Below you can find some examples of useful keytool commands, where the value “changeit” always refers to a password and further values refer to filenames (e.g. of type “.jks”) or certificate files (e.g. of type “.cer”) that must be replaced correspondingly.
List certificate from a valid keystore
$> keytool -list -v -storepass changeit -keystore keystore.jks
Print certificate information
$> keytool -printcert -file server_abcd235.cer
Import certificate into a keystore
$> keytool -import -alias abcd235 -keystore keystore.jks -storepass changeit -file server_abcd235.cer
Export certificate out of the keystore
$> keytool -export -alias abcd235 -storepass changeit -keystore keystore.jks -file server_abcd235.cer
Delete certificate from a keystore
$> keytool -delete -storepass changeit -keystore keystore.jks -alias abcd235
Generate self-signed server certificate inclusive of private key
Via the parameter “-dname” your own certificate attributes (CN, OU, O, L, ST, and C) are set:
$> keytool -genkey -noprompt -trustcacerts -keyalg RSA -alias abcd235 -dname "CN=ima, OU=ImageMaster, O=T-Systems International GmbH, L=Leinfelden-Echterdingen, ST=Baden-Wuerttemberg, C=DE" -keypass changeit -storepass changeit -keystore keystore.jks
Import certificate for client authentication into the cacerts.jks keystore
keytool –importcert -alias new_client –file new-client.der –trustcacerts -keystore cacerts.jks
Insert server certificate into trusted keystore of the client
Parameter values like <ALIAS>, <PATH>, <PASSWORD> and the filenames must be adjusted:
$> keytool -import -v -trustcacerts -alias <ALIAS> -file <FILENAME.cer> -keystore <PATH>/<cacerts.jks> -keypass <PASSWORD>
A default Java location is used in the example below, which requires that $JAVA_HOME is set:
$> keytool -import -v -trustcacerts -alias <ALIAS> -file <FILENAME.cer> -keystore $JAVA_HOME/jre/lib/security/cacerts -keypass <PASSWORD>
For related details see the online documentation [Java keytool].