[TOC]
1 簡介
keytool is a key and certificate management utility. It allows users to administer their own public/private key pairs and associated certificates for use in self-authentication (where the user authenticates himself/herself to other users/services) or data integrity and authentication services, using digital signatures. It also allows users to cache the public keys (in the form of certificates) of their communicating peers.
A certificate is a digitally signed statement from one entity (person, company, etc.), saying that the public key (and some other information) of some other entity has a particular value. (See Certificates.) When data is digitally signed, the signature can be verified to check the data integrity and authenticity. Integrity means that the data has not been modified or tampered with, and authenticity means the data indeed comes from whoever claims to have created and signed it.
keytool also enables users to administer secret keys used in symmetric encryption/decryption (e.g. DES).
keytool stores the keys and certificates in a keystore.
通過以上官方文檔中的一部分內(nèi)容，我們可以了解到:
- keytool是一個秘鑰和證書的管理工具
- keytool可以用于管理對稱加密和非對稱加密
- keytool將秘鑰和證書存儲在keystore中
2 命令格式
2.1 幾點(diǎn)說明
- 所有的命令和選項都以減號(-)打頭
- 命令的選項可以以任意的位置出現(xiàn)
- 選項的值中如果有空白字符，必須用引號引起來
- -help命令是默認(rèn)的命令，所以
keytool和keytool -help是一樣的
2.2 命令列表
[root@hylexus ~]# keytool
Key and Certificate Management Tool
Commands:
-certreq Generates a certificate request
-changealias Changes an entry's alias
-delete Deletes an entry
-exportcert Exports certificate
-genkeypair Generates a key pair
-genseckey Generates a secret key
-gencert Generates certificate from a certificate request
-importcert Imports a certificate or a certificate chain
-importpass Imports a password
-importkeystore Imports one or all entries from another keystore
-keypasswd Changes the key password of an entry
-list Lists entries in a keystore
-printcert Prints the content of a certificate
-printcertreq Prints the content of a certificate request
-printcrl Prints the content of a CRL file
-storepasswd Changes the store password of a keystore
Use "keytool -command_name -help" for usage of command_name
2.3 一些選項的默認(rèn)值
- -alias "mykey"
- -keyalg
- "DSA" (使用 -genkeypair的時候)
- "DES" (使用 -genseckey)的時候
- -keysize
- 1024(當(dāng)使用 -genkeypair的時候)
- 56 (當(dāng)使用 -genseckey 并且 -keyalg 為 "DES"的時候)
- 168 (當(dāng)使用 -genseckey 并且 -keyalg 為 "DESede"的時候)
- -validity 90
- -keystore 用戶家目錄下名為.keystore的文件
- -file
- 讀的時候為stdin
- 寫的時候為stdout
- -protected false
3 使用示例
3.1 生成秘鑰對兒/自簽署證書
創(chuàng)建密鑰對的時候，同時就創(chuàng)建了一個自簽署的證書
keytool -genkeypair -alias tomcat -keyalg rsa -keysize 2048 -validity 365 -keystore /soft/tomcat7-80/conf/keystore
解釋如下:
keytool \
-genkeypair \ # 生成秘鑰對兒
-alias tomcat \ # 名稱
-keyalg rsa \ # 算法名稱
-keysize 2048 \# 長度
-validity 365 \# 有效期
-keystore /soft/tomcat7-80/conf/keystore # 存儲位置
3.2 生成CSR
CSR即Certificate Signing Request，證書頒發(fā)請求。
keytool -certreq -keyalg rsa -alias tomcat -file /soft/tomcat7-80/conf/tomcat.csr -keystore /soft/tomcat7-80/conf/keystore
解釋如下：
keytool -certreq \ # 創(chuàng)建CSR命令
-keyalg rsa \ # 加密算法
-alias tomcat \ #在可以store中存儲的別名
-file /soft/tomcat7-80/conf/tomcat.csr \ # 輸出文件位置
#指定keystore的位置，默認(rèn)為用戶家目錄下的.keystore文件
-keystore /soft/tomcat7-80/conf/keystore
3.3 導(dǎo)出證書
keytool -exportcert -file /soft/tomcat7-80/conf/server.crt -alias tomcat -keystore /soft/tomcat7-80/conf/keystore
解釋如下:
keytool -exportcert \ 導(dǎo)出命令
# 導(dǎo)出到哪里？
-file /soft/tomcat7-80/conf/server.crt \
# 導(dǎo)出哪個？
-alias tomcat \
# 從哪個keystore中導(dǎo)出？默認(rèn)為用戶家目錄~/.keystore文件
-keystore /soft/tomcat7-80/conf/keystore
3.4 導(dǎo)入證書
keytool -importcert -file /soft/tomcat7-80/conf/server.crt -alias myCA -keystore /soft/tomcat7-80/conf/keystore -trustcacerts
解釋如下:
keytool -importcert \ # 導(dǎo)入命令
# 從哪里導(dǎo)入？
-file /soft/tomcat7-80/conf/server.crt \
# 起別名
-alias myCA \
# 使用哪個keystore？
-keystore /soft/tomcat7-80/conf/keystore \
-trustcacerts
3.5 列出keystore中存儲的內(nèi)容
keytool -list
keytool -list -keystore /soft/tomcat7-80/conf/keystore
keytool -list -keystore /soft/tomcat7-80/conf/keystore -alias tomcat
解釋如下:
keytool -list \ # list命令
# 使用哪個keystore？
-keystore /soft/tomcat7-80/conf/keystore
3.6 導(dǎo)入現(xiàn)成的私鑰和證書到keystore
看看這個來自stackoverflow的截圖：
貌似keytool并不提供或說是不直接提供方法導(dǎo)入私鑰。
不過可以繞繞，最終借助于openssl來解決：
http://cunning.sharp.fm/2008/06/importing_private_keys_into_a.html
來自stackoverflow的解決方案
# Create PKCS12 keystore from private key and public certificate.
openssl pkcs12 -export -name myservercert -in selfsigned.crt -inkey server.key -out keystore.p12
# Convert PKCS12 keystore into a JKS keystore
keytool -importkeystore -destkeystore mykeystore.jks -srckeystore keystore.p12 -srcstoretype pkcs12 -alias myservercert
以后有時間在補(bǔ)齊其他命令的使用吧……
參考文章
http://stackoverflow.com/questions/906402/importing-an-existing-x509-certificate-and-private-key-in-java-keystore-to-use-i
http://cunning.sharp.fm/2008/06/importing_private_keys_into_a.html
http://stackoverflow.com/questions/17695297/importing-the-private-key-public-certificate-pair-in-the-java-keystore
