Home > Articles > Security > Network Security

  • Print
  • + Share This
  • 💬 Discuss
Like this article? We recommend

Like this article? We recommend

Generating a Private Key and a Keystore

To generate a keystore, you need a JDK installed with its /bin directory in your path. You can verify this setup by typing keytool at the shell prompt. You should see the help text, similar to this (which is an opportunity for you to peek at the options, in case you like to read ahead):

C:\>\bea_81sp4\jrockit81_142_05\bin\keytool
keytool usage:

-certreq   [-v] [-alias <alias>] [-sigalg <sigalg>]
       [-file <csr_file>] [-keypass <keypass>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-delete   [-v] -alias <alias>
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-export   [-v] [-rfc] [-alias <alias>] [-file <cert_file>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-genkey   [-v] [-alias <alias>] [-keyalg <keyalg>]
       [-keysize <keysize>] [-sigalg <sigalg>]
       [-dname <dname>] [-validity <valDays>]
       [-keypass <keypass>] [-keystore <keystore>]
       [-storepass <storepass>] [-storetype <storetype>]
       [-provider <provider_class_name>] ...

-help

-identitydb [-v] [-file <idb_file>] [-keystore <keystore>]
       [-storepass <storepass>] [-storetype <storetype>]
       [-provider <provider_class_name>] ...

-import   [-v] [-noprompt] [-trustcacerts] [-alias <alias>]
       [-file <cert_file>] [-keypass <keypass>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-keyclone  [-v] [-alias <alias>] -dest <dest_alias>
       [-keypass <keypass>] [-new <new_keypass>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-keypasswd  [-v] [-alias <alias>]
       [-keypass <old_keypass>] [-new <new_keypass>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-list    [-v | -rfc] [-alias <alias>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

-printcert  [-v] [-file <cert_file>]

-selfcert  [-v] [-alias <alias>] [-sigalg <sigalg>]
       [-dname <dname>] [-validity <valDays>]
       [-keypass <keypass>] [-keystore <keystore>]
       [-storepass <storepass>] [-storetype <storetype>]
       [-provider <provider_class_name>] ...

-storepasswd [-v] [-new <new_storepass>]
       [-keystore <keystore>] [-storepass <storepass>]
       [-storetype <storetype>] [-provider <provider_class_name>] ...

This output comes from BEA's version of the JVM called JRockit. However, the output would be identical if I had used Sun's version.

We use only a few of these options here, the first of which is -genkey, which generates the private key. The -genkey option can also add the private key to an existing keystore; or, if the keystore specified does not exist, it create a new one.

To create a new keystore, you issue the following command at the command prompt:

keytool -genkey -alias servercert -keyalg RSA -keysize 1024 -dname "CN=jsvede.bea.com,OU=DRE,O=BEA,L=Denver,S=Colorado,C=US" -keypass weblogic1234 -keystore server_keystore.jks -storepass weblogic1234

The alias is the unique identifier of this entry. I recommend that you name it something specific to your server or application, but it can be anything you want.

The –keyalg is the algorithm that is used to generate the key. You can read about the other values for this argument on Sun's Web site. Most people choose RSA.

The next argument, –dname, is the Distinguished Name (DN). It contains the server identity, called the Common Name (CN), as well as other relevant information about your Organizational Unit (OU), Oranization(O), Locality (L), State (S) and Country (C). In WebLogic 8.1, you can use nearly any ASCII characters you want in this string, but in prior versions the SSL implementation was not as flexible.

The –keypass is the password for your private key; it is required for obvious reasons. Next, you specify the keystore name and the keystore password. Again, I recommend that you use a password for this and that it be something cryptic. Also, I recommend using a different password than the private key password.

When you run this command, it produces no output:

D:\ssl-article\examples>keytool -genkey -alias servercert -keyalg RSA -keysize 1024 -dname "CN=jsvede.bea.com,OU=DRE,O=BEA,L=Denver,S=Colorado,C=
US" -keypass weblogic1234 -keystore server_keystore.jks -storepass weblogic1234

D:\ssl-article\examples>dir
 Volume in drive D is DATA
 Volume Serial Number is 80F6-E25B

 Directory of D:\ssl-article\examples

03/04/2005 07:35p   <DIR>     .
03/04/2005 07:35p   <DIR>     ..
03/04/2005 07:35p        1,353 server_keystore.jks
        1 File(s)     1,353 bytes
        2 Dir(s) 12,589,309,952 bytes free

D:\ssl-article\examples>

You can verify the contents of your keystore, which at this time is only the private key, using this command:

D:\ssl-article\examples>keytool -list -v -keystore server_keystore.jks -storepass weblogic1234

Keystore type: jks
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: servercert
Creation date: Mar 4, 2005
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=jsvede.bea.com, OU=DRE, O=BEA, L=Denver, ST=Colorado, C=US
Issuer: CN=jsvede.bea.com, OU=DRE, O=BEA, L=Denver, ST=Colorado, C=US
Serial number: 42291b03
Valid from: Fri Mar 04 19:35:47 MST 2005 until: Thu Jun 02 20:35:47 MDT 2005
Certificate fingerprints:
     MD5: D4:55:EA:25:FF:1A:1C:22:F5:3E:76:53:36:96:CF:93
     SHA1: 82:3F:73:37:A5:B9:A0:24:F4:E4:CA:0F:E8:A9:0B:CB:41:2F:F0:29

The next step is to generate the Certificate Signing Request (CSR). To do so, issue the following command:

D:\ssl-article\examples>keytool -certreq -v -alias servercert -file csr-for-myserver.pem -keypass weblogic1234 -storepass weblogic1234 -keystore
server_keystore.jks
Certification request stored in file <csr-for-myserver.pem>
Submit this to your CA

As the command output suggests, you should now find a file called csr-for-myserver.pem in the current directory. Its contents look something like this:

D:\ssl-article\examples>more csr-for-myserver.pem
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBpjCCAQ8CAQAwZjELMAkGA1UEBhMCVVMxETAPBgNVBAgTCENvbG9yYWRvMQ8wDQYDVQQHEwZE
ZW52ZXIxDDAKBgNVBAoTA0JFQTEMMAoGA1UECxMDRFJFMRcwFQYDVQQDEw5qc3ZlZGUuYmVhLmNv
bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3hwTyXG2gWGUTMKMTeIkUgYzPJJwboJQdEIc
VbkHuzEnAnymz+402R2lR/mJjSCo1m+Wv3s5JvGZ9d2EfGC9ZpDG3tZGxqWomhAOBwyVBgcCmFOj
hv6rgrRO0NrO5KOyqJQBAHKHlj7M9hYD6Nml4M0wXqg43+9jR2NnTNLdMzsCAwEAAaAAMA0GCSqG
SIb3DQEBBAUAA4GBAIJ67O+gCe8KqyGKiKdcBfqSEGFQYBxJrnM9It9NcOn723Rt4OHvcz0a3Qz0
6ZutPzH0PbVxDIaG1jvy7Bew6khrWVxt6xX2gndxbx1qwDwW1e1VyRrGwP1ZXKZDzaJptlz+7P8B
3jyIgC4HsM5poBfSLtn3xX3Zy1tQkDmmiyL7
-----END NEW CERTIFICATE REQUEST-----

Not very enlightening, is it? It isn't supposed to be pretty. This is the encrypted information you specified when creating the private key. Don't worry though; your certificate authority should have no trouble deciphering it.

This file is what you submit to your CA for signing.

In this case, I use VeriSign's Trial Certificate Authority. You fill out various fields about yourself and your organization. This is all for business purposes; the actual information about your certificates are already encoded into the CSR. With VeriSign, after you've completed the online stuff, you receive an e-mail message with an entry like this:

-----BEGIN CERTIFICATE-----
MIIDJjCCAtCgAwIBAgIQVd1yrfv2854JsDjU08ZA+DANBgkqhkiG9w0BAQUFADCB
qTEWMBQGA1UEChMNVmVyaVNpZ24sIEluYzFHMEUGA1UECxM+d3d3LnZlcmlzaWdu
LmNvbS9yZXBvc2l0b3J5L1Rlc3RDUFMgSW5jb3JwLiBCeSBSZWYuIExpYWIuIExU
RC4xRjBEBgNVBAsTPUZvciBWZXJpU2lnbiBhdXRob3JpemVkIHRlc3Rpbmcgb25s
eS4gTm8gYXNzdXJhbmNlcyAoQylWUzE5OTcwHhcNMDUwMzA1MDAwMDAwWhcNMDUw
MzE5MjM1OTU5WjBmMQswCQYDVQQGEwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzAN
BgNVBAcUBkRlbnZlcjEMMAoGA1UEChQDQkVBMQwwCgYDVQQLFANEUkUxFzAVBgNV
BAMUDmpzdmVkZS5iZWEuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDe
HBPJcbaBYZRMwoxN4iRSBjM8knBuglB0QhxVuQe7MScCfKbP7jTZHaVH+YmNIKjW
b5a/ezkm8Zn13YR8YL1mkMbe1kbGpaiaEA4HDJUGBwKYU6OG/quCtE7Q2s7ko7Ko
lAEAcoeWPsz2FgPo2aXgzTBeqDjf72NHY2dM0t0zOwIDAQABo4HRMIHOMAkGA1Ud
EwQCMAAwCwYDVR0PBAQDAgWgMEIGA1UdHwQ7MDkwN6A1oDOGMWh0dHA6Ly9jcmwu
dmVyaXNpZ24uY29tL1NlY3VyZVNlcnZlclRlc3RpbmdDQS5jcmwwUQYDVR0gBEow
SDBGBgpghkgBhvhFAQcVMDgwNgYIKwYBBQUHAgEWKmh0dHA6Ly93d3cudmVyaXNp
Z24uY29tL3JlcG9zaXRvcnkvVGVzdENQUzAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
KwYBBQUHAwIwDQYJKoZIhvcNAQEFBQADQQBVDkyW9fc1o28p7+lZW7GY/VRL/am5
7dxNQPLXxQjP1gG1wfw2OGh7YAPZCS2QaX/hQnXRWGhtVKBmdB80FDFJ
-----END CERTIFICATE-----

Copy this information into a file. I usually name it servername-signed-cert.pem to distinguish it from my other certificates.

We can peek at the contents using keytool:

D:\ssl-article\examples>keytool -printcert -v -file jsvede-signed-cert.pem
Owner: CN=jsvede.bea.com, OU=DRE, O=BEA, L=Denver, ST=Colorado, C=US
Issuer: OU=For VeriSign authorized testing only. No assurances (C)VS1997, OU=http://www.verisign.com/repository/TestCPS Incorp. By Ref. Liab. LTD., O="V
eriSign, Inc"
Serial number: 55dd72adfbf6f39e09b038d4d3c640f8
Valid from: Fri Mar 04 17:00:00 MST 2005 until: Sat Mar 19 16:59:59 MST 2005
Certificate fingerprints:
     MD5: 29:F6:04:14:90:20:FC:80:FF:BB:A0:EE:A7:4A:81:F7
     SHA1: C3:EC:12:C2:CC:CE:B1:F4:C4:6A:56:80:74:93:EC:A7:48:43:3C:7F

This tells us that this certificate is for a server named jsvede.bea.com and it was signed by VeriSign but for testing purposes only. Additionally, we see that this certificate is only good for 14 days.

Before we move on, we need one more thing: the root certificate for the VeriSign trial certificate authority. It's available on VeriSign's site, but here are its contents:

-----BEGIN CERTIFICATE-----
MIICTTCCAfcCEFKp9CTaZ0ydr09TeFKr724wDQYJKoZIhvcNAQEEBQAwgakxFjAU
BgNVBAoTDVZlcmlTaWduLCBJbmMxRzBFBgNVBAsTPnd3dy52ZXJpc2lnbi5jb20v
cmVwb3NpdG9yeS9UZXN0Q1BTIEluY29ycC4gQnkgUmVmLiBMaWFiLiBMVEQuMUYw
RAYDVQQLEz1Gb3IgVmVyaVNpZ24gYXV0aG9yaXplZCB0ZXN0aW5nIG9ubHkuIE5v
IGFzc3VyYW5jZXMgKEMpVlMxOTk3MB4XDTk4MDYwNzAwMDAwMFoXDTA2MDYwNjIz
NTk1OVowgakxFjAUBgNVBAoTDVZlcmlTaWduLCBJbmMxRzBFBgNVBAsTPnd3dy52
ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9UZXN0Q1BTIEluY29ycC4gQnkgUmVmLiBM
aWFiLiBMVEQuMUYwRAYDVQQLEz1Gb3IgVmVyaVNpZ24gYXV0aG9yaXplZCB0ZXN0
aW5nIG9ubHkuIE5vIGFzc3VyYW5jZXMgKEMpVlMxOTk3MFwwDQYJKoZIhvcNAQEB
BQADSwAwSAJBAMak6xImJx44jMKcbkACy5/CyMA2fqXK4PlzTtCxRq5tFkDzne7s
cI8oFK/J+gFZNE3bjidDxf07O3JOYG9RGx8CAwEAATANBgkqhkiG9w0BAQQFAANB
AKWnR/KPNxCglpTP5nzbo+QCIkmsCPjTCMnvm7KcwDJguaEwkoi1gBSY9biJp9oK
+cv1Yn3KuVM+YptcWXLfxxI=
-----END CERTIFICATE-----

Save this as verisign-demo-cert-root.pem.

  • + Share This
  • 🔖 Save To Your Account

Discussions

comments powered by Disqus