Import CA signed certificate to keystore keytool -import -v -alias tomcat -file signed-cert.pem -keystore keystore.jks 9. Verify contents of keystore using this command: keytool -list -v -keystore keystore.jks The most important thing you want to see is that, under the private key alias, additional information is being displayed. Before you can create your CSR, you need to create your Java keystore. Your Java keystore contains your private key. Run the following command to create your 2048 bit Java keystore: keytool -genkey -alias myalias -keyalg RSA –keysize 2048 -keystore c:yoursite.keystore 2. Note the alias you use here to create the keystore. To Generate a Certificate by Using keytool. By default, the keytool utility creates a keystore file in the directory where the utility is run. Before You Begin. To run the keytool utility, your shell environment must be configured so that the J2SE /bin directory is in the path, otherwise the full path to the utility must be present on the command line.

To Use keytool to Create a ServerCertificate

Run keytool to generate a new key pair in the defaultdevelopment keystore file, keystore.jks. This exampleuses the alias server-alias to generate a new public/privatekey pair and wrap the public key into a self-signed certificate inside keystore.jks. The key pair is generated by using an algorithm oftype RSA, with a default password of changeit. For moreinformation and other examples of creating and managing keystore files, readthe keytool online help at http://download.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html.

• To create a private key and its corresponding public-key certificate using Java tools, you would do something like: $ keytool -genkeypair -keyalg rsa -keysize 2048 -alias jdavies -keystore jdavieskeys.jks -dname 'CN=Joshua Davies' $ keytool -certreq -alias jdavies -keystore jdavieskeys.jks jdaviescert.csr (get the CSR signed by a CA) $ keytool -import -alias jdavies -file jdaviescert.pem -keystore.
• KeyStore Explorer is an open source GUI replacement for the Java command-line utilities keytool and jarsigner. KeyStore Explorer presents their functionality,.
• If at all possible I would consider creating a new keystore in OpenSSL and new keys rather than trying to pry out the private key from the Java keystore. By opening the Java keystore and extracting the private key one is moving beyond the designed security features.

RSA is public-key encryption technology developed by RSA DataSecurity, Inc.

From the directory in which you want to create the key pair, run keytool as shown in the following steps.

1. /windows-10-enterprise-64-bit-product-key-generator.html. Generate the server certificate.

   Type the keytool command all on one line:

   When you press Enter, keytool prompts you to enterthe server name, organizational unit, organization, locality, state, and countrycode.

   You must type the server name in response to keytool’sfirst prompt, in which it asks for first and last names. For testing purposes,this can be localhost.

   When you run the example applications, the host (server name) specifiedin the keystore must match the host identified in the javaee.server.name property specified in the file tut-install/examples/bp-project/build.properties.

2. Export the generated server certificate in keystore.jks intothe file server.cer.

   Type the keytool commandall on one line:

3. If you want to have the certificate signed by a CA, read the exampleat http://download.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html.

4. To add the server certificate to the truststore file, cacerts.jks, run keytool from the directory where you createdthe keystore and server certificate.

   Use the following parameters:

   Information on the certificate, such as that shown next, will appear:

5. Type yes, then press the Enter or Return key.

   The following information appears:

Keytool Create A Keystore

If you have your own private key and CA-signed certificate files, you must create keystore files in which to import the certificates and the private keys for both the HTTPS and the console proxy service before importing the keystores in your vCloud Director environment.

• See Before You Create SSL Certificates for vCloud Director on Linux.
• Verify that you have access to a computer that has a Java version 8 or later runtime environment, so that you can use the keytool command to import the certificates. The vCloud Director installer places a copy of keytool in /opt/vmware/vcloud-director/jre/bin/keytool, but you can perform this procedure on any computer that has a Java runtime environment installed. Certificates created with a keytool from any other source are not supported for use with vCloud Director. These command-line examples assume that keytool is in the user's path.
• Familiarize yourself with the keytool command.
• Download and install OpenSSL.
• For more details on the available options for the certificates command, see Replacing Certificates for the HTTP and Console Proxy Endpoints.

Procedure

Keytool Generate Private Key From Keystore File

1. If you have intermediate certificates, run the command to concatenate the root CA-signed certificate with the intermediate certificates and create a certificate chain.
2. Use OpenSSL to create intermediate PKCS12 keystore files for both the HTTPS and the console proxy services with the private key, the certificate chain and the respective alias.
   1. Create the keystore file for the HTTPS service with password passwd.
   2. Create the keystore file for the console proxy service with password passwd.
3. Use keytool to import the PKCS12 keystores into JCЕKS keystore.
   1. Run the command to import the PKCS12 keystore for the HTTPS service.
   2. Run the command to import the PKCS12 keystore for the console proxy service.
4. To check if the certificates are imported to the JCEKS keystore, run the command to list the contents of the keystore file.
5. Repeat this procedure on all vCloud Director cells in your environment.

Advantages Of Private Key Encryption

• If you have not yet configured your vCloud Director instance, run the configure script to import the certificates keystore to vCloud Director. See Configure the Network and Database Connections.
  Note: If you created the certificates.ks keystore file on a computer other than the server on which you generated the list of fully qualified domain names and their associated IP addresses, copy the keystore file to that server now. You need the keystore path name when you run the configuration script.
• If you have already installed and configured your vCloud Director instance, use the certificates command of the cell management tool to import the certificates keystore. See Replacing Certificates for the HTTP and Console Proxy Endpoints.