- Category: Java
- Last Updated: Thursday, 02 July 2015 23:17
- Written by Stefan Reimer
First you have to create a new private key within an existing or new keystore using keytool:
keytool -genkeypair -keyalg rsa -keystore keystorename -storepass keystorepassword -alias my_new_key
The preceding command uses java 1.6 syntax! If your are still using Java 1.5, substitute -genkeypair with -genkey.
- to protect the new private key by its own keypassword within the keystore you have to add the keypass option
- if you don't use the keypass option the keystore password is used to protect the private key
- accordingly in order to delete a key password (which is not possible with keytool btw), you have to copy the keystore password to the key password
- if you want to use the key as a client certifcate use RSA as key algorithm, instead of default DSA, because many servers (e.g IBM MQ) only accept RSA client certs
The next task is to generate a CSR, even if you want to create a self signed certifcate:
keytool -certreq -alias my_new_key -keystore keystorename -storepass keystorepassword -file my_new.csr
Now it is time to either send the CSR to the CA of your choice, or to sign it by your own CA using openssl:
openssl x509 -req -in my_new.csr -CA my_ca.crt -CAkey my_ca.key -out my_new.crt -days 365 -CAcreateserial -CAserial my_ca.seq
In case your certificate is not selfsigned, you first have to import the certificate of the CA, and in case all intermediate CAs, that signed your CSR. After that, by importing the certficate the chain of trust will be established.
keytool -import -alias my_ca -file ca.crt -keystore keystorename -storepass keystorepassword
You have to enter either "yes" or use .
Finally the signed certificate has to be imported into the keystore using the same alias as the private key:
keytool -import -alias my_new_key -file my_new.crt -keystore keystorename -storepass keystorepassword
Examing the keystore
To see what's inside any given keystore:
keytool -list -keystore keystorename
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
my_key, Sep 26, 2007, keyEntry,
Certificate fingerprint (MD5): BA:22:E1:9E:9D:83:05:5A:99:42:5E:EF:62:77:DE:5A
my_ca, Sep 26, 2007, trustedCertEntry,
Certificate fingerprint (MD5): 4E:B5:B6:7A:02:F8:F8:6E:5E:79:FB:84:65:75:42:68
To get detailed information, like issuer for an alias use "-v" !
Change keystore passpharse
To change to keystore passphrase use the following keytool command:
keytool -storepasswd -keystore keystorename
If you use JDK 1.6 keytool you have to change the keypasswd for all private keys within the keystore as well !
OpenSSL and Keystores
A common task is to exchange keys and certificates between apache webserver, ssl loadbalancer or java application server such as tomcat or BEA Weblogic. This means to convert keys and certificates from PEM,DER or PKCS12 to or from java keystores. The standard keytool is able to import or export certificates, but there is no way to do so with private keys.
keytool -export -rfc -alias my_cert -file cert.crt -keystore keystorename -storepass keystorepassword
keytool -import -alias my_cert -file cert.crt -keystore keystorename -storepass keystorepassword
Import private key:
In order to import an exisiting private key you first have to get and compile the ImportKey.java tool. It is based on ImportKey. I added options to import keys and certs into an existing keystore as well as setting the keystore passphrase via the command line.
Usage: java ImportKey keyfile certfile [alias] [keystore] [keystore_passphrase]
The key has to be in DER format, which can be easily done with openssl:
openssl pkcs8 -topk8 -nocrypt -in key.pem -inform PEM -out key.der -outform DER
In case of a self signed certifcate use:
openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
If the certifcate is signed by a foreign CA or even signed by intermediate CA(s) use:
openssl crl2pkcs7 [-certfile ca_intermediate.pem] -certfile ca.pem -in cert.pem -inform PEM -out cert.der -outform DER -nocrl
This will create a PKCS#7 container using DER format including the correct certificate chain.
Then build a new keystore using both key and certificate:
java ImportKey key.der cert.der my_alias
Export private key:
In order to export any private key from an existing keystore download and compile ExportPriv.java. After compiling it run:
java ExportPriv > exported.key
The key will be exported into exported.key file in PKCS#8 PEM format. This can be converted into RSA format which is needed by apache with:
openssl pkcs8 -inform PEM -nocrypt -in exported.key -out exported_rsa.key
Various needful commands
Convert PEM to PKCS12
To create a pkcs12 container from a pem private key and cert use:
openssl pkcs12 -export -in cert.pem -inkey key.pem -out cred.p12
Export key and cert from PKCS12 to PEM
If you have a pkcs12 container and its passphrase .) use the following command to extract the private key and client certificate only (-clcerts), without encrypting the exported private key again (-nodes):
openssl pkcs12 -in cred.p12 -out certkey.pem -nodes -clcerts
As you will probably notice, both key and certificate are combined into one file. If you need them seperatly you can either split the file using your favorite editor by simply save everything between (and including) each of the -----BEGIN----- and -----END----- lines to separate files or use the following two commands to export them seperatly:
openssl pkcs12 -in cred.p12 -out cert.pem -nodes -clcerts -nokeysopenssl pkcs12 -in cred.p12 -out key.pem -nodes -nocerts
Remove passphrase of private key
It will prompt for current passphrase:
openssl rsa -in oldkey.pem -out newkey.pem
Change passphrase of private key
It will prompt for old passphrase and twice for new one:
openssl rsa [-des3|-aes128] -in oldkey.pem -out newkey.pem
View details of a certificate signing request CSR
openssl req -noout -text -in server.csr
Graphical Keytool Tool
- Category: Java
- Last Updated: Monday, 18 May 2015 03:32
- Written by Stefan Reimer
In order to find memory leaks within a java application it is sometimes not enough looking at thread dumps. With tools like visualgc, a tool the see the different memory pools inside a running java app, you can tune the memory setup concering heap size, perm size, survivor ratio, etc., but you can't see which type of objects are causing the heap to fill up.
Enable Heap Dumps
There are several possibilities to enable heap dumps.
One way is to start to application with -XX:+HeapDumpOnCtrlBreak (Introduced since JDK 1.4.2 update 12 and 5.0 update 7), see for additional information.
Sending signal SIGQUIT (3) to the running process causes the jvm to write a heap dump into its working directory. Unfortunately the -XX:HeapDumpPath option, to set the path to write the heap dump file to, currently doesn't work. See Sun Bug report.
Another way to get a heap dump of any running java application is using jmap, which is now part of the jdk.
jmap -dump:format=b pid
writes heap.bin to current directory. Since JDK 1.6 jmap you can use -heap:format=b,file=<heap_dump.out>
Analyse Heap Dumps
The best tool start with is probably hat, which is part of the jdk since JDK1.6 and called jhat.
If you don't have java 6 yet, get hat from here. Good examples and Documentation are available as well.
Prior to JDK 1.6 call: (attune heap size if hat to the size of your heap dumps)
java -jar hat.jar -Xmx512M heap_dump.out
After hat finished analysing the heap dump, it starts a HTTP server accessible on port 7000.