Java Key Store

keytool -genkey -keyalg RSA -keysize 2048 -validity 7300\
 -dname     "CN=Chorke Academia, OU=Academia, O=Chorke Inc, L=Kuala Lumpur, ST=WP, C=MY"\
 -keystore  clients.jks -alias academia\
 -storepass storepasswd\
 -keypass   storepasswd

keytool -genkey -keyalg RSA -keysize 2048 -validity 7300\
 -dname     "CN=Chorke Academia, OU=Academia, O=Chorke Inc, L=Kuala Lumpur, ST=WP, C=MY"\
 -storetype pkcs12 -keystore  clients.jks -alias academia\
 -storepass storepasswd\
 -keypass   storepasswd

Java Code

public class JavaKeyStoreTest {
    private static final Logger LOG = LoggerFactory.getLogger(JavaKeyStoreTest.class);
    private static final char[] STORE_PASSWORD = "storepasswd".toCharArray();
    private static final String STORE_TYPE = KeyStore.getDefaultType();
    private static final String KEY_ALIAS = "academia";

    private KeyStore keyStore;

    @BeforeEach
    public void setUp() throws Exception {
        keyStore = KeyStore.getInstance(STORE_TYPE);
        Resource resource = new ClassPathResource("/META-INF/keystore/server.jks");
        keyStore.load(resource.getInputStream(), STORE_PASSWORD);
    }

    @Test
    public void testKey() throws  Exception {
        Key key = keyStore.getKey(KEY_ALIAS, STORE_PASSWORD);
        if (key instanceof PrivateKey){
            Certificate cert = keyStore.getCertificate(KEY_ALIAS);
            PublicKey publicKey = cert.getPublicKey();
            PrivateKey privateKey = (PrivateKey) key;
            LOG.info("Public Key:\n{}", Base64.getEncoder().encodeToString(publicKey.getEncoded()));
            KeyPair keyPair = new KeyPair(publicKey, privateKey);
        }
        Assertions.assertTrue(true);
    }
}

Spring Boot

server.ssl.key-store: ${user.dir}/keystore/chorke.jks
server.ssl.key-store-password: storepasswd
server.ssl.key-password: storepasswd
server.ssl.keyAlias: academia
server.ssl.enabled: false

Create

keytool -genkey -keyalg RSA -keysize 2048 -validity 7300\
 -dname     "CN=Chorke Academia, OU=Academia, O=Chorke Inc, L=Kuala Lumpur, ST=WP, C=MY"\
 -storetype pkcs12 -keystore  clients.jks -alias academia\
 -storepass storepasswd

Import

keytool -importkeystore -deststoretype pkcs12\
 -srckeystore   clients.jks\
 -destkeystore  servers.jks\
 -srcstorepass  storepasswd\
 -deststorepass storepasswd\
 -srcalias      academia\
 -destalias     academia

keytool -importkeystore -deststoretype pkcs12\
 -srckeystore   clients.jks\
 -destkeystore  clients.p12\
 -srcstorepass  storepasswd\
 -deststorepass storepasswd\
 -srcalias      academia\
 -destalias     academia

Root CA Cert

keytool -importcert -trustcacerts\
 -storepass storepasswd\
 -keystore  clients.jks\
 -file  rootca.cer\
 -alias rootca

Sub CA Cert

keytool -importcert -trustcacerts\
 -storepass storepasswd\
 -keystore  clients.jks\
 -file  subca.cer\
 -alias subca

Certificate

keytool     -importcert\
 -storepass storepasswd\
 -keystore  clients.jks\
 -file  software.crt\
 -alias software

Export

Keytool

keytool    -rfc -export\
 -storepass storepasswd\
 -keystore  clients.jks\
 -alias academia\
 -file  academia.pem

keytool         -export\
 -storepass storepasswd\
 -keystore  clients.jks\
 -alias academia\
 -file  academia.pem

OpenSSL

openssl pkcs12 -nodes -nocerts\
 -out private_key.pem\
 -in clients.p12

 openssl pkcs12 -nokeys\
 -out public_key.pem\
 -in clients.p12

Certificate List

keytool -list -keystore clients.jks -storepass storepasswd
keytool -list -keystore clients.p12 -storepass storepasswd
keytool -list -keystore servers.jks -storepass storepasswd

Knowledge

# debugging certificate handshacking
service='api.chorke.org:5443/soap/services';\
echo -e "GET / HTTP/1.0\r\n" | openssl s_client \
-connect $service -CAfile chorke_client.pem

openssl help
openssl help pkcs12
keytool --help -importkeystore

openssl s_client -connect mail.chorke.com:465 -state
openssl s_client -connect mail.chorke.org:465 -state
openssl s_client -connect mail.shahed.biz:465 -state

sudo keytool -import -trustcacerts -alias letsencrypt_r3 -file r3-chain.der -keystore\
 /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts

sudo keytool -import -trustcacerts -alias letsencrypt_r3 -file r3-chain.der -keystore\
 /etc/ssl/certs/java/cacerts

Enter keystore password: changeit

References

How to create csr, key, crt and import crt, rootca, subca into jks? Difference between Root Cert, Intermediate Cert and SSL Cert Relationships between TrustManagers and KeyManagers Installing Trusted Certificates into a Java Keystore Use an Existing SSL Certificate and Private Key Convert a PKCS#12 File to JKS Format How to use .key and .crt file in java? Creating a New SSL Certificate How to convert .csr to .cer? Portecle

Generate a key with keytool, in a non-interactive way Extracting a Private Key From the Java Keystore Export public key from JKS using Keytool Import a public SSL certificate into a JVM Raspberry Pi Apache2 Lets Encrypt SSL Creating a KeyStore in JKS Format Feign » SSL Client Configuration Feign » Using SSL Certificate Read public key from JKS Java Mail API

ACME » Certificates for localhost Manage Ingress TLS for local K8s Security » Certificate Security » Password Security » Java