \n(.f |
|
387 .ll \n(34u*1u/3u |
|
388 .if \n(.l<\n(81 .ll \n(81u |
|
389 .in 0 |
|
390 method:location\-type:location\-value (,method:location\-type:location\-value)*, method can be "timeStamping", "caRepository" or any OID. location\-type and location\-value can be any type:value supported by the SubjectAlternativeName extension. |
|
391 .br |
|
392 .di |
|
393 .nr h| \n(dn |
|
394 .nr h- \n(dl |
|
395 .. |
|
396 .ec \ |
|
397 .eo |
|
398 .am 80 |
|
399 .br |
|
400 .di i+ |
|
401 .35 |
|
402 .ft \n(.f |
|
403 .ll \n(34u*1u/3u |
|
404 .if \n(.l<\n(80 .ll \n(80u |
|
405 .in 0 |
|
406 AIA or AuthorityInfoAccess |
|
407 .br |
|
408 .di |
|
409 .nr i| \n(dn |
|
410 .nr i- \n(dl |
|
411 .. |
|
412 .ec \ |
|
413 .eo |
|
414 .am 81 |
|
415 .br |
|
416 .di j+ |
|
417 .35 |
|
418 .ft \n(.f |
|
419 .ll \n(34u*1u/3u |
|
420 .if \n(.l<\n(81 .ll \n(81u |
|
421 .in 0 |
|
422 same as SubjectInfoAccess. method can be "ocsp","caIssuers" or any OID. |
|
423 .br |
|
424 .di |
|
425 .nr j| \n(dn |
|
426 .nr j- \n(dl |
|
427 .. |
|
428 .ec \ |
|
429 .35 |
|
430 .nf |
|
431 .ll \n(34u |
|
432 .nr 80 0 |
|
433 .nr 38 \w\f3Name\fP |
|
434 .if \n(80<\n(38 .nr 80 \n(38 |
|
435 .nr 38 \wBC or BasicConstraints |
|
436 .if \n(80<\n(38 .nr 80 \n(38 |
|
437 .nr 38 \wKU or KeyUsage |
|
438 .if \n(80<\n(38 .nr 80 \n(38 |
|
439 .nr 38 \wEKU or ExtendedkeyUsage |
|
440 .if \n(80<\n(38 .nr 80 \n(38 |
|
441 .nr 38 \wSIA or SubjectInfoAccess |
|
442 .if \n(80<\n(38 .nr 80 \n(38 |
|
443 .80 |
|
444 .rm 80 |
|
445 .nr 38 \n(d- |
|
446 .if \n(80<\n(38 .nr 80 \n(38 |
|
447 .nr 38 \n(f- |
|
448 .if \n(80<\n(38 .nr 80 \n(38 |
|
449 .nr 38 \n(i- |
|
450 .if \n(80<\n(38 .nr 80 \n(38 |
|
451 .nr 81 0 |
|
452 .nr 38 \w\f3Value\fP |
|
453 .if \n(81<\n(38 .nr 81 \n(38 |
|
454 .81 |
|
455 .rm 81 |
|
456 .nr 38 \n(a- |
|
457 .if \n(81<\n(38 .nr 81 \n(38 |
|
458 .nr 38 \n(b- |
|
459 .if \n(81<\n(38 .nr 81 \n(38 |
|
460 .nr 38 \n(c- |
|
461 .if \n(81<\n(38 .nr 81 \n(38 |
|
462 .nr 38 \n(e- |
|
463 .if \n(81<\n(38 .nr 81 \n(38 |
|
464 .nr 38 \n(g- |
|
465 .if \n(81<\n(38 .nr 81 \n(38 |
|
466 .nr 38 \n(h- |
|
467 .if \n(81<\n(38 .nr 81 \n(38 |
|
468 .nr 38 \n(j- |
|
469 .if \n(81<\n(38 .nr 81 \n(38 |
|
470 .35 |
|
471 .nf |
|
472 .ll \n(34u |
|
473 .nr 38 1n |
|
474 .nr 79 0 |
|
475 .nr 40 \n(79+(0*\n(38) |
|
476 .nr 80 +\n(40 |
|
477 .nr 41 \n(80+(3*\n(38) |
|
478 .nr 81 +\n(41 |
|
479 .nr TW \n(81 |
|
480 .if t .if \n(TW>\n(.li .tm Table at line 288 file Input is too wide - \n(TW units |
|
481 .fc |
|
482 .nr #T 0-1 |
|
483 .nr #a 0-1 |
|
484 .eo |
|
485 .de T# |
|
486 .ds #d .d |
|
487 .if \(ts\n(.z\(ts\(ts .ds #d nl |
|
488 .mk ## |
|
489 .nr ## -1v |
|
490 .ls 1 |
|
491 .ls |
|
492 .. |
|
493 .ec |
|
494 .ta \n(80u \n(81u |
|
495 .nr 31 \n(.f |
|
496 .nr 35 1m |
|
497 \&\h'|\n(40u'\f3Name\fP\h'|\n(41u'\f3Value\fP |
|
498 .ne \n(a|u+\n(.Vu |
|
499 .if (\n(a|+\n(#^-1v)>\n(#- .nr #- +(\n(a|+\n(#^-\n(#--1v) |
|
500 .ta \n(80u \n(81u |
|
501 .nr 31 \n(.f |
|
502 .nr 35 1m |
|
503 \&\h'|\n(40u'BC or BasicConstraints\h'|\n(41u' |
|
504 .mk ## |
|
505 .nr 31 \n(## |
|
506 .sp |\n(##u-1v |
|
507 .nr 37 \n(41u |
|
508 .in +\n(37u |
|
509 .a+ |
|
510 .in -\n(37u |
|
511 .mk 32 |
|
512 .if \n(32>\n(31 .nr 31 \n(32 |
|
513 .sp |\n(31u |
|
514 .ne \n(b|u+\n(.Vu |
|
515 .if (\n(b|+\n(#^-1v)>\n(#- .nr #- +(\n(b|+\n(#^-\n(#--1v) |
|
516 .ta \n(80u \n(81u |
|
517 .nr 31 \n(.f |
|
518 .nr 35 1m |
|
519 \&\h'|\n(40u'KU or KeyUsage\h'|\n(41u' |
|
520 .mk ## |
|
521 .nr 31 \n(## |
|
522 .sp |\n(##u-1v |
|
523 .nr 37 \n(41u |
|
524 .in +\n(37u |
|
525 .b+ |
|
526 .in -\n(37u |
|
527 .mk 32 |
|
528 .if \n(32>\n(31 .nr 31 \n(32 |
|
529 .sp |\n(31u |
|
530 .ne \n(c|u+\n(.Vu |
|
531 .if (\n(c|+\n(#^-1v)>\n(#- .nr #- +(\n(c|+\n(#^-\n(#--1v) |
|
532 .ta \n(80u \n(81u |
|
533 .nr 31 \n(.f |
|
534 .nr 35 1m |
|
535 \&\h'|\n(40u'EKU or ExtendedkeyUsage\h'|\n(41u' |
|
536 .mk ## |
|
537 .nr 31 \n(## |
|
538 .sp |\n(##u-1v |
|
539 .nr 37 \n(41u |
|
540 .in +\n(37u |
|
541 .c+ |
|
542 .in -\n(37u |
|
543 .mk 32 |
|
544 .if \n(32>\n(31 .nr 31 \n(32 |
|
545 .sp |\n(31u |
|
546 .ne \n(d|u+\n(.Vu |
|
547 .ne \n(e|u+\n(.Vu |
|
548 .if (\n(d|+\n(#^-1v)>\n(#- .nr #- +(\n(d|+\n(#^-\n(#--1v) |
|
549 .if (\n(e|+\n(#^-1v)>\n(#- .nr #- +(\n(e|+\n(#^-\n(#--1v) |
|
550 .ta \n(80u \n(81u |
|
551 .nr 31 \n(.f |
|
552 .nr 35 1m |
|
553 \&\h'|\n(40u'\h'|\n(41u' |
|
554 .mk ## |
|
555 .nr 31 \n(## |
|
556 .sp |\n(##u-1v |
|
557 .nr 37 \n(40u |
|
558 .in +\n(37u |
|
559 .d+ |
|
560 .in -\n(37u |
|
561 .mk 32 |
|
562 .if \n(32>\n(31 .nr 31 \n(32 |
|
563 .sp |\n(##u-1v |
|
564 .nr 37 \n(41u |
|
565 .in +\n(37u |
|
566 .e+ |
|
567 .in -\n(37u |
|
568 .mk 32 |
|
569 .if \n(32>\n(31 .nr 31 \n(32 |
|
570 .sp |\n(31u |
|
571 .ne \n(f|u+\n(.Vu |
|
572 .ne \n(g|u+\n(.Vu |
|
573 .if (\n(f|+\n(#^-1v)>\n(#- .nr #- +(\n(f|+\n(#^-\n(#--1v) |
|
574 .if (\n(g|+\n(#^-1v)>\n(#- .nr #- +(\n(g|+\n(#^-\n(#--1v) |
|
575 .ta \n(80u \n(81u |
|
576 .nr 31 \n(.f |
|
577 .nr 35 1m |
|
578 \&\h'|\n(40u'\h'|\n(41u' |
|
579 .mk ## |
|
580 .nr 31 \n(## |
|
581 .sp |\n(##u-1v |
|
582 .nr 37 \n(40u |
|
583 .in +\n(37u |
|
584 .f+ |
|
585 .in -\n(37u |
|
586 .mk 32 |
|
587 .if \n(32>\n(31 .nr 31 \n(32 |
|
588 .sp |\n(##u-1v |
|
589 .nr 37 \n(41u |
|
590 .in +\n(37u |
|
591 .g+ |
|
592 .in -\n(37u |
|
593 .mk 32 |
|
594 .if \n(32>\n(31 .nr 31 \n(32 |
|
595 .sp |\n(31u |
|
596 .ne \n(h|u+\n(.Vu |
|
597 .if (\n(h|+\n(#^-1v)>\n(#- .nr #- +(\n(h|+\n(#^-\n(#--1v) |
|
598 .ta \n(80u \n(81u |
|
599 .nr 31 \n(.f |
|
600 .nr 35 1m |
|
601 \&\h'|\n(40u'SIA or SubjectInfoAccess\h'|\n(41u' |
|
602 .mk ## |
|
603 .nr 31 \n(## |
|
604 .sp |\n(##u-1v |
|
605 .nr 37 \n(41u |
|
606 .in +\n(37u |
|
607 .h+ |
|
608 .in -\n(37u |
|
609 .mk 32 |
|
610 .if \n(32>\n(31 .nr 31 \n(32 |
|
611 .sp |\n(31u |
|
612 .ne \n(i|u+\n(.Vu |
|
613 .ne \n(j|u+\n(.Vu |
|
614 .if (\n(i|+\n(#^-1v)>\n(#- .nr #- +(\n(i|+\n(#^-\n(#--1v) |
|
615 .if (\n(j|+\n(#^-1v)>\n(#- .nr #- +(\n(j|+\n(#^-\n(#--1v) |
|
616 .ta \n(80u \n(81u |
|
617 .nr 31 \n(.f |
|
618 .nr 35 1m |
|
619 \&\h'|\n(40u'\h'|\n(41u' |
|
620 .mk ## |
|
621 .nr 31 \n(## |
|
622 .sp |\n(##u-1v |
|
623 .nr 37 \n(40u |
|
624 .in +\n(37u |
|
625 .i+ |
|
626 .in -\n(37u |
|
627 .mk 32 |
|
628 .if \n(32>\n(31 .nr 31 \n(32 |
|
629 .sp |\n(##u-1v |
|
630 .nr 37 \n(41u |
|
631 .in +\n(37u |
|
632 .j+ |
|
633 .in -\n(37u |
|
634 .mk 32 |
|
635 .if \n(32>\n(31 .nr 31 \n(32 |
|
636 .sp |\n(31u |
|
637 .fc |
|
638 .nr T. 1 |
|
639 .T# 1 |
|
640 .35 |
|
641 .rm a+ |
|
642 .rm b+ |
|
643 .rm c+ |
|
644 .rm d+ |
|
645 .rm e+ |
|
646 .rm f+ |
|
647 .rm g+ |
|
648 .rm h+ |
|
649 .rm i+ |
|
650 .rm j+ |
|
651 .TE |
|
652 .if \n-(b.=0 .nr c. \n(.c-\n(d.-38 |
|
653 |
|
654 .LP |
|
655 .LP |
|
656 For name as OID, value is the HEX dumped DER encoding of the extnValue for the extension excluding the OCTET STRING type and length bytes. Any extra character other than standard HEX numbers (0\-9, a\-f, A\-F) are ignored in the HEX string. Therefore, both \f2"01:02:03:04"\fP and \f2"01020304"\fP are accepted as identical values. If there's no value, the extension has an empty value field then. |
|
657 .LP |
|
658 .LP |
|
659 A special name \f2"honored"\fP, used in \-gencert only, denotes how the extensions included in the certificate request should be honored. The value for this name is a comma\-seperated list of \f2"all"\fP (all requested extensions are honored), \f2"name{:[critical|non\-critical]}"\fP (the named extension is honored, but using a different isCritical attribute) and \f2"\-name"\fP (used with all, denotes an exception). Requested extensions are not honored by default. |
|
660 .LP |
|
661 .LP |
|
662 If, besides the \-ext honored option, another named or OID \-ext option is provided, this extension will be added to those already honored. However, if this name (or OID) also appears in the honored value, its value and criticality overrides the one in the request. |
|
663 .LP |
|
664 .LP |
|
665 The subjectKeyIdentifier extension is always created. For non self\-signed certificates, the authorityKeyIdentifier is always created. |
|
666 .LP |
|
667 .RE |
|
668 .RE |
240 .RE |
669 .RE |
241 .SH "COMMANDS" |
670 .SH "COMMANDS" |
242 .LP |
671 .LP |
243 |
672 |
244 .LP |
673 .LP |
248 .RS 3 |
677 .RS 3 |
249 |
678 |
250 .LP |
679 .LP |
251 .RS 3 |
680 .RS 3 |
252 .TP 3 |
681 .TP 3 |
253 \-genkeypair {\-alias alias} {\-keyalg keyalg} {\-keysize keysize} {\-sigalg sigalg} [\-dname dname] [\-keypass keypass] {\-validity valDays} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
682 \-gencert {\-infile infile} {\-outfile outfile} {\-ext ext}* {\-rfc} {\-alias alias} {\-sigalg sigalg} {\-validity valDays} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] [\-keypass keypass] {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
|
683 .LP |
|
684 Generates a certificate as a response to a certificate request file (which can be created by the \f2keytool \-certreq\fP command). The command reads the request from infile (if omitted, from the standard input), signs it using alias's private key, and output the X.509 certificate into outfile (if omitted, to the standard output). If \f2\-rfc\fP is specified, output format is BASE64\-encoded PEM; otherwise, a binary DER is created. |
|
685 .LP |
|
686 \f2sigalg\fP specifies the algorithm that should be used to sign the certificate. valDays tells the number of days for which the certificate should be considered valid. |
|
687 .LP |
|
688 \f2ext\fP shows what X.509 extensions will be embedded in the certificate. Read Common Options for the grammar of \f2\-ext\fP. |
|
689 .TP 3 |
|
690 \-genkeypair {\-alias alias} {\-keyalg keyalg} {\-keysize keysize} {\-sigalg sigalg} [\-dname dname] [\-keypass keypass] {\-startdate value} {\-validity valDays} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
254 .LP |
691 .LP |
255 Generates a key pair (a public key and associated private key). Wraps the public key into an X.509 v3 self\-signed certificate, which is stored as a single\-element certificate chain. This certificate chain and the private key are stored in a new keystore entry identified by \f2alias\fP. |
692 Generates a key pair (a public key and associated private key). Wraps the public key into an X.509 v3 self\-signed certificate, which is stored as a single\-element certificate chain. This certificate chain and the private key are stored in a new keystore entry identified by \f2alias\fP. |
256 .LP |
693 .LP |
257 \f2keyalg\fP specifies the algorithm to be used to generate the key pair, and \f2keysize\fP specifies the size of each key to be generated. \f2sigalg\fP specifies the algorithm that should be used to sign the self\-signed certificate; this algorithm must be compatible with \f2keyalg\fP. |
694 \f2keyalg\fP specifies the algorithm to be used to generate the key pair, and \f2keysize\fP specifies the size of each key to be generated. \f2sigalg\fP specifies the algorithm that should be used to sign the self\-signed certificate; this algorithm must be compatible with \f2keyalg\fP. |
258 .LP |
695 .LP |
259 \f2dname\fP specifies the X.500 Distinguished Name to be associated with \f2alias\fP, and is used as the \f2issuer\fP and \f2subject\fP fields in the self\-signed certificate. If no distinguished name is provided at the command line, the user will be prompted for one. |
696 \f2dname\fP specifies the X.500 Distinguished Name to be associated with \f2alias\fP, and is used as the \f2issuer\fP and \f2subject\fP fields in the self\-signed certificate. If no distinguished name is provided at the command line, the user will be prompted for one. |
260 .LP |
697 .LP |
261 \f2keypass\fP is a password used to protect the private key of the generated key pair. If no password is provided, the user is prompted for it. If you press RETURN at the prompt, the key password is set to the same password as that used for the keystore. \f2keypass\fP must be at least 6 characters long. |
698 \f2keypass\fP is a password used to protect the private key of the generated key pair. If no password is provided, the user is prompted for it. If you press RETURN at the prompt, the key password is set to the same password as that used for the keystore. \f2keypass\fP must be at least 6 characters long. |
262 .LP |
699 .LP |
263 \f2valDays\fP tells the number of days for which the certificate should be considered valid. |
700 \f2startdate\fP specifies the issue time of the certificate, also known as the "Not Before" value of the X.509 certificate's Validity field. |
264 .LP |
701 .RS 3 |
265 This command was named \f2\-genkey\fP in previous releases. This old name is still supported in this release and will be supported in future releases, but for clarify the new name, \f2\-genkeypair\fP, is preferred going forward. |
702 |
|
703 .LP |
|
704 .LP |
|
705 The option value can be set in one of these two forms: |
|
706 .LP |
|
707 .RS 3 |
|
708 .TP 3 |
|
709 1. |
|
710 .LP |
|
711 ([+\-]\f2nnn\fP[ymdHMS])+ |
|
712 .TP 3 |
|
713 2. |
|
714 .LP |
|
715 [yyyy/mm/dd] [HH:MM:SS] |
|
716 .RE |
|
717 |
|
718 .LP |
|
719 .LP |
|
720 With the first form, the issue time is shifted by the specified value from the current time. The value is a concatenation of a sequence of sub values. Inside each sub value, the plus sign ("+") means shifting forward, and the minus sign ("\-") means shifting backward. The time to be shifted is \f2nnn\fP units of years, months, days, hours, minutes, or seconds (denoted by a single character of "y", "m", "d", "H", "M", or "S" respectively). The exact value of the issue time is calculated using the \f2java.util.GregorianCalendar.add(int field, int amount)\fP method on each sub value, from left to right. For example, by specifying \f2"\-startdate \-1y+1m\-1d"\fP, the issue time will be: |
|
721 .LP |
|
722 .RS 3 |
|
723 |
|
724 .LP |
|
725 .nf |
|
726 \f3 |
|
727 .fl |
|
728 Calendar c = new GregorianCalendar(); |
|
729 .fl |
|
730 c.add(Calendar.YEAR, \-1); |
|
731 .fl |
|
732 c.add(Calendar.MONTH, 1); |
|
733 .fl |
|
734 c.add(Calendar.DATE, \-1); |
|
735 .fl |
|
736 return c.getTime() |
|
737 .fl |
|
738 \fP |
|
739 .fi |
|
740 .RE |
|
741 |
|
742 .LP |
|
743 .LP |
|
744 With the second form, the user sets the exact issue time in two parts, year/month/day and hour:minute:second (using the local timezone). The user may provide only one part, which means the other part is the same as the current date (or time). User must provide the exact number of digits as shown in the format definition (padding with 0 if shorter). When both the date and time are provided, there is one (and only one) space character between the two parts. The hour should always be provided in 24 hour format. |
|
745 .LP |
|
746 .LP |
|
747 When the option is not provided, the start date is the current time. The option can be provided at most once. |
|
748 .LP |
|
749 .RE |
|
750 .LP |
|
751 \f2valDays\fP specifies the number of days (starting at the date specified by \f2\-startdate\fP, or the current date if \f2\-startdate\fP is not specified) for which the certificate should be considered valid. |
|
752 .LP |
|
753 This command was named \f2\-genkey\fP in previous releases. This old name is still supported in this release and will be supported in future releases, but for clarity the new name, \f2\-genkeypair\fP, is preferred going forward. |
266 .TP 3 |
754 .TP 3 |
267 \-genseckey {\-alias alias} {\-keyalg keyalg} {\-keysize keysize} [\-keypass keypass] {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
755 \-genseckey {\-alias alias} {\-keyalg keyalg} {\-keysize keysize} [\-keypass keypass] {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
268 .LP |
756 .LP |
269 Generates a secret key and stores it in a new \f2KeyStore.SecretKeyEntry\fP identified by \f2alias\fP. |
757 Generates a secret key and stores it in a new \f2KeyStore.SecretKeyEntry\fP identified by \f2alias\fP. |
270 .LP |
758 .LP |
271 \f2keyalg\fP specifies the algorithm to be used to generate the secret key, and \f2keysize\fP specifies the size of the key to be generated. \f2keypass\fP is a password used to protect the secret key. If no password is provided, the user is prompted for it. If you press RETURN at the prompt, the key password is set to the same password as that used for the keystore. \f2keypass\fP must be at least 6 characters long. |
759 \f2keyalg\fP specifies the algorithm to be used to generate the secret key, and \f2keysize\fP specifies the size of the key to be generated. \f2keypass\fP is a password used to protect the secret key. If no password is provided, the user is prompted for it. If you press RETURN at the prompt, the key password is set to the same password as that used for the keystore. \f2keypass\fP must be at least 6 characters long. |
272 .TP 3 |
760 .TP 3 |
273 \-importcert {\-alias alias} {\-file cert_file} [\-keypass keypass] {\-noprompt} {\-trustcacerts} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerName provider_name} {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
761 \-importcert {\-alias alias} {\-file cert_file} [\-keypass keypass] {\-noprompt} {\-trustcacerts} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerName provider_name} {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v} {\-protected} {\-Jjavaoption} |
274 .LP |
762 .LP |
275 Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply) from the file \f2cert_file\fP, and stores it in the keystore entry identified by \f2alias\fP. If no file is given, the certificate or PKCS#7 reply is read from stdin. |
763 Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or a sequence of X.509 certificates) from the file \f2cert_file\fP, and stores it in the keystore entry identified by \f2alias\fP. If no file is given, the certificate or certificate chain is read from stdin. |
276 .LP |
764 .LP |
277 \f3keytool\fP can import X.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type. The data to be imported must be provided either in binary encoding format, or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard. In the latter case, the encoding must be bounded at the beginning by a string that starts with "\-\-\-\-\-BEGIN", and bounded at the end by a string that starts with "\-\-\-\-\-END". |
765 \f3keytool\fP can import X.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type. The data to be imported must be provided either in binary encoding format, or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard. In the latter case, the encoding must be bounded at the beginning by a string that starts with "\-\-\-\-\-BEGIN", and bounded at the end by a string that starts with "\-\-\-\-\-END". |
278 .LP |
766 .LP |
279 You import a certificate for two reasons: |
767 You import a certificate for two reasons: |
280 .RS 3 |
768 .RS 3 |
321 .TP 2 |
807 .TP 2 |
322 o |
808 o |
323 \f3If the reply is a single X.509 certificate\fP, \f3keytool\fP attempts to establish a trust chain, starting at the certificate reply and ending at a self\-signed certificate (belonging to a root CA). The certificate reply and the hierarchy of certificates used to authenticate the certificate reply form the new certificate chain of \f2alias\fP. If a trust chain cannot be established, the certificate reply is not imported. In this case, \f3keytool\fP does not print out the certificate and prompt the user to verify it, because it is very hard (if not impossible) for a user to determine the authenticity of the certificate reply. |
809 \f3If the reply is a single X.509 certificate\fP, \f3keytool\fP attempts to establish a trust chain, starting at the certificate reply and ending at a self\-signed certificate (belonging to a root CA). The certificate reply and the hierarchy of certificates used to authenticate the certificate reply form the new certificate chain of \f2alias\fP. If a trust chain cannot be established, the certificate reply is not imported. In this case, \f3keytool\fP does not print out the certificate and prompt the user to verify it, because it is very hard (if not impossible) for a user to determine the authenticity of the certificate reply. |
324 .TP 2 |
810 .TP 2 |
325 o |
811 o |
326 \f3If the reply is a PKCS#7 formatted certificate chain\fP, the chain is first ordered (with the user certificate first and the self\-signed root CA certificate last), before \f3keytool\fP attempts to match the root CA certificate provided in the reply with any of the trusted certificates in the keystore or the "cacerts" keystore file (if the \f2\-trustcacerts\fP option was specified). If no match can be found, the information of the root CA certificate is printed out, and the user is prompted to verify it, e.g., by comparing the displayed certificate fingerprints with the fingerprints obtained from some other (trusted) source of information, which might be the root CA itself. The user then has the option of aborting the import operation. If the \f2\-noprompt\fP option is given, however, there will be no interaction with the user. |
812 \f3If the reply is a PKCS#7 formatted certificate chain or a sequence of X.509 certificates\fP, the chain is ordered with the user certificate first followed by zero or more CA certificates. If the chain ends with a self\-signed root CA certificate and \f2\-trustcacerts\fP option was specified, \f3keytool\fP will attempt to match it with any of the trusted certificates in the keystore or the "cacerts" keystore file. If the chain does not end with a self\-signed root CA certificate and the \f2\-trustcacerts\fP option was specified, \f3keytool\fP will try to find one from the trusted certificates in the keystore or the "cacerts" keystore file and add it to the end of the chain. If the certificate is not found and \f2\-noprompt\fP option is not specified, the information of the last certificate in the chain is printed out, and the user is prompted to verify it. |
327 .RE |
813 .RE |
328 |
814 |
329 .LP |
815 .LP |
330 .LP |
816 .LP |
331 If the public key in the certificate reply matches the user's public key already stored with under \f2alias\fP, the old certificate chain is replaced with the new certificate chain in the reply. The old chain can only be replaced if a valid \f2keypass\fP, the password used to protect the private key of the entry, is supplied. If no password is provided, and the private key password is different from the keystore password, the user is prompted for it. |
817 If the public key in the certificate reply matches the user's public key already stored with under \f2alias\fP, the old certificate chain is replaced with the new certificate chain in the reply. The old chain can only be replaced if a valid \f2keypass\fP, the password used to protect the private key of the entry, is supplied. If no password is provided, and the private key password is different from the keystore password, the user is prompted for it. |
343 If the \f2srcalias\fP option is not provided, then all entries in the source keystore are imported into the destination keystore. Each destination entry will be stored under the alias from the source entry. If the source entry is protected by a password, \f2srcstorepass\fP will be used to recover the entry. If \f2srcstorepass\fP is either not provided or is incorrect, the user will be prompted for a password. If a source keystore entry type is not supported in the destination keystore, or if an error occurs while storing an entry into the destination keystore, the user will be prompted whether to skip the entry and continue, or to quit. The destination entry will be protected with the source entry password. |
829 If the \f2srcalias\fP option is not provided, then all entries in the source keystore are imported into the destination keystore. Each destination entry will be stored under the alias from the source entry. If the source entry is protected by a password, \f2srcstorepass\fP will be used to recover the entry. If \f2srcstorepass\fP is either not provided or is incorrect, the user will be prompted for a password. If a source keystore entry type is not supported in the destination keystore, or if an error occurs while storing an entry into the destination keystore, the user will be prompted whether to skip the entry and continue, or to quit. The destination entry will be protected with the source entry password. |
344 .LP |
830 .LP |
345 If the destination alias already exists in the destination keystore, the user is prompted to either overwrite the entry, or to create a new entry under a different alias name. |
831 If the destination alias already exists in the destination keystore, the user is prompted to either overwrite the entry, or to create a new entry under a different alias name. |
346 .LP |
832 .LP |
347 Note that if \f2\-noprompt\fP is provided, the user will not be prompted for a new destination alias. Existing entries will automatically be overwritten with the destination alias name. Finally, entries that can not be imported are automatically skipped and a warning is output. |
833 Note that if \f2\-noprompt\fP is provided, the user will not be prompted for a new destination alias. Existing entries will automatically be overwritten with the destination alias name. Finally, entries that can not be imported are automatically skipped and a warning is output. |
|
834 .TP 3 |
|
835 \-printcertreq {\-file file} |
|
836 .LP |
|
837 Prints the content of a PKCS #10 format certificate request, which can be generated by the keytool \-certreq command. The command reads the request from file; if omitted, from the standard input. |
348 .RE |
838 .RE |
349 .RE |
839 .RE |
350 .SS |
840 .SS |
351 Exporting Data |
841 Exporting Data |
352 .LP |
842 .LP |
394 .TP 3 |
884 .TP 3 |
395 \-list {\-alias alias} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerName provider_name} {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v | \-rfc} {\-protected} {\-Jjavaoption} |
885 \-list {\-alias alias} {\-storetype storetype} {\-keystore keystore} [\-storepass storepass] {\-providerName provider_name} {\-providerClass provider_class_name {\-providerArg provider_arg}} {\-v | \-rfc} {\-protected} {\-Jjavaoption} |
396 .LP |
886 .LP |
397 Prints (to stdout) the contents of the keystore entry identified by \f2alias\fP. If no alias is specified, the contents of the entire keystore are printed. |
887 Prints (to stdout) the contents of the keystore entry identified by \f2alias\fP. If no alias is specified, the contents of the entire keystore are printed. |
398 .LP |
888 .LP |
399 This command by default prints the MD5 fingerprint of a certificate. If the \f2\-v\fP option is specified, the certificate is printed in human\-readable format, with additional information such as the owner, issuer, serial number, and any extensions. If the \f2\-rfc\fP option is specified, certificate contents are printed using the printable encoding format, as defined by the Internet RFC 1421 standard |
889 This command by default prints the SHA1 fingerprint of a certificate. If the \f2\-v\fP option is specified, the certificate is printed in human\-readable format, with additional information such as the owner, issuer, serial number, and any extensions. If the \f2\-rfc\fP option is specified, certificate contents are printed using the printable encoding format, as defined by the Internet RFC 1421 standard |
400 .LP |
890 .LP |
401 You cannot specify both \f2\-v\fP and \f2\-rfc\fP. |
891 You cannot specify both \f2\-v\fP and \f2\-rfc\fP. |
402 .TP 3 |
892 .TP 3 |
403 \-printcert {\-file cert_file} {\-v} {\-Jjavaoption} |
893 \-printcert {\-file cert_file | \-sslserver host[:port]} {\-rfc} {\-v} {\-Jjavaoption} |
404 .LP |
894 .LP |
405 .LP |
895 .LP |
406 Internet RFC 1421 standard. |
896 If \f2\-rfc\fP is specified, keytool prints the certificate in PEM mode as defined by the Internet RFC 1421 standard. |
407 .LP |
897 .LP |
408 Note: This option can be used independently of a keystore. |
898 If the certificate is read from a file or stdin, it may be either binary encoded or in printable encoding format, as defined by the Internet RFC 1421 standard |
|
899 .LP |
|
900 If the SSL server is behind a firewall, \f2\-J\-Dhttps.proxyHost=proxyhost\fP and \f2\-J\-Dhttps.proxyPort=proxyport\fP can be specified on the command line for proxy tunneling. See the JSSE Reference Guide for more information. |
|
901 .LP |
|
902 \f3Note\fP: This option can be used independently of a keystore. |
409 .RE |
903 .RE |
410 |
904 |
411 .LP |
905 .LP |
412 .RE |
906 .RE |
413 .SS |
907 .SS |
755 .LP |
1284 .LP |
756 .LP |
1285 .LP |
757 There is a built\-in default implementation, provided by Sun Microsystems. It implements the keystore as a file, utilizing a proprietary keystore type (format) named "JKS". It protects each private key with its individual password, and also protects the integrity of the entire keystore with a (possibly different) password. |
1286 There is a built\-in default implementation, provided by Sun Microsystems. It implements the keystore as a file, utilizing a proprietary keystore type (format) named "JKS". It protects each private key with its individual password, and also protects the integrity of the entire keystore with a (possibly different) password. |
758 .LP |
1287 .LP |
759 .LP |
1288 .LP |
760 Keystore implementations are provider\-based. More specifically, the application interfaces supplied by \f2KeyStore\fP are implemented in terms of a "Service Provider Interface" (SPI). That is, there is a corresponding abstract \f2KeystoreSpi\fP class, also in the \f2java.security\fP package, which defines the Service Provider Interface methods that "providers" must implement. (The term "provider" refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API.) Thus, to provide a keystore implementation, clients must implement a "provider" and supply a KeystoreSpi subclass implementation, as described in How to Implement a Provider for the Java Cryptography Architecture. |
1289 Keystore implementations are provider\-based. More specifically, the application interfaces supplied by \f2KeyStore\fP are implemented in terms of a "Service Provider Interface" (SPI). That is, there is a corresponding abstract \f2KeystoreSpi\fP class, also in the \f2java.security\fP package, which defines the Service Provider Interface methods that "providers" must implement. (The term "provider" refers to a package or a set of packages that supply a concrete implementation of a subset of services that can be accessed by the Java Security API.) Thus, to provide a keystore implementation, clients must implement a "provider" and supply a KeystoreSpi subclass implementation, as described in |
|
1290 .na |
|
1291 \f2How to Implement a Provider for the Java Cryptography Architecture\fP @ |
|
1292 .fi |
|
1293 http://java.sun.com/javase/6/docs/technotes/guides/security/crypto/HowToImplAProvider.html. |
761 .LP |
1294 .LP |
762 .LP |
1295 .LP |
763 Applications can choose different \f2types\fP of keystore implementations from different providers, using the "getInstance" factory method supplied in the \f2KeyStore\fP class. A keystore type defines the storage and data format of the keystore information, and the algorithms used to protect private/secret keys in the keystore and the integrity of the keystore itself. Keystore implementations of different types are not compatible. |
1296 Applications can choose different \f2types\fP of keystore implementations from different providers, using the "getInstance" factory method supplied in the \f2KeyStore\fP class. A keystore type defines the storage and data format of the keystore information, and the algorithms used to protect private/secret keys in the keystore and the integrity of the keystore itself. Keystore implementations of different types are not compatible. |
764 .LP |
1297 .LP |
765 .LP |
1298 .LP |