Skip to main content
This section shows how to use the Java keytool commands to generate a new key pair on the Excrypt HSM, create a Certificate Signing Request (CSR), issue a certificate through an internal or external CA, and import the signed certificate and its accompanying CA certificate into a Java keystore. These steps ensure that you can use APKSigner and the signed certificate to sign an APK file in the next section.
The JDK installation includes the keytool application, so you can run the keytool commands in this section with no additional configuration.

Generate a key pair and certificate

Perform the following steps to generate a server key pair and self-signed certificate:
1
Execute the following command:
The -alias field sets a name to identify the key pair and certificate to be generated. It can be any name (for example, apksignerdemo).
Shell
2
When prompted, answer questions about the server certificate shown in the following example and enter the keystore password, which all keytool and jarsigner commands use moving forward:
None

Generate and export a CSR

Perform the following steps to generate and export a CSR:
1
To generate and export a CSR, run the following command:
Shell
2
Enter the keystore password.
3
Get the CSR signed by a CA, either third-party or internal.
After it is signed, the server certificate returned by the CA is imported along with the CA certificate.

Import a CA root certificate

Perform the following steps to import a CA root certificate:
1
To import the CA root certificate, run the following command:
Shell
2
Enter the keystore password.
3
When prompted to trust the certificate, enter Yes.
Shell

Import a server certificate

Perform the following steps to import a server certificate signed by a CA:
1
To import the signed server certificate, run the following command:
Shell
2
Enter the keystore password.
If the command succeeds, you should see an output similar to the following:Certificate reply was installed in keystore.