1 '\" t |
1 '\" t |
2 .\" Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved. |
2 .\" Copyright (c) 1998, 2015, Oracle and/or its affiliates. All rights reserved. |
3 .\" |
|
4 .\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
3 .\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
5 .\" |
4 .\" |
6 .\" This code is free software; you can redistribute it and/or modify it |
5 .\" This code is free software; you can redistribute it and/or modify it |
7 .\" under the terms of the GNU General Public License version 2 only, as |
6 .\" under the terms of the GNU General Public License version 2 only, as |
8 .\" published by the Free Software Foundation. |
7 .\" published by the Free Software Foundation. |
9 .\" |
8 .\" |
10 .\" This code is distributed in the hope that it will be useful, but WITHOUT |
9 .\" This code is distributed in the hope that it will be useful, but WITHOUT |
11 .\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
10 .\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
12 .\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
11 .\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
13 .\" version 2 for more details (a copy is included in the LICENSE file that |
12 .\" version 2 for more details (a copy is included in the LICENSE file that |
14 .\" accompanied this code). |
13 .\" accompanied this code). |
15 .\" |
14 .\" |
16 .\" You should have received a copy of the GNU General Public License version |
15 .\" You should have received a copy of the GNU General Public License version |
17 .\" 2 along with this work; if not, write to the Free Software Foundation, |
16 .\" 2 along with this work; if not, write to the Free Software Foundation, |
383 .PP |
388 .PP |
384 The \f3subjectKeyIdentifier\fR extension is always created\&. For non-self-signed certificates, the \f3authorityKeyIdentifier\fR is created\&. |
389 The \f3subjectKeyIdentifier\fR extension is always created\&. For non-self-signed certificates, the \f3authorityKeyIdentifier\fR is created\&. |
385 .PP |
390 .PP |
386 \fINote:\fR Users should be aware that some combinations of extensions (and other certificate fields) may not conform to the Internet standard\&. See Certificate Conformance Warning\&. |
391 \fINote:\fR Users should be aware that some combinations of extensions (and other certificate fields) may not conform to the Internet standard\&. See Certificate Conformance Warning\&. |
387 .SH COMMANDS |
392 .SH COMMANDS |
388 .TP |
393 .TP |
389 -gencert |
394 -gencert |
390 .br |
395 .sp |
391 \f3{-rfc} {-infile infile} {-outfile outfile} {-alias alias} {-sigalg sigalg} {-dname dname} {-startdate startdate {-ext ext}* {-validity valDays} [-keypass keypass] {-keystore keystore} [-storepass storepass] {-storetype storetype} {-providername provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
396 .nf |
|
397 \f3{\-rfc} {\-infile \fIinfile\fR} {\-outfile \fIoutfile\fR} {\-alias \fIalias\fR} {\-sigalg \fIsigalg\fR}\fP |
|
398 .fi |
|
399 .sp |
|
400 .sp |
|
401 .nf |
|
402 \f3{\-dname \fIdname\fR} {\-startdate \fIstartdate\fR {\-ext \fIext\fR}* {\-validity \fIvalDays\fR}\fP |
|
403 .fi |
|
404 .sp |
|
405 .sp |
|
406 .nf |
|
407 \f3[\-keypass \fIkeypass\fR] {\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR]\fP |
|
408 .fi |
|
409 .sp |
|
410 .sp |
|
411 .nf |
|
412 \f3{\-storetype \fIstoretype\fR} {\-providername \fIprovider_name\fR}\fP |
|
413 .fi |
|
414 .sp |
|
415 .sp |
|
416 .nf |
|
417 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
418 .fi |
|
419 .sp |
|
420 .sp |
|
421 .nf |
|
422 \f3{\-v} {\-protected} {\-Jjavaoption}\fP |
|
423 .fi |
|
424 .sp |
|
425 |
392 |
426 |
393 Generates a certificate as a response to a certificate request file (which can be created by the \f3keytool\fR\f3-certreq\fR command)\&. The command reads the request from \fIinfile\fR (if omitted, from the standard input), signs it using alias\&'s private key, and outputs the X\&.509 certificate into \fIoutfile\fR (if omitted, to the standard output)\&. When\f3-rfc\fR is specified, the output format is Base64-encoded PEM; otherwise, a binary DER is created\&. |
427 Generates a certificate as a response to a certificate request file (which can be created by the \f3keytool\fR\f3-certreq\fR command)\&. The command reads the request from \fIinfile\fR (if omitted, from the standard input), signs it using alias\&'s private key, and outputs the X\&.509 certificate into \fIoutfile\fR (if omitted, to the standard output)\&. When\f3-rfc\fR is specified, the output format is Base64-encoded PEM; otherwise, a binary DER is created\&. |
394 |
428 |
395 The \f3sigalg\fR value specifies the algorithm that should be used to sign the certificate\&. The \f3startdate\fR argument is the start time and date that the certificate is valid\&. The \f3valDays\fR argument tells the number of days for which the certificate should be considered valid\&. |
429 The \f3sigalg\fR value specifies the algorithm that should be used to sign the certificate\&. The \f3startdate\fR argument is the start time and date that the certificate is valid\&. The \f3valDays\fR argument tells the number of days for which the certificate should be considered valid\&. |
396 |
430 |
508 When the option is not provided, the start date is the current time\&. The option can be provided at most once\&. |
571 When the option is not provided, the start date is the current time\&. The option can be provided at most once\&. |
509 |
572 |
510 The value of \f3valDays\fR specifies the number of days (starting at the date specified by \f3-startdate\fR, or the current date when \f3-startdate\fR is not specified) for which the certificate should be considered valid\&. |
573 The value of \f3valDays\fR specifies the number of days (starting at the date specified by \f3-startdate\fR, or the current date when \f3-startdate\fR is not specified) for which the certificate should be considered valid\&. |
511 |
574 |
512 This command was named \f3-genkey\fR in earlier releases\&. The old name is still supported in this release\&. The new name, \f3-genkeypair\fR, is preferred going forward\&. |
575 This command was named \f3-genkey\fR in earlier releases\&. The old name is still supported in this release\&. The new name, \f3-genkeypair\fR, is preferred going forward\&. |
513 .TP |
576 .TP |
514 -genseckey |
577 -genseckey |
515 .br |
578 .sp |
516 \f3-genseckey {-alias alias} {-keyalg keyalg} {-keysize keysize} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
579 .nf |
|
580 \f3{\-alias \fIalias\fR} {\-keyalg \fIkeyalg\fR} {\-keysize \fIkeysize\fR} [\-keypass \fIkeypass\fR]\fP |
|
581 .fi |
|
582 .sp |
|
583 .sp |
|
584 .nf |
|
585 \f3{\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR]\fP |
|
586 .fi |
|
587 .sp |
|
588 .sp |
|
589 .nf |
|
590 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}} {\-v}\fP |
|
591 .fi |
|
592 .sp |
|
593 .sp |
|
594 .nf |
|
595 \f3{\-protected} {\-Jjavaoption}\fP |
|
596 .fi |
|
597 .sp |
|
598 |
517 |
599 |
518 Generates a secret key and stores it in a new \f3KeyStore\&.SecretKeyEntry\fR identified by \f3alias\fR\&. |
600 Generates a secret key and stores it in a new \f3KeyStore\&.SecretKeyEntry\fR identified by \f3alias\fR\&. |
519 |
601 |
520 The value of \f3keyalg\fR specifies the algorithm to be used to generate the secret key, and the value of \f3keysize\fR specifies the size of the key to be generated\&. The \f3keypass\fR value is a password that protects the secret key\&. If no password is provided, then the user is prompted for it\&. If you press the Return key at the prompt, then the key password is set to the same password that is used for the \f3keystore\fR\&. The \f3keypass\fR value must be at least 6 characters\&. |
602 The value of \f3keyalg\fR specifies the algorithm to be used to generate the secret key, and the value of \f3keysize\fR specifies the size of the key to be generated\&. The \f3keypass\fR value is a password that protects the secret key\&. If no password is provided, then the user is prompted for it\&. If you press the Return key at the prompt, then the key password is set to the same password that is used for the \f3keystore\fR\&. The \f3keypass\fR value must be at least 6 characters\&. |
521 .TP |
603 .TP |
522 -importcert |
604 -importcert |
523 .br |
605 .sp |
524 \f3-importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} {-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
606 .nf |
|
607 \f3{\-alias \fIalias\fR} {\-file \fIcert_file\fR} [\-keypass \fIkeypass\fR] {\-noprompt} {\-trustcacerts}\fP |
|
608 .fi |
|
609 .sp |
|
610 .sp |
|
611 .nf |
|
612 \f3{\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR]\fP |
|
613 .fi |
|
614 .sp |
|
615 .sp |
|
616 .nf |
|
617 \f3{\-providerName \fIprovider_name\fR}\fP |
|
618 .fi |
|
619 .sp |
|
620 .sp |
|
621 .nf |
|
622 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
623 .fi |
|
624 .sp |
|
625 .sp |
|
626 .nf |
|
627 \f3{\-v} {\-protected} {\-Jjavaoption}\fP |
|
628 .fi |
|
629 .sp |
|
630 |
525 |
631 |
526 Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or a sequence of X\&.509 certificates) from the file \f3cert_file\fR, and stores it in the \f3keystore\fR entry identified by \f3alias\fR\&. If no file is specified, then the certificate or certificate chain is read from \f3stdin\fR\&. |
632 Reads the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or a sequence of X\&.509 certificates) from the file \f3cert_file\fR, and stores it in the \f3keystore\fR entry identified by \f3alias\fR\&. If no file is specified, then the certificate or certificate chain is read from \f3stdin\fR\&. |
527 |
633 |
528 The \f3keytool\fR command can import X\&.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type\&. The data to be imported must be provided either in binary encoding format or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard\&. In the latter case, the encoding must be bounded at the beginning by a string that starts with \f3-\fR\f3----BEGIN\fR, and bounded at the end by a string that starts with \f3-----END\fR\&. |
634 The \f3keytool\fR command can import X\&.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type\&. The data to be imported must be provided either in binary encoding format or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard\&. In the latter case, the encoding must be bounded at the beginning by a string that starts with \f3-\fR\f3----BEGIN\fR, and bounded at the end by a string that starts with \f3-----END\fR\&. |
529 |
635 |
530 You import a certificate for two reasons: To add it to the list of trusted certificates, and to import a certificate reply received from a certificate authority (CA) as the result of submitting a Certificate Signing Request to that CA (see the \f3-certreq\fR option in Commands)\&. |
636 You import a certificate for two reasons: To add it to the list of trusted certificates, and to import a certificate reply received from a certificate authority (CA) as the result of submitting a Certificate Signing Request to that CA (see the \f3-certreq\fR option in Commands)\&. |
531 |
637 |
532 Which type of import is intended is indicated by the value of the \f3-alias\fR option\&. If the alias does not point to a key entry, then the \f3keytool\fR command assumes you are adding a trusted certificate entry\&. In this case, the alias should not already exist in the keystore\&. If the alias does already exist, then the \f3keytool\fR command outputs an error because there is already a trusted certificate for that alias, and does not import the certificate\&. If the alias points to a key entry, then the \f3keytool\fR command assumes you are importing a certificate reply\&. |
638 Which type of import is intended is indicated by the value of the \f3-alias\fR option\&. If the alias does not point to a key entry, then the \f3keytool\fR command assumes you are adding a trusted certificate entry\&. In this case, the alias should not already exist in the keystore\&. If the alias does already exist, then the \f3keytool\fR command outputs an error because there is already a trusted certificate for that alias, and does not import the certificate\&. If the alias points to a key entry, then the \f3keytool\fR command assumes you are importing a certificate reply\&. |
533 .TP |
639 .TP |
534 -importpassword |
640 -importpassword |
535 .br |
641 .sp |
536 \f3{-alias alias} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
642 .nf |
|
643 \f3{\-alias \fIalias\fR} [\-keypass \fIkeypass\fR] {\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR}\fP |
|
644 .fi |
|
645 .sp |
|
646 .sp |
|
647 .nf |
|
648 \f3[\-storepass \fIstorepass\fR]\fP |
|
649 .fi |
|
650 .sp |
|
651 .sp |
|
652 .nf |
|
653 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
654 .fi |
|
655 .sp |
|
656 .sp |
|
657 .nf |
|
658 \f3{\-v} {\-protected} {\-Jjavaoption}\fP |
|
659 .fi |
|
660 .sp |
|
661 |
537 |
662 |
538 Imports a passphrase and stores it in a new \f3KeyStore\&.SecretKeyEntry\fR identified by \f3alias\fR\&. The passphrase may be supplied via the standard input stream; otherwise the user is prompted for it\&. \f3keypass\fR is a password used to protect the imported passphrase\&. If no password is provided, the user is prompted for it\&. If you press the Return key at the prompt, the key password is set to the same password as that used for the \f3keystore\fR\&. \f3keypass\fR must be at least 6 characters long\&. |
663 Imports a passphrase and stores it in a new \f3KeyStore\&.SecretKeyEntry\fR identified by \f3alias\fR\&. The passphrase may be supplied via the standard input stream; otherwise the user is prompted for it\&. \f3keypass\fR is a password used to protect the imported passphrase\&. If no password is provided, the user is prompted for it\&. If you press the Return key at the prompt, the key password is set to the same password as that used for the \f3keystore\fR\&. \f3keypass\fR must be at least 6 characters long\&. |
539 .TP |
664 .TP |
540 -importkeystore |
665 -importkeystore |
541 .br |
666 .sp |
542 \f3{-srcstoretype srcstoretype} {-deststoretype deststoretype} [-srcstorepass srcstorepass] [-deststorepass deststorepass] {-srcprotected} {-destprotected} {-srcalias srcalias {-destalias destalias} [-srckeypass srckeypass] } [-destkeypass destkeypass] {-noprompt} {-srcProviderName src_provider_name} {-destProviderName dest_provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
667 .nf |
|
668 \f3{\-srcstoretype \fIsrcstoretype\fR} {\-deststoretype \fIdeststoretype\fR}\fP |
|
669 .fi |
|
670 .sp |
|
671 .sp |
|
672 .nf |
|
673 \f3[\-srcstorepass \fIsrcstorepass\fR] [\-deststorepass \fIdeststorepass\fR] {\-srcprotected}\fP |
|
674 .fi |
|
675 .sp |
|
676 .sp |
|
677 .nf |
|
678 \f3{\-destprotected} \fP |
|
679 .fi |
|
680 .sp |
|
681 .sp |
|
682 .nf |
|
683 \f3{\-srcalias \fIsrcalias\fR {\-destalias \fIdestalias\fR} [\-srckeypass \fIsrckeypass\fR]} \fP |
|
684 .fi |
|
685 .sp |
|
686 .sp |
|
687 .nf |
|
688 \f3[\-destkeypass \fIdestkeypass\fR] {\-noprompt}\fP |
|
689 .fi |
|
690 .sp |
|
691 .sp |
|
692 .nf |
|
693 \f3{\-srcProviderName \fIsrc_provider_name\fR} {\-destProviderName \fIdest_provider_name\fR}\fP |
|
694 .fi |
|
695 .sp |
|
696 .sp |
|
697 .nf |
|
698 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}} {\-v}\fP |
|
699 .fi |
|
700 .sp |
|
701 .sp |
|
702 .nf |
|
703 \f3{\-protected} {\-Jjavaoption}\fP |
|
704 .fi |
|
705 .sp |
|
706 |
543 |
707 |
544 Imports a single entry or all entries from a source keystore to a destination keystore\&. |
708 Imports a single entry or all entries from a source keystore to a destination keystore\&. |
545 |
709 |
546 When the \f3-srcalias\fR option is provided, the command imports the single entry identified by the alias to the destination keystore\&. If a destination alias is not provided with \f3destalias\fR, then \f3srcalias\fR is used as the destination alias\&. If the source entry is protected by a password, then \f3srckeypass\fR is used to recover the entry\&. If \fIsrckeypass\fR is not provided, then the \f3keytool\fR command attempts to use \f3srcstorepass\fR to recover the entry\&. If \f3srcstorepass\fR is either not provided or is incorrect, then the user is prompted for a password\&. The destination entry is protected with \f3destkeypass\fR\&. If \f3destkeypass\fR is not provided, then the destination entry is protected with the source entry password\&. For example, most third-party tools require \f3storepass\fR and \f3keypass\fR in a PKCS #12 keystore to be the same\&. In order to create a PKCS #12 keystore for these tools, always specify a \f3-destkeypass\fR to be the same as \f3-deststorepass\fR\&. |
710 When the \f3-srcalias\fR option is provided, the command imports the single entry identified by the alias to the destination keystore\&. If a destination alias is not provided with \f3destalias\fR, then \f3srcalias\fR is used as the destination alias\&. If the source entry is protected by a password, then \f3srckeypass\fR is used to recover the entry\&. If \fIsrckeypass\fR is not provided, then the \f3keytool\fR command attempts to use \f3srcstorepass\fR to recover the entry\&. If \f3srcstorepass\fR is either not provided or is incorrect, then the user is prompted for a password\&. The destination entry is protected with \f3destkeypass\fR\&. If \f3destkeypass\fR is not provided, then the destination entry is protected with the source entry password\&. For example, most third-party tools require \f3storepass\fR and \f3keypass\fR in a PKCS #12 keystore to be the same\&. In order to create a PKCS #12 keystore for these tools, always specify a \f3-destkeypass\fR to be the same as \f3-deststorepass\fR\&. |
547 |
711 |
548 If the \f3-srcalias\fR option is not provided, then all entries in the source keystore are imported into the destination keystore\&. Each destination entry is stored under the alias from the source entry\&. If the source entry is protected by a password, then \f3srcstorepass\fR is used to recover the entry\&. If \f3srcstorepass\fR is either not provided or is incorrect, then the user is prompted for a password\&. If a source keystore entry type is not supported in the destination keystore, or if an error occurs while storing an entry into the destination keystore, then the user is prompted whether to skip the entry and continue or to quit\&. The destination entry is protected with the source entry password\&. |
712 If the \f3-srcalias\fR option is not provided, then all entries in the source keystore are imported into the destination keystore\&. Each destination entry is stored under the alias from the source entry\&. If the source entry is protected by a password, then \f3srcstorepass\fR is used to recover the entry\&. If \f3srcstorepass\fR is either not provided or is incorrect, then the user is prompted for a password\&. If a source keystore entry type is not supported in the destination keystore, or if an error occurs while storing an entry into the destination keystore, then the user is prompted whether to skip the entry and continue or to quit\&. The destination entry is protected with the source entry password\&. |
549 |
713 |
550 If the destination alias already exists in the destination keystore, then the user is prompted to either overwrite the entry or to create a new entry under a different alias name\&. |
714 If the destination alias already exists in the destination keystore, then the user is prompted to either overwrite the entry or to create a new entry under a different alias name\&. |
551 |
715 |
552 If the \f3-noprompt\fR option is provided, then the user is not prompted for a new destination alias\&. Existing entries are overwritten with the destination alias name\&. Entries that cannot be imported are skipped and a warning is displayed\&. |
716 If the \f3-noprompt\fR option is provided, then the user is not prompted for a new destination alias\&. Existing entries are overwritten with the destination alias name\&. Entries that cannot be imported are skipped and a warning is displayed\&. |
553 .TP |
717 .TP |
554 -printcertreq |
718 -printcertreq |
555 .br |
719 .sp |
556 \f3{-file file}\fR |
720 .nf |
|
721 \f3{\-file \fIfile\fR}\fP |
|
722 .fi |
|
723 .sp |
|
724 |
557 |
725 |
558 Prints the content of a PKCS #10 format certificate request, which can be generated by the \f3keytool\fR\f3-certreq\fR command\&. The command reads the request from file\&. If there is no file, then the request is read from the standard input\&. |
726 Prints the content of a PKCS #10 format certificate request, which can be generated by the \f3keytool\fR\f3-certreq\fR command\&. The command reads the request from file\&. If there is no file, then the request is read from the standard input\&. |
559 .TP |
727 .TP |
560 -certreq |
728 -certreq |
561 .br |
729 .sp |
562 \f3{-alias alias} {-dname dname} {-sigalg sigalg} {-file certreq_file} [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
730 .nf |
|
731 \f3{\-alias \fIalias\fR} {\-dname \fIdname\fR} {\-sigalg \fIsigalg\fR} {\-file \fIcertreq_file\fR}\fP |
|
732 .fi |
|
733 .sp |
|
734 .sp |
|
735 .nf |
|
736 \f3[\-keypass \fIkeypass\fR] {\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR}\fP |
|
737 .fi |
|
738 .sp |
|
739 .sp |
|
740 .nf |
|
741 \f3[\-storepass \fIstorepass\fR] {\-providerName \fIprovider_name\fR}\fP |
|
742 .fi |
|
743 .sp |
|
744 .sp |
|
745 .nf |
|
746 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
747 .fi |
|
748 .sp |
|
749 .sp |
|
750 .nf |
|
751 \f3{\-v} {\-protected} {\-Jjavaoption}\fP |
|
752 .fi |
|
753 .sp |
|
754 |
563 |
755 |
564 Generates a Certificate Signing Request (CSR) using the PKCS #10 format\&. |
756 Generates a Certificate Signing Request (CSR) using the PKCS #10 format\&. |
565 |
757 |
566 A CSR is intended to be sent to a certificate authority (CA)\&. The CA authenticates the certificate requestor (usually off-line) and will return a certificate or certificate chain, used to replace the existing certificate chain (which initially consists of a self-signed certificate) in the keystore\&. |
758 A CSR is intended to be sent to a certificate authority (CA)\&. The CA authenticates the certificate requestor (usually off-line) and will return a certificate or certificate chain, used to replace the existing certificate chain (which initially consists of a self-signed certificate) in the keystore\&. |
567 |
759 |
570 The \f3sigalg\fR value specifies the algorithm that should be used to sign the CSR\&. |
762 The \f3sigalg\fR value specifies the algorithm that should be used to sign the CSR\&. |
571 |
763 |
572 The CSR is stored in the file certreq_file\&. If no file is specified, then the CSR is output to \f3stdout\fR\&. |
764 The CSR is stored in the file certreq_file\&. If no file is specified, then the CSR is output to \f3stdout\fR\&. |
573 |
765 |
574 Use the \f3importcert\fR command to import the response from the CA\&. |
766 Use the \f3importcert\fR command to import the response from the CA\&. |
575 .TP |
767 .TP |
576 -exportcert |
768 -exportcert |
577 .br |
769 .sp |
578 \f3{-alias alias} {-file cert_file} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-rfc} {-v} {-protected} {-Jjavaoption}\fR |
770 .nf |
|
771 \f3{\-alias \fIalias\fR} {\-file \fIcert_file\fR} {\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR}\fP |
|
772 .fi |
|
773 .sp |
|
774 .sp |
|
775 .nf |
|
776 \f3[\-storepass \fIstorepass\fR] {\-providerName \fIprovider_name\fR}\fP |
|
777 .fi |
|
778 .sp |
|
779 .sp |
|
780 .nf |
|
781 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
782 .fi |
|
783 .sp |
|
784 .sp |
|
785 .nf |
|
786 \f3{\-rfc} {\-v} {\-protected} {\-Jjavaoption}\fP |
|
787 .fi |
|
788 .sp |
|
789 |
579 |
790 |
580 Reads from the keystore the certificate associated with \fIalias\fR and stores it in the cert_file file\&. When no file is specified, the certificate is output to \f3stdout\fR\&. |
791 Reads from the keystore the certificate associated with \fIalias\fR and stores it in the cert_file file\&. When no file is specified, the certificate is output to \f3stdout\fR\&. |
581 |
792 |
582 The certificate is by default output in binary encoding\&. If the \f3-rfc\fR option is specified, then the output in the printable encoding format defined by the Internet RFC 1421 Certificate Encoding Standard\&. |
793 The certificate is by default output in binary encoding\&. If the \f3-rfc\fR option is specified, then the output in the printable encoding format defined by the Internet RFC 1421 Certificate Encoding Standard\&. |
583 |
794 |
584 If \f3alias\fR refers to a trusted certificate, then that certificate is output\&. Otherwise, \f3alias\fR refers to a key entry with an associated certificate chain\&. In that case, the first certificate in the chain is returned\&. This certificate authenticates the public key of the entity addressed by \f3alias\fR\&. |
795 If \f3alias\fR refers to a trusted certificate, then that certificate is output\&. Otherwise, \f3alias\fR refers to a key entry with an associated certificate chain\&. In that case, the first certificate in the chain is returned\&. This certificate authenticates the public key of the entity addressed by \f3alias\fR\&. |
585 |
796 |
586 This command was named \f3-export\fR in earlier releases\&. The old name is still supported in this release\&. The new name, \f3-exportcert\fR, is preferred going forward\&. |
797 This command was named \f3-export\fR in earlier releases\&. The old name is still supported in this release\&. The new name, \f3-exportcert\fR, is preferred going forward\&. |
587 .TP |
798 .TP |
588 -list |
799 -list |
589 .br |
800 .sp |
590 \f3{-alias alias} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v | -rfc} {-protected} {-Jjavaoption}\fR |
801 .nf |
|
802 \f3{\-alias \fIalias\fR} {\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR]\fP |
|
803 .fi |
|
804 .sp |
|
805 .sp |
|
806 .nf |
|
807 \f3{\-providerName \fIprovider_name\fR}\fP |
|
808 .fi |
|
809 .sp |
|
810 .sp |
|
811 .nf |
|
812 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
813 .fi |
|
814 .sp |
|
815 .sp |
|
816 .nf |
|
817 \f3{\-v | \-rfc} {\-protected} {\-Jjavaoption}\fP |
|
818 .fi |
|
819 .sp |
|
820 |
591 |
821 |
592 Prints to \f3stdout\fR the contents of the keystore entry identified by \f3alias\fR\&. If no \f3alias\fR is specified, then the contents of the entire keystore are printed\&. |
822 Prints to \f3stdout\fR the contents of the keystore entry identified by \f3alias\fR\&. If no \f3alias\fR is specified, then the contents of the entire keystore are printed\&. |
593 |
823 |
594 This command by default prints the SHA1 fingerprint of a certificate\&. If the \f3-v\fR option is specified, then the certificate is printed in human-readable format, with additional information such as the owner, issuer, serial number, and any extensions\&. If the \f3-rfc\fR option is specified, then the certificate contents are printed using the printable encoding format, as defined by the Internet RFC 1421 Certificate Encoding Standard\&. |
824 This command by default prints the SHA1 fingerprint of a certificate\&. If the \f3-v\fR option is specified, then the certificate is printed in human-readable format, with additional information such as the owner, issuer, serial number, and any extensions\&. If the \f3-rfc\fR option is specified, then the certificate contents are printed using the printable encoding format, as defined by the Internet RFC 1421 Certificate Encoding Standard\&. |
595 |
825 |
596 You cannot specify both \f3-v\fR and \f3-rfc\fR\&. |
826 You cannot specify both \f3-v\fR and \f3-rfc\fR\&. |
597 .TP |
827 .TP |
598 -printcert |
828 -printcert |
599 .br |
829 .sp |
600 \f3{-file cert_file | -sslserver host[:port]} {-jarfile JAR_file {-rfc} {-v} {-Jjavaoption}\fR |
830 .nf |
|
831 \f3{\-file \fIcert_file\fR | \-sslserver \fIhost\fR[:\fIport\fR]} {\-jarfile \fIJAR_file\fR {\-rfc} {\-v}\fP |
|
832 .fi |
|
833 .sp |
|
834 .sp |
|
835 .nf |
|
836 \f3{\-Jjavaoption}\fP |
|
837 .fi |
|
838 .sp |
|
839 |
601 |
840 |
602 Reads the certificate from the file cert_file, the SSL server located at host:port, or the signed JAR file \f3JAR_file\fR (with the \f3-jarfile\fR option and prints its contents in a human-readable format\&. When no port is specified, the standard HTTPS port 443 is assumed\&. Note that \f3-sslserver\fR and -file options cannot be provided at the same time\&. Otherwise, an error is reported\&. If neither option is specified, then the certificate is read from \f3stdin\fR\&. |
841 Reads the certificate from the file cert_file, the SSL server located at host:port, or the signed JAR file \f3JAR_file\fR (with the \f3-jarfile\fR option and prints its contents in a human-readable format\&. When no port is specified, the standard HTTPS port 443 is assumed\&. Note that \f3-sslserver\fR and -file options cannot be provided at the same time\&. Otherwise, an error is reported\&. If neither option is specified, then the certificate is read from \f3stdin\fR\&. |
603 |
842 |
604 When\f3-rfc\fR is specified, the \f3keytool\fR command prints the certificate in PEM mode as defined by the Internet RFC 1421 Certificate Encoding standard\&. See Internet RFC 1421 Certificate Encoding Standard\&. |
843 When\f3-rfc\fR is specified, the \f3keytool\fR command prints the certificate in PEM mode as defined by the Internet RFC 1421 Certificate Encoding standard\&. See Internet RFC 1421 Certificate Encoding Standard\&. |
605 |
844 |
606 If the certificate is read from a file or \f3stdin\fR, then it might be either binary encoded or in printable encoding format, as defined by the RFC 1421 Certificate Encoding standard\&. |
845 If the certificate is read from a file or \f3stdin\fR, then it might be either binary encoded or in printable encoding format, as defined by the RFC 1421 Certificate Encoding standard\&. |
607 |
846 |
608 If the SSL server is behind a firewall, then the \f3-J-Dhttps\&.proxyHost=proxyhost\fR and \f3-J-Dhttps\&.proxyPort=proxyport\fR options can be specified on the command line for proxy tunneling\&. See Java Secure Socket Extension (JSSE) Reference Guide at http://docs\&.oracle\&.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide\&.html |
847 If the SSL server is behind a firewall, then the \f3-J-Dhttps\&.proxyHost=proxyhost\fR and \f3-J-Dhttps\&.proxyPort=proxyport\fR options can be specified on the command line for proxy tunneling\&. See Java Secure Socket Extension (JSSE) Reference Guide at http://docs\&.oracle\&.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide\&.html |
609 |
848 |
610 \fINote:\fR This option can be used independently of a keystore\&. |
849 \fINote:\fR This option can be used independently of a keystore\&. |
611 .TP |
850 .TP |
612 -printcrl |
851 -printcrl |
613 .br |
852 .sp |
614 \f3-file crl_ {-v}\fR |
853 .nf |
|
854 \f3\-file \fIcrl_\fR {\-v}\fP |
|
855 .fi |
|
856 .sp |
|
857 |
615 |
858 |
616 Reads the Certificate Revocation List (CRL) from the file \f3crl_\fR\&. A CRL is a list of digital certificates that were revoked by the CA that issued them\&. The CA generates the \f3crl_\fR file\&. |
859 Reads the Certificate Revocation List (CRL) from the file \f3crl_\fR\&. A CRL is a list of digital certificates that were revoked by the CA that issued them\&. The CA generates the \f3crl_\fR file\&. |
617 |
860 |
618 \fINote:\fR This option can be used independently of a keystore\&. |
861 \fINote:\fR This option can be used independently of a keystore\&. |
619 .TP |
862 .TP |
620 -storepasswd |
863 -storepasswd |
621 .br |
864 .sp |
622 \f3[-new new_storepass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption}\fR |
865 .nf |
|
866 \f3[\-new \fInew_storepass\fR] {\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR}\fP |
|
867 .fi |
|
868 .sp |
|
869 .sp |
|
870 .nf |
|
871 \f3[\-storepass \fIstorepass\fR] {\-providerName \fIprovider_name\fR}\fP |
|
872 .fi |
|
873 .sp |
|
874 .sp |
|
875 .nf |
|
876 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
877 .fi |
|
878 .sp |
|
879 .sp |
|
880 .nf |
|
881 \f3{\-v} {\-Jjavaoption}\fP |
|
882 .fi |
|
883 .sp |
|
884 |
623 |
885 |
624 Changes the password used to protect the integrity of the keystore contents\&. The new password is \f3new_storepass\fR, which must be at least 6 characters\&. |
886 Changes the password used to protect the integrity of the keystore contents\&. The new password is \f3new_storepass\fR, which must be at least 6 characters\&. |
625 .TP |
887 .TP |
626 -keypasswd |
888 -keypasswd |
627 .br |
889 .sp |
628 \f3{-alias alias} [-keypass old_keypass] [-new new_keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-Jjavaoption}\fR |
890 .nf |
|
891 \f3{\-alias \fIalias\fR} [\-keypass \fIold_keypass\fR] [\-new \fInew_keypass\fR] {\-storetype \fIstoretype\fR}\fP |
|
892 .fi |
|
893 .sp |
|
894 .sp |
|
895 .nf |
|
896 \f3{\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR] {\-providerName \fIprovider_name\fR}\fP |
|
897 .fi |
|
898 .sp |
|
899 .sp |
|
900 .nf |
|
901 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}} {\-v}\fP |
|
902 .fi |
|
903 .sp |
|
904 .sp |
|
905 .nf |
|
906 \f3{\-Jjavaoption}\fP |
|
907 .fi |
|
908 .sp |
|
909 |
629 |
910 |
630 Changes the password under which the private/secret key identified by \f3alias\fR is protected, from \f3old_keypass\fR to \f3new_keypass\fR, which must be at least 6 characters\&. |
911 Changes the password under which the private/secret key identified by \f3alias\fR is protected, from \f3old_keypass\fR to \f3new_keypass\fR, which must be at least 6 characters\&. |
631 |
912 |
632 If the \f3-keypass\fR option is not provided at the command line, and the key password is different from the keystore password, then the user is prompted for it\&. |
913 If the \f3-keypass\fR option is not provided at the command line, and the key password is different from the keystore password, then the user is prompted for it\&. |
633 |
914 |
634 If the \f3-new\fR option is not provided at the command line, then the user is prompted for it |
915 If the \f3-new\fR option is not provided at the command line, then the user is prompted for it |
635 .TP |
916 .TP |
636 -delete |
917 -delete |
637 .br |
918 .sp |
638 \f3[-alias alias] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
919 .nf |
|
920 \f3[\-alias \fIalias\fR] {\-storetype \fIstoretype\fR} {\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR]\fP |
|
921 .fi |
|
922 .sp |
|
923 .sp |
|
924 .nf |
|
925 \f3{\-providerName \fIprovider_name\fR} \fP |
|
926 .fi |
|
927 .sp |
|
928 .sp |
|
929 .nf |
|
930 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}}\fP |
|
931 .fi |
|
932 .sp |
|
933 .sp |
|
934 .nf |
|
935 \f3{\-v} {\-protected} {\-Jjavaoption}\fP |
|
936 .fi |
|
937 .sp |
|
938 |
639 |
939 |
640 Deletes from the keystore the entry identified by \f3alias\fR\&. The user is prompted for the alias, when no alias is provided at the command line\&. |
940 Deletes from the keystore the entry identified by \f3alias\fR\&. The user is prompted for the alias, when no alias is provided at the command line\&. |
641 .TP |
941 .TP |
642 -changealias |
942 -changealias |
643 .br |
943 .sp |
644 \f3{-alias alias} [-destalias destalias] [-keypass keypass] {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}\fR |
944 .nf |
|
945 \f3{\-alias \fIalias\fR} [\-destalias \fIdestalias\fR] [\-keypass \fIkeypass\fR] {\-storetype \fIstoretype\fR}\fP |
|
946 .fi |
|
947 .sp |
|
948 .sp |
|
949 .nf |
|
950 \f3{\-keystore \fIkeystore\fR} [\-storepass \fIstorepass\fR] {\-providerName \fIprovider_name\fR}\fP |
|
951 .fi |
|
952 .sp |
|
953 .sp |
|
954 .nf |
|
955 \f3{\-providerClass \fIprovider_class_name\fR {\-providerArg \fIprovider_arg\fR}} {\-v}\fP |
|
956 .fi |
|
957 .sp |
|
958 .sp |
|
959 .nf |
|
960 \f3{\-protected} {\-Jjavaoption}\fP |
|
961 .fi |
|
962 .sp |
|
963 |
645 |
964 |
646 Move an existing keystore entry from the specified \f3alias\fR to a new alias, \f3destalias\fR\&. If no destination alias is provided, then the command prompts for one\&. If the original entry is protected with an entry password, then the password can be supplied with the \f3-keypass\fR option\&. If no key password is provided, then the \f3storepass\fR (if provided) is attempted first\&. If the attempt fails, then the user is prompted for a password\&. |
965 Move an existing keystore entry from the specified \f3alias\fR to a new alias, \f3destalias\fR\&. If no destination alias is provided, then the command prompts for one\&. If the original entry is protected with an entry password, then the password can be supplied with the \f3-keypass\fR option\&. If no key password is provided, then the \f3storepass\fR (if provided) is attempted first\&. If the attempt fails, then the user is prompted for a password\&. |
647 .TP |
966 .TP |
648 -help |
967 -help |
649 .br |
968 .br |