A group of snippets that I use frequently.
For SignCertificate (edited from https://www.youtube.com/watch?v=fQEhA79ifnI)
Create a certificate chain using keytool:
-
Create the keystore and the root certifying authority's certificate rootca first with the following command keytool -genkey -v -alias rootca -keyalg RSA -keystore kstore
-
Create server's certifying authority's initial certificate CA keytool -genkey -v -alias CA -keyalg RSA -keystore kstore
-
Sign CA with rootca using SignCertificate and store the new signed certificate as CAsigned java SignCertificate kstore rootca CA CAsigned
-
Now export the new signed certificate to a file CAsigned.crt keytool -export -alias CAsigned -keystore kstore -file CAsigned.crt
-
Display the signed certificate content keytool -printcert -v -file CAsigned.crt
-
Create a server key keytool -genkey -v -alias serverKey -keyalg RSA -keystore kstore
-
Sign CA with the server key using SignCertificate and store the new signed certificate as serverKeySigned java SignCertificate kstore CA serverKey serverKeySigned
-
Export the signed certificate to its crt file keytool -export -alias serverKeySigned -keystore kstore -file serverKeySigned.crt
-
Import back the signed certificate into the keystore keytool -import -alias serverKey -keystore kstore -file serverKeySigned.crt
-
List all of the keystore entries keytool -v -list -keystore kstore
-
Display the signed server key content keytool -printcert -v -file serverKeySigned.crt