A major mode for viewing and managing (java) keystores in Emacs.

This mode uses the keytool command, which comes with OpenJDK JRE. Make sure it is installed and available on the PATH.

The package keystore-mode is available on the MELPA repository. After MELPA is setup, as explained here it can be installed with

M-x package-install RET keystore-mode RET

Or alternatively using use-package in your init.el

(use-package keystore-mode)

There are several ways to open a buffer in keystore-mode.

Create a new keystore with M-x keystore-genkeypair. This command will prompt the user for certificate parameters. After the key and the certificate are generated, the keystore is displayed in a new buffer with keystore-mode.

Or create a new keystore with M-x keystore-genseckey. This command will prompt the user for key parameters. After the key is generated, the key is displayed in a new buffer with keystore-mode.

Alternatively you can create an empty keystore with M-x keystore-empty. This command will prompt for a keystore filename and a keystore password (twice), and create that keystore. By default it will not overwrite existing files, this behaviour can be overridden with the universal argument, i.e. C-u M-x keystore-empty.

Open an existing keystore with M-x keystore-visit. After selecting the keystore file, you’re asked to enter the keystore password. This password is stored in a buffer local variable. It is recommended to kill the buffer (bound to q) directly after you’re done with the keystore.

Following emacs’ philosophy, a backup of the keystore is created before any command is executed that modifies the keystore. In contrast to normal buffers, this is being done by the backup-buffer function because all keystore modifications are performed on the file system by the keytool command, and not on the contents of the buffer itself.

As a consequence the backups will be created following customizations of the backup group, however hooks like before-save-hook and after-save-hook are not executed. So customizations based on those hooks (f.e. like proposed on the wiki) will not have any effect here.

The mode defines the following keybindings:

The keystore-list-rfc command opens a buffer where the certificates are folded (using origami.el). The folding can be toggled with the <TAB> key.

keystore-mode is customizable in the customization group keystore-mode (M-x customize-group RET keystore-mode RET). For example the following configuration shows SHA1 fingerprint instead of SHA256 and adds the validity dates of certificates.

(custom-set-variables
 '(keystore-display-columns
   '(("fingerprint (SHA1)" 40 nil)
     ("type" 20 t)
     ("alias" 64 t)
     ("Valid from" 32 nil)
     ("Valid until" 0 nil))))

To apply new customizations to existing keystore buffers, use keystore-revisit.

Make sure that you’ve configured locales correctly on your system. For example for UTF-8:

sudo update-locale LC_ALL=en_US.UTF-8

• [ ] Add support for openssl and make it a more generic/versatile keystore/certificate management tool.
• [X] Backup the keystore before making changes to it.
• [X] Detect incorrect entered keystore passwords, and re-prompt the user.
• [ ] Currently generated keys get the keystore password, allow setting other passwords on keys.
• [X] Use call-process or process-file to invoke keytool
• [ ] Make keystore-mode play nice with TRAMP, to allow managing remote keystores.

I am open to any kind of feedback via issues.

For bug-fixes and/or new features, open a pull-request. Please create or update testcases for your changes, and make sure to add yourself to the AUTHORS file.

This repository provides a Caskfile for development purposes.

Tests are created with ecukes. The testsuite can be run with the following command:

cask exec ecukes