密钥与证书工具 openssl keytool

1
2
3
4
5
6
7

# 生成PKCS12格式的密钥文件
keytool -genkey -alias localhost -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -storetype PKCS12 -keystore localhost.p12 -dname CN=localhost,OU=Test,O=pkslow,L=Guangzhou,C=CN -validity 731 -storepass changeit -keypass changeit

# 导出pem(certificate)
openssl pkcs12 -nokeys -in ./localhost.p12 -out localhost.pem
# 导出key
openssl pkcs12 -nocerts -nodes -in ./localhost.p12 -out localhost.key

1
2
3

# To import a certificate into a PKCS12 keystore, we can also use openssl :
openssl pkcs12 -export -in ynthm.cer -inkey ynthm.key -out ynthm.keystore -name trustme
openssl pkcs12 -info -in ynthm.keystore

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# 生成 PKCS＃12 keystore JDK 17 执行 JDK 8 没有 HmacPBESHA256
keytool -genkeypair -alias ynthm-keystore -keyalg RSA -keysize 4096 \
  -validity 365 -dname "CN=localhost" -keypass changeit -keystore keystore.p12 \
  -storeType PKCS12 -storepass changeit
# 查看 keystore
keytool -list -v -keystore keystore.p12
# 导出公钥/证书
keytool -export -alias ynthm-keystore -keystore keystore.p12 -rfc -file pubkey.cer
# 导入证书到 truststore 文件中 提示创建密码 storepass
keytool -import -alias ynthm-truststore -file pubkey.cer -keystore truststore.p12
# 查看生成的 truststore 文件
keytool -list -v -keystore truststore.p12

# JDK 8
# jks keystore 文件
keytool -genkey -alias jks-keystore -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -keystore keystore.jks -dname CN=localhost,OU=Test,O=pkslow,L=Guangzhou,C=CN -validity 365 -storepass changeit -keypass changeit
keytool -list -v -keystore keystore.jks
# 导出证书
keytool -export -alias jks-keystore -keystore keystore.jks -rfc -file selfsignedcert.cer
# 导入证书到 truststore 文件中 提示创建密码 storepass
keytool -import -alias jks-truststore -file selfsignedcert.cer -keystore truststore.jks
# 查看生成的 truststore 文件
keytool -list -v -keystore truststore.jks

keytool -genkeypair --help

1
2
3

# To import a certificate into a PKCS12 keystore, we can also use openssl :
openssl pkcs12 -export -in ynthm.cer -inkey ynthm.key -out ynthm.keystore -name trustme
openssl pkcs12 -info -in ynthm.keystore

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# 生成一个密钥对
keytool -genkey -alias localhost -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -keystore localhost.jks -dname CN=localhost,OU=Test,O=pkslow,L=Guangzhou,C=CN -validity 731 -storepass changeit -keypass changeit

# 生成CSR文件
keytool -certreq -alias localhost -file localhost.csr -keystore localhost.jks -storepass changeit

# 导出一个cert文件
keytool -export -alias xxx -file xxx.cer -keystore xxx.jks

#导入一个cert文件
keytool -import -alias xxx -file xxx.cer -keystore xxx.jks

# 查看cert列表详情
keytool -list -v -keystore xxx.p12 -storepass changeit -storetype PKCS12
keytool -list -v -keystore xxx.jks -storepass changeit -storetype JKS

#转换JKS格式为P12
keytool -importkeystore -srckeystore xxx.jks -destkeystore xxx.p12 -srcstoretype JKS -deststoretype PKCS12 -srcstorepass changeit -deststorepass changeit -srckeypass changeit -destkeypass changeit -srcalias xxx -destalias xxx -noprompt