Java Security: keytool usage instructions, securitykeytool

Java Security: keytool usage instructions, securitykeytool

Keytool usage

Keytool is a key and cert management tool. You can use keytool to manage public keys, private keys, and certificate related to keys.

 

1. command and option description 1.1 command

When using the keytool, you can use 15 types of commands:

 

 

1.2 option

Option is a command parameter. You can use keytool-command_name-help to obtain the parameters of a command. For example, you can use keytool-genkeypair-help to view the parameter description of the genkeypair command:

 

 

In this command, many parameters used by commands have default values. You can leave them unspecified when using the command. See the following table:

Option	Default Value
-Alias	"Mykey"
-Keyalg	When "DSA" uses the-genkeypair command
	When "DES" uses the-genseckey command
-Keysize	2048 when the-genkeypair command is used and the-keyalg option is "RSA"
	1024 when the-genkeypair command is used and the-keyalg option is "DSA"
	256 when the-genkeypair command is used and the-keyalg option is "EC"
	56 when the-genseckey command is used and the-keyalg option is "DES"
	168 when the-genseckey command is used and the-keyalg option is "DESede"
-Validity	90
-Keystore	The default file name is. keystore, which is a hidden file.
-Storetype	The default value is configured in java. security. SUN specifies JKS and can be manually modified.
-File	For write, the value is stout. For read, the value is stdin.
-Protected	False
-Sigalg	SHA1withDSA: Specifies the DSA algorithm when KeyPair is generated.
	SHA256withRSA if the RSA algorithm used to generate KeyPair
	SHA256withECDSA if the EC algorithm used to generate KeyPair

 

 

2. Commands

 

2. 1Generate keypairAnd view

Genkeypair

-genkeypair{-alias alias} {-keyalg keyalg} {-keysize keysize} {-sigalg sigalg} [-dname dname] [-keypass keypass] {-startdate value} {-ext ext}* {-validity valDays} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}

 

Generate KeyPair and generate a self-signed certificate using X.509 v3.

See the following example:

 

 

To view the command details, you can use the list Command (see the list Command below) or JAVA program to view the command details.

The following is an example of a Java program:

Package com. fjn. other. security; import java. io. file; import java. io. fileInputStream; import java. security. key; import java. security. keyStore; import java. security. privateKey; import java. security. publicKey; import java. security. cert. certificate; import java. security. interfaces. dsw.vatekey; import java. util. enumeration; import org. junit. test; public class KeyPaireReader {public void read (String file, String Password) throws Exception {FileInputStream FD = null; FD = new FileInputStream (new File); KeyStore keystore = KeyStore. getInstance ("JKS"); keystore. load (FCM, password. toCharArray (); System. out. println (keystore. containsAlias ("mykey"); Enumeration <String> aliases = keystore. aliases (); while (aliases. hasMoreElements () {String alias = aliases. nextElement (); String createDate = keystore. getC ReationDate (alias ). toLocaleString (); System. out. println ("createDate:" + createDate); Key key = keystore. getKey (alias, password. toCharArray (); if (key! = Null & key instanceof PrivateKey) {if ("DSA ". equals (key. getAlgorithm (). toUpperCase () {dsw.vatekey pik = (dsw.vatekey) key; System. out. println (pik. getX () ;}} Certificate [] certs = keystore. getCertificateChain (alias); for (Certificate cert: certs) {PublicKey puk = cert. getPublicKey (); System. out. println (puk) ;}}@ Test public void test () throws Exception {read ("D: \ keytooltest \ ca1.jks", "111111 ");}}View Code

 

Execution result of the above program:

 

 

List

-list{-alias alias} {-storetype storetype} {-keystore keystore} [-storepass storepass] {-providerName provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v | -rfc} {-protected} {-Jjavaoption}

 

Print the information of the specified alias. If no alias is specified, all the information is displayed.

The following example shows the key details of alias mykey generated using genkeypair:

 

2. 2Certificate Signature Processing

This process involves three commands:

Certreq, gencert, importcert

1) Organization A uses certreq to generate A certificate Signature request file (CSR certificate sign request). The generated file represents A request.

2) After CA receives this request, it will generate a certificate or certificate chain after processing (using gencert.

3) organization A receives the response and imports the certificate (importcert) to the keystore.

 

 

Before processing this description, use genkeypair to generate two keystore files:

keytool -genkeypair -alias ca1 -keystore D:\keytooltest\ca1.jkskeytool -genkeypair -alias ca2 -keystore D:\keytooltest\ca2.jks

 

Certreq

Put the request in the file:

 

Keytool-certreq-alias ca1-keystore D: \ keytooltest \ ca1.jks-file D: \ keytooltest \ ca1_to_ca2.req

 

 

Gencert

-gencert{-rfc} {-infile infile} {-outfile outfile} {-alias alias} {-sigalg sigalg} {-dname dname} {-startdate startdate {-ext ext}* {-validity valDays} [-keypass keypass] {-keystore keystore} [-storepass storepass] {-storetype storetype} {-providername provider_name} {-providerClass provider_class_name {-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}

keytool -gencert -alias ca2 -infile D:\keytooltest\ca1_to_ca2.req -outfile D:\keytooltest\ca2_to_ca1.cert -keystore D:\keytooltest\ca2.jks

 

Importcert

 

 

Official learning materials:

Http://docs.oracle.com/javase/6/docs/technotes/tools/windows/keytool.html

Http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html

Http://docs.oracle.com/javase/8/docs/technotes/tools/windows/keytool.html

In-depth understanding:

Http://www.ibm.com/developerworks/cn/java/j-lo-socketkeytool/index.html? Ca = drs