Generate Private Key From Jks

Posted on by
  1. Create Jks From Pfx
  2. Generate Private Key From Jks Mac
  3. Generate Private Key From Jks File
  4. Keytool Generate Private Key From Jks

Java Keytool can be used to generate Java keystores, certificate signing requests (CSRs), convert certificate formats, and other certificate related functions. Keytool is bundled with Oracle's JDK. This article will walk through generating a CSR as well as generating a private key if one is not already available. Jun 18, 2008  Exporting the private key from a jks file (Java keystore) Submitted by Kamal Wickramanayake on June 18, 2008 - 18:08 Some seems to have used complicated mechanisms including writing new software to do so. Follow SSLSupportDesk guide to keystore creation using our Portecle Guide. In order to generate a keystore for various Oracle systems that utilize.jks keystores using Keytool perform the following instructions listed below. Step 1: Create a Keystore: Create a certificate keystore and private key by executing the following command. Extracting public and private keys from a Java Key Store (JKS), 9.0 out of 10 based on 163 ratings This entry was posted by admin on August 23, 2011 at 9:07 am, and is filed under Security. Follow any responses to this post through RSS 2.0. Java Keytool can be used to generate Java keystores, certificate signing requests (CSRs), convert certificate formats, and other certificate related functions. Keytool is bundled with Oracle's JDK. This article will walk through generating a CSR as well as generating a private key if one is not already available. Create PKCS 12 file using your private key and CA signed certificate of it. You can use openssl command for this. Create JKS file using keytool command. Step 3 (Optional). Changing the password of private key file in keystore. More details from here as well.

Creating a KeyStore in JKS Format

This section explains how to create a KeyStore using theJKS format as the database format for both the private key, and theassociated certificate or certificate chain. By default, as specifiedin the java.security file, keytool usesJKS as the format of the key and certificate databases (KeyStore andTrustStores). A CA must sign the certificate signing request (CSR).The CA is therefore trusted by the server-side application to whichthe Adapter is connected.

Note –

Itis recommended to use the default KeyStore

Command: keytool -list -v -keystore identity.jks -storepass password - The ImportPrivateKey utility is used to load a private key into a private keystore file. You can use the CertGen utility to create a.key ( testkey ) and.crt ( testcert ) and then use the ImportPrivateKey utility to create a.jks file.


where <c:JavaCAPS> isthe directory where Java CAPS is installed and <MyDomain> isthe name of your domain.

To Generate a KeyStore

Jks

  1. Perform the following command.


  2. Once prompted, enter the information required to generatea CSR. A sample key generation section follows.


    If the KeyStore password is specified, then the password mustbe provided for the adapter.

  3. Press RETURN when prompted for the key password (thisaction makes the key password the same as the KeyStore password).

    This operation creates a KeyStore file clientkeystore in the current working directory. You must specify a fullyqualified domain for the “first and last name” question.The reason for this use is that some CAs such as VeriSign expect thisproperties to be a fully qualified domain name.

    Thereare CAs that do not require the fully qualified domain, but it isrecommended to use the fully qualified domain name for the sake ofportability. All the other information given must be valid. If theinformation cannot be validated, a CA such as VeriSign does not signa generated CSR for this entry.

    This KeyStore containsan entry with an alias of client.This entry consists of the generated private key and information neededfor generating a CSR as follows:


    This command generates a certificate signing request which canbe provided to a CA for a certificate request. The file client.csr contains the CSR in PEM format.

    Some CA (one trusted by the web server to which the adapteris connecting) must sign the CSR. The CA generates a certificate forthe corresponding CSR and signs the certificate with its private key.For more information, visit the following web sites:

    or

    If the certificate is chained with the CA’scertificate, perform step 4; otherwise, perform step 5 in the followinglist:

  4. Perform the following command.


    The command imports the certificate and assumes the client certificateis in the file client.cer and theCA’s certificate is in the file CARoot.cer.

  5. Unique product key generator online. Perform the following command to import the CA’scertificate into the KeyStore for chaining with the client’scertificate.


  6. Perform the following command to import the client’scertificate signed by the CA whose certificate was imported in thepreceding step.


    The generated file clientkeystore containsthe client’s private key and the associated certificate chainused for client authentication and signing. The KeyStore and/or clientkeystore, can then be used as the adapter’sKeyStore.

Generate a .jks keystore using .key and .crt files

Generate

Generate a .jks keystore using .key and .crt files :

Notes :

x509 standard assumes a strict hierarchical system of certificate authorities (CAs) for issuing the certificates.

Structure of a certificate :

The structure of an X.509 v3 digital certificate is as follows:

.
Certificate
Version
Serial Number
Algorithm ID
Issuer
Validity
Not Before
Not After
Subject
Subject Public Key Info
Public Key Algorithm
Subject Public Key
Issuer Unique Identifier (Optional)
Subject Unique Identifier (Optional)
Extensions (Optional)
…
Certificate Signature Algorithm
Certificate Signature

Issuer and subject unique identifiers were introduced in Version 2, Extensions in Version 3. Nevertheless, the Serial number must be unique for each certificate issued by a specific CA

Certificate filename extensions :

Common filename extensions for X.509 certificates are:

.pem – (Privacy Enhanced Mail) Base64 encoded DER certificate, enclosed between “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–”

.cer, .crt, .der – usually in binary DER form, but Base64-encoded certificates are common too (see .pem above)

.p7b, .p7c – PKCS#7 SignedData structure without data, just certificate(s) or CRL(s)

.p12 – PKCS#12, may contain certificate(s) (public) and private keys (password protected)

.pfx – PFX, predecessor of PKCS#12 (usually contains data in PKCS#12 format, e.g, with PFX files generated in IIS)

PKCS#7 is a standard for signing or encrypting (officially called “enveloping”) data. Since the certificate is needed to verify signed data, it is possible to include them in the SignedData structure. A .P7C file is a degenerated SignedData structure, without any data to sign.
PKCS#12 evolved from the PFX (Personal inFormation eXchange) standard and is used to exchange public and private objects in a single file.

Steps :

Tools like in F5 load balancers generate .crt and .key files ( they basically use openssl ).

Here .crt is the signed certificate from a CA and key contains the private key.

These keys and certificates are in PEM format.

– Open both the files in a notepad and copy the contents in it to a new notepad file and save it with extension .pem

– Now we need to convert this .pem to .des

Note : DES is a binary format and non readable whereas PEM are in human readable form.
Note : Make sure OpenSSL is installed ( You can download it from : http://www.slproweb.com/products/Win32OpenSSL.html )

– You can use the following command to convert PEM to DER format.

Command : openssl pkcs8 -topk8 -nocrypt -in key.pem -inform PEM -out key.der -outform DER ( this command will convert the key file (PEM format) containing private key to DER format )

Command : openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER ( This command converts the signed certificate (PEM format) to DER format ).

– Now we need to add the signed certificate and the private key into the keystore.

Keytool does not let you import an existing private key for which you already have a certificate.

– Download and compile the java code from the link below :

Link : http://www.agentbob.info/agentbob/80.html ( ImportKey.java )

Command : javac ImportKey.java

The above code will add the private key and the certificate into a .jks keystore.

Default name of the keystore that will be created : keystore.ImportKey ( you can edit the code and change it to identity.jks )

Default password/passphrase for the private key : importkey ( you can edit the code to make changes in it accordingly )

Default alias name given to this key would be : importkey

Create Jks From Pfx

Once you have the .class file run the command below to generate the keystore ( i.e identity.jks ) :

Command : Â java ImportKey key.der cert.der ( Note the first argument is the key file and the second is the cerificate (both in DER format) )

Generate Private Key From Jks Mac

Note : The keystore is not created in the same directory. You can find it in the root folder ( Eg : C:Documents and SettingsCoolDragon… )

– Now import your rootca.crt file into this keystore to complete the chaining of certificates

Command : keytool -import -file rootca.crt -alias -trustcacerts -keystore keystore.ImportKey -storepass importkey

– Now list the certificates of the keystore to check if the chaining is fine :

Generate Private Key From Jks File

Command : keytool -v -list -keystore keystore.ImportKey -storepass importkey

Keytool Generate Private Key From Jks

Identity.jks file is now ready 🙂