Create Java KeyStore - Futurex Documentation

This section uses Java keytool commands to generate a new key pair on the Vectera Plus, create a Certificate Signing Request (CSR), issue a certificate through an internal or external CA, and import the signed certificate and its accompanying CA certificate into a Java KeyStore. Perform the following tasks to ensure that you can use jarsigner and the signed certificate to sign a JAR file in the next section:

Generate a server key pair and self-signed certificate.
Generate and export a CSR.
Import a CA root certificate.
Import the server certificate signed by the CA.

Because the JDK 8 installation includes keytool, you can run the commands without additional configuration.

Generate a key pair and certificate

Perform the following steps to generate a server key pair and self-signed certificate:

Execute the following command:

-alias sets a name to identify the key pair and certificate to be generated. It can be any name (for example, JarSignerDemo).

Shell

keytool -genkeypair -keyalg RSA -keysize 2048 -alias JarsignerDemo -keystore NONE -providerclass sun.security.pkcs11.SunPKCS11 -providerName SunPKCS11-Futurex -ext extendedKeyUsage=codeSigning -ext KeyUsage=digitalSignature

When prompted, enter the following information for the server certificate you want to generate and enter a new KeyStore password, which all subsequent keytool and jarsigner commands use:

None

What is your first and last name?
[Unknown]: www.example.com

What is the name of your organizational unit?
[Unknown]: Engineering

What is the name of your organization?
[Unknown]: Futurex

What is the name of your City or Locality?
[Unknown]: Bulverde

What is the name of your State or Province?
[Unknown]: TX

What is the two-letter country code for this unit?
[Unknown]: US

Is CN=www.example.com, OU=Engineering, O=Futurex, L=Bulverde, ST=TX, C=US correct?
[no]: yes

Generate and export a CSR

Perform the following steps to generate and export a CSR:

To generate and export a CSR, run the following command:

Shell

keytool -certreq -alias JarsignerDemo -file example.csr -keystore NONE -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerName SunPKCS11-Futurex

Enter the KeyStore password.

Send the CSR to a third-party or internal CA to get it signed.

The CA returns the server certificate and CA certificate for you to import.

Import a CA root certificate

Perform the following steps to import a CA root certificate:

To import the CA root certificate, run the following command:

Shell

keytool -import -trustcacerts -alias JarsignerDemoCA -keystore NONE -file ssl-ca-cert.pem -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerName SunPKCS11-Futurex

Enter the KeyStore password.

When prompted to trust the certificate, enter yes as shown in the following example:

Shell

Trust this certificate?
[no]: yes

Certificate was added to keystore.

Import the server certificate

Perform the following steps to import the server certificate signed by CA:

To import the signed server certificate, run the following command:

Shell

keytool -importcert -alias JarsignerDemo -keystore NONE -file signed-example-cert.pem -storetype PKCS11 -providerclass sun.security.pkcs11.SunPKCS11 -providerName SunPKCS11-Futurex

Enter the KeyStore password.

If the command was successful, you should see an output similar to the following example:

Shell

Certificate reply was installed in keystore.

​Generate a key pair and certificate

​Generate and export a CSR

​Import a CA root certificate

​Import the server certificate

Generate a key pair and certificate

Generate and export a CSR

Import a CA root certificate

Import the server certificate