keytool and jks
keytool
Name
keytool - Key and Certificate Management Tool
Manages a keystore (database) of cryptographic keys, X.509 certificate chains, and trusted certificates.DESCRIPTION
keytool is a key and certificate management utility. It allows users to administer their own public/private key pairs and associated certificates for use in self-authentication (where the user authenticates himself/herself to other users/services) or data integrity and authentication services, using digital signatures. It also allows users to cache the public keys (in the form of certificates) of their communicating peers.
A certificate is a digitally signed statement from one entity (person, company, etc.), saying that the public key (and some other information) of some other entity has a particular value.(See Certificates.) When data is digitally signed, the signature can be verified to check the data integrity and authenticity. Integrity means that the data has not been modified or tampered with, and authenticity means the data indeed comes from whoever claims to have created and signed it.
keytool also enables users to administer secret keys used in symmetric encryption/decryption (e.g. DES).
keytool stores the keys and certificates in a keystore.
Commands
Key and Certificate Management Tool
Commands:
-certreq Generates a certificate request
-changealias Changes an entry's alias
-delete Deletes an entry
-exportcert Exports certificate
-genkeypair Generates a key pair
-genseckey Generates a secret key
-gencert Generates certificate from a certificate request
-importcert Imports a certificate or a certificate chain
-importkeystore Imports one or all entries from another keystore
-keypasswd Changes the key password of an entry
-list Lists entries in a keystore
-printcert Prints the content of a certificate
-printcertreq Prints the content of a certificate request
-printcrl Prints the content of a CRL file
-storepasswd Changes the store password of a keystore
1. 创建keystore文件
-genkey
-genkeypair
keytool -genkeypair [OPTION]...
Generates a key pair
Options:
-alias <alias> alias name of the entry to process
-keyalg <keyalg> key algorithm name
-keysize <keysize> key bit size
-sigalg <sigalg> signature algorithm name
-destalias <destalias> destination alias
-dname <dname> distinguished name
-startdate <startdate> certificate validity start date/time
-ext <value> X.509 extension
-validity <valDays> validity number of days
-keypass <arg> key password
-keystore <keystore> keystore name
-storepass <arg> keystore password
-storetype <storetype> keystore type
-providername <providername> provider name
-providerclass <providerclass> provider class name
-providerarg <arg> provider argument
-providerpath <pathlist> provider classpath
-v verbose output
-protected password through protected mechanism
keytool -genkeypair -alias xmg -keyalg RSA -keysize 2048 -validity 365 -keypass 123456 -storepass 123456 -keystore xmg.jks -dname "CN=frank, OU=xiaomage, O=xiaomage, L=SZ, ST=GUANGDONG, C=CN"
2. 查看keystore文件的信息
keytool -list -rfc -keystore xmg.jks -storepass 123456
3. 从keystore文件中导出certificate
keytool -exportcert [OPTION]...
Exports certificate
Options:
-rfc output in RFC style
-alias <alias> alias name of the entry to process
-file <filename> output file name
-keystore <keystore> keystore name
-storepass <arg> keystore password
-storetype <storetype> keystore type
-providername <providername> provider name
-providerclass <providerclass> provider class name
-providerarg <arg> provider argument
-providerpath <pathlist> provider classpath
-v verbose output
-protected password through protected mechanism
keytool -exportcert -keystore xmg.jks -alias xmg -file xmg.cer -rfc
-rfc 会将certificate的内容以可读的形式保存在 xmg.cer文件中,否则,cat xmg.cer将是一堆ASCII码.
一般 -keystore 和 -alias 要一起使用，如果在创建keystore文件时指定了alias.
4. 查看certificate的信息
keytool -printcert [OPTION]...
Prints the content of a certificate
Options:
-rfc output in RFC style
-file <filename> input file name
-sslserver <server[:port]> SSL server host and port
-jarfile <filename> signed jar file
-v verbose output
keytool -printcert -file xmg.cer
5. 将jks 转为 pfx格式
keytool -importkeystore [OPTION]...
Imports one or all entries from another keystore
Options:
-srckeystore <srckeystore> source keystore name
-destkeystore <destkeystore> destination keystore name
-srcstoretype <srcstoretype> source keystore type
-deststoretype <deststoretype> destination keystore type
-srcstorepass <arg> source keystore password
-deststorepass <arg> destination keystore password
-srcprotected source keystore password protected
-srcprovidername <srcprovidername> source keystore provider name
-destprovidername <destprovidername> destination keystore provider name
-srcalias <srcalias> source alias
-destalias <destalias> destination alias
-srckeypass <arg> source key password
-destkeypass <arg> destination key password
-noprompt do not prompt
-providerclass <providerclass> provider class name
-providerarg <arg> provider argument
-providerpath <pathlist> provider classpath
-v verbose output
keytool -alias xmg -importkeystore -srckeystore xmg.jks -srcstoretype jks -srcstorepass 123456 -destkeystore xmg.pfx -deststoretype pkcs12 -deststorepass 654321 -destkeypass 654321
.PFX或.P12文件: 这样的证书文件是二进制格式，同时包含证书和密钥，且一般有密码保护。
6. 将pfx格式 转为 pem格式
PEM文件: 这样的文件一般是文本格式，可以存放证书或密钥，或者两者都包含。 PEM 文件如果只包含密钥，一般用KEY文件代替。
从pem文件从分别提取 证书，PKCS#1 私钥，PKCS#8 私钥/公钥
#输出证书和密钥信息
openssl pkcs12 -in xmg.pfx -out xmg1.pem -nodes
#仅输出证书信息
openssl pkcs12 -in xmg.pfx -out xmg1.cer -nokeys
#仅输出密钥信息
openssl pkcs12 -in xmg.pfx -out xmg1.key -nocerts
#提取公钥
#本指令输出的公钥是PKCS#8 格式
#-----BEGIN PUBLIC KEY-----
#-----END PUBLIC KEY-----
openssl rsa -in xmg1.key -pubout -out pub.key
#提取私钥
#本指令输出的私钥是PKCS#1 格式
#-----BEGIN RSA PRIVATE KEY-----
#-----END RSA PRIVATE KEY-----
openssl rsa -in xmg1.key -out pri.key
#PKCS#1私钥 转换为 PKCS#8私钥
#-----BEGIN PRIVATE KEY-----
#-----END PRIVATE KEY-----
openssl pkcs8 -topk8 -in pri.key -out pri_8.key
Usage: pkcs12 [options]
where options are
-export output PKCS12 file
-chain add certificate chain
-inkey file private key if not infile
-certfile f add all certs in f
-CApath arg - PEM format directory of CA's
-CAfile arg - PEM format file of CA's
-name "name" use name as friendly name
-caname "nm" use nm as CA friendly name (can be used more than once).
-in infile input filename
-out outfile output filename
-noout don't output anything, just verify. -仅作为验证
-nomacver don't verify MAC.
-nocerts don't output certificates. -不输出证书信息
-clcerts only output client certificates. -仅输出客户端证书,尚不清楚client certificates是什么
-cacerts only output CA certificates.
-nokeys don't output private keys. -不输出密钥
-info give info about PKCS#12 structure.
-des encrypt private keys with DES
-des3 encrypt private keys with triple DES (default)
-seed encrypt private keys with seed
-aes128, -aes192, -aes256
encrypt PEM output with cbc aes
-camellia128, -camellia192, -camellia256
encrypt PEM output with cbc camellia
-nodes don't encrypt private keys -不对私钥进行加密，如果不指定，则会提示输入 私钥加密password
-noiter don't use encryption iteration
-nomaciter don't use MAC iteration
-maciter use MAC iteration
-nomac don't generate MAC
-twopass separate MAC, encryption passwords
-descert encrypt PKCS#12 certificates with triple DES (default RC2-40)
-certpbe alg specify certificate PBE algorithm (default RC2-40)
-keypbe alg specify private key PBE algorithm (default 3DES)
-macalg alg digest algorithm used in MAC (default SHA1)
-keyex set MS key exchange type
-keysig set MS key signature type
-password p set import/export password source
-passin p input file pass phrase source
-passout p output file pass phrase source
-engine e use engine e, possibly a hardware device.
-rand file:file:...
load the file (or the files in the directory) into
the random number generator
-CSP name Microsoft CSP name
-LMK Add local machine keyset attribute to private key
rsa [options] <infile >outfile
where options are
-inform arg input format - one of DER NET PEM //输入文件格式，默认pem格式
-outform arg output format - one of DER NET PEM //输出文件格式，默认pem格式
-in arg input file //输入文件
-sgckey Use IIS SGC key format //指定SGC编码格式，兼容老版本，不应再使用
-passin arg input file pass phrase source //指定输入文件的加密口令，可来自文件、终端、环境变量等
-out arg output file //输出文件
-passout arg output file pass phrase source //指定输出文件的加密口令，可来自文件、终端、环境变量等
-des encrypt PEM output with cbc des //使用des加密输出的文件
-des3 encrypt PEM output with ede cbc des using 168 bit key //使用des3加密输出的文件
-seed encrypt PEM output with cbc seed //使用seed加密输出的文件
-aes128, -aes192, -aes256 //使用aes加密输出的文件
encrypt PEM output with cbc aes
-camellia128, -camellia192, -camellia256 //使用camellia加密输出的文件
encrypt PEM output with cbc camellia
-text print the key in text //以明文形式输出各个参数值
-noout don't print key out //不输出密钥到任何文件
-modulus print the RSA key modulus //输出模数值
-check verify key consistency //检查输入密钥的正确性和一致性
-pubin expect a public key in input file //指定输入文件是公钥
-pubout output a public key //指定输出文件是公钥
-engine e use engine e, possibly a hardware device. //指定三方加密库或者硬件
Usage pkcs8 [options]
where options are
-in file input file
-inform X input format (DER or PEM)
-passin arg input file pass phrase source
-outform X output format (DER or PEM)
-out file output file
-passout arg output file pass phrase source
-topk8 output PKCS8 file -指定输出文件的格式为PKCS#8
-nooct use (nonstandard) no octet format
-embed use (nonstandard) embedded DSA parameters format
-nsdb use (nonstandard) DSA Netscape DB format
-noiter use 1 as iteration count
-nocrypt use or expect unencrypted private key -不对私钥加password
-v2 alg use PKCS#5 v2.0 and cipher "alg"
-v1 obj use PKCS#5 v1.5 and cipher "alg"
-engine e use engine e, possibly a hardware device.
DER&CER&CRT&PEM&PFX&P12什么含义
*.DER或*.CER文件： 这样的文件是二进制格式，一般只含有证书信息，不包含私钥。
*.CRT文件： 这样的文件可以是二进制格式，也可以是文本格式，一般均为文本格式，功能与 *.DER及*.CER文件相同。
*.PEM文件： 这样的文件一般是文本格式，可以存放证书或私钥，或者两者都包含。 *.PEM 文件如果只包含私钥，一般用*.KEY文件代替。
*.PFX或*.P12文件： 这样的文件一般是二进制格式，同时包含证书和私钥，且一般有密码保护。