.\" Automatically generated by Pod::Man 2.16 (Pod::Simple 3.05)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sh \" Subsection heading
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.ie \nF \{\
.    de IX
.    tm Index:\\$1\t\\n%\t"\\$2"
..
.    nr % 0
.    rr F
.\}
.el \{\
.    de IX
..
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "GKEYTOOL 1"
.TH GKEYTOOL 1 "2012-03-22" "0.99-pre" "GNU"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
gkeytool \- Manage private keys and public certificates
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
keytool [\fI\s-1COMMAND\s0\fR] ...
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
Cryptographic credentials, in a Java environment, are usually stored in a \fIKey Store\fR. The Java \s-1SDK\s0 specifies a \fIKey Store\fR as a persistent container of two types of objects: \fIKey Entries\fR and \fITrusted Certificates\fR. The security tool \fBkeytool\fR is a Java-based application for managing those types of objects.
.PP
A \fIKey Entry\fR represents the private key part of a key-pair used in Public-Key Cryptography, and a signed X.509 certificate which authenticates the public key part for a known entity; i.e. the owner of the key-pair. The X.509 certificate itself contains the public key part of the key-pair.
.PP
A \fITrusted Certificate\fR is a signed X.509 certificate issued by a trusted entity. The \fITrust\fR in this context is relative to the User of the \fBkeytool\fR. In other words, the existence of a \fITrusted Certificate\fR in the \fIKey Store\fR processed by a \fBkeytool\fR command implies that the User trusts the \fIIssuer\fR of that \fITrusted Certificate\fR to also sign, and hence authenticates, other \fISubjects\fR the tool may process.
.PP
\&\fITrusted Certificates\fR are important because they allow the tool to mechanically construct \fIChains of Trust\fR starting from one of the \fITrusted Certificates\fR in a \fIKey Store\fR and ending with a certificate whose \fIIssuer\fR is potentially unknown. A valid chain is an ordered list, starting with a \fITrusted Certificate\fR (also called the \fIanchor\fR), ending with the target certificate, and satisfying the condition that the \fISubject\fR of certificate \f(CW\*(C`#i\*(C'\fR is the \fIIssuer\fR of certificate \f(CW\*(C`#i + 1\*(C'\fR.
.PP
The \fBkeytool\fR is invoked from the command line as follows:
.PP
.Vb 1
\&        keytool [COMMAND] ...
.Ve
.PP
Multiple \fI\s-1COMMAND\s0\fRs may be specified at once, each complete with its own options. \fBkeytool\fR will parse all the arguments, before processing, and executing, each \f(CW\*(C`COMMAND\*(C'\fR. If an exception occurs while executing one \fI\s-1COMMAND\s0\fR \fBkeytool\fR will abort. Note however that because the implementation of the tool uses code to parse command line options that also supports GNU-style options, you have to separate each command group with a double-hyphen; e.g
.PP
.Vb 1
\&        keytool \-list \-\- \-printcert \-alias mykey
.Ve
.SH "OPTIONS"
.IX Header "OPTIONS"
.IP "\- Add/Update commands" 4
.IX Item "- Add/Update commands"
.RS 4
.PD 0
.IP "\fB\-genkey [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-genkey [OPTION]..."
.PD
Generate a new \fIKey Entry\fR, eventually creating a new key store.
.IP "\fB\-import [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-import [OPTION]..."
Add, to a key store, \fIKey Entries\fR (private keys and certificate chains authenticating the public keys) and \fITrusted Certificates\fR (3rd party certificates which can be used as \fITrust Anchors\fR when building chains-of-trust).
.IP "\fB\-selfcert [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-selfcert [OPTION]..."
Generate a new self-signed \fITrusted Certificate\fR.
.IP "\fB\-cacert [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-cacert [OPTION]..."
Import a \s-1CA\s0 \fITrusted Certificate\fR.
.IP "\fB\-identitydb [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-identitydb [OPTION]..."
\&\fB\s-1NOT\s0 \s-1IMPLEMENTED\s0 \s-1YET\s0\fR.Import a \s-1JDK\s0 1.1 style Identity Database.
.RE
.RS 4
.RE
.IP "\- Export commands" 4
.IX Item "- Export commands"
.RS 4
.PD 0
.IP "\fB\-certreq [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-certreq [OPTION]..."
.PD
Issue a \fICertificate Signing Request\fR (\s-1CSR\s0) which can be then sent to a \fICertification Authority\fR (\s-1CA\s0) to issue a certificate signed (by the \s-1CA\s0) and authenticating the \fISubject\fR of the request.
.IP "\fB\-export [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-export [OPTION]..."
Export a certificate from a key store.
.RE
.RS 4
.RE
.IP "\- Display commands" 4
.IX Item "- Display commands"
.RS 4
.PD 0
.IP "\fB\-list [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-list [OPTION]..."
.PD
Print one or all certificates in a key store to \f(CW\*(C`STDOUT\*(C'\fR.
.IP "\fB\-printcert [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-printcert [OPTION]..."
Print a human-readable form of a certificate, in a designated file, to \f(CW\*(C`STDOUT\*(C'\fR.
.RE
.RS 4
.RE
.IP "\- Management commands" 4
.IX Item "- Management commands"
.RS 4
.PD 0
.IP "\fB\-keyclone [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-keyclone [OPTION]..."
.PD
Clone a \fIKey Entry\fR in a key store.
.IP "\fB\-storepasswd [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-storepasswd [OPTION]..."
Change the password protecting a key store.
.IP "\fB\-keypasswd [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-keypasswd [OPTION]..."
Change the password protecting a \fIKey Entry\fR in a key store.
.IP "\fB\-delete [\fR\fI\s-1OPTION\s0\fR\fB]...\fR" 4
.IX Item "-delete [OPTION]..."
Delete a \fIKey Entry\fR or a \fITrusted Certificate\fR from a key store.
.RE
.RS 4
.RE
.PP
\fICommon options\fR
.IX Subsection "Common options"
.PP
The following \fB\s-1OPTION\s0\fRs are used in more than one \fB\s-1COMMAND\s0\fR. They are described here to reduce redundancy.
.IP "\fB\-alias\fR \fIAlias\fR" 4
.IX Item "-alias Alias"
Every entry, be it a \fIKey Entry\fR or a \fITrusted Certificate\fR, in a key store is uniquely identified by a user-defined \fIAlias\fR string. Use this option to specify the \fIAlias\fR to use when referring to an entry in the key store. Unless specified otherwise, a default value of \f(CW\*(C`mykey\*(C'\fR shall be used when this option is omitted from the command line.
.IP "\fB\-keyalg\fR \fI\s-1ALGORITHM\s0\fR" 4
.IX Item "-keyalg ALGORITHM"
Use this option to specify the canonical name of the key-pair generation algorithm. The default value for this option is \f(CW\*(C`DSS\*(C'\fR (a synonym for the Digital Signature Algorithm also known as \s-1DSA\s0).
.IP "\fB\-keysize\fR \fI\s-1SIZE\s0\fR" 4
.IX Item "-keysize SIZE"
Use this option to specify the number of bits of the shared modulus (for both the public and private keys) to use when generating new keys. A default value of \f(CW1024\fR will be used if this option is omitted from the command line.
.IP "\fB\-validity\fR \fI\s-1DAY_COUNT\s0\fR" 4
.IX Item "-validity DAY_COUNT"
Use this option to specify the number of days a newly generated certificate will be valid for. The default value is \f(CW90\fR (days) if this option is omitted from the command line.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
Use this option to specify the type of the key store to use. The default value, if this option is omitted, is that of the property \f(CW\*(C`keystore.type\*(C'\fR in the security properties file, which is obtained by invoking the static method call \f(CW\*(C`getDefaultType()\*(C'\fR in \f(CW\*(C`java.security.KeyStore\*(C'\fR.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
Use this option to specify the password protecting the key store. If this option is omitted from the command line, you will be prompted to provide a password.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
Use this option to specify the location of the key store to use. The default value is a file \s-1URL\s0 referencing the file named \fI.keystore\fR located in the path returned by the call to \f(CW\*(C`java.lang.System#getProperty(String)\*(C'\fR using \f(CW\*(C`user.home\*(C'\fR as argument.
.Sp
If a \s-1URL\s0 was specified, but was found to be malformed \-\-e.g. missing protocol element\*(-- the tool will attempt to use the \s-1URL\s0 value as a file-name (with absolute or relative path-name) of a key store \-\-as if the protocol was \f(CW\*(C`file:\*(C'\fR.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
A fully qualified class name of a \fISecurity Provider\fR to add to the current list of \fISecurity Providers\fR already installed in the \s-1JVM\s0 in-use. If a provider class is specified with this option, and was successfully added to the runtime \-\-i.e. it was not already installed\*(-- then the tool will attempt to removed this \fISecurity Provider\fR before exiting.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
Use this option to designate a file to use with a command. When specified with this option, the value is expected to be the fully qualified path of a file accessible by the File System. Depending on the command, the file may be used as input or as output. When this option is omitted from the command line, \f(CW\*(C`STDIN\*(C'\fR will be used instead, as the source of input, and \f(CW\*(C`STDOUT\*(C'\fR will be used instead as the output destination.
.IP "\fB\-v\fR" 4
.IX Item "-v"
Unless specified otherwise, use this option to enable more verbose output.
.PP
\fIAdd/Update commands\fR
.IX Subsection "Add/Update commands"
.PP
The \fB\-genkey\fR command
.IX Subsection "The -genkey command"
.PP
Use this command to generate a new key-pair (both private and public keys), and save these credentials in the key store as a \fIKey Entry\fR, associated with the designated (if was specified with the \fB\-alias\fR option) or default (if the \fB\-alias\fR option is omitted) \fIAlias\fR.
.PP
The private key material will be protected with a user-defined password (see \fB\-keypass\fR option). The public key on the other hand will be part of a self-signed X.509 certificate, which will form a 1\-element chain and will be saved in the key store.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-keyalg\fR \fI\s-1ALGORITHM\s0\fR" 4
.IX Item "-keyalg ALGORITHM"
See \fICommon Options\fR for more details.
.IP "\fB\-keysize\fR \fI\s-1KEY_SIZE\s0\fR" 4
.IX Item "-keysize KEY_SIZE"
See \fICommon Options\fR for more details.
.IP "\fB\-sigalg\fR \fI\s-1ALGORITHM\s0\fR" 4
.IX Item "-sigalg ALGORITHM"
The canonical name of the digital signature algorithm to use for signing certificates. If this option is omitted, a default value will be chosen based on the type of the key-pair; i.e., the algorithm that ends up being used by the \-keyalg option. If the key-pair generation algorithm is \f(CW\*(C`DSA\*(C'\fR, the value for the signature algorithm will be \f(CW\*(C`SHA1withDSA\*(C'\fR. If on the other hand the key-pair generation algorithm is \f(CW\*(C`RSA\*(C'\fR, then the tool will use \f(CW\*(C`MD5withRSA\*(C'\fR as the signature algorithm.
.IP "\fB\-dname\fR \fI\s-1NAME\s0\fR" 4
.IX Item "-dname NAME"
This a mandatory value for the command. If no value is specified \-\-i.e. the \fB\-dname\fR option is omitted\*(-- the tool will prompt you to enter a \fIDistinguished Name\fR to use as both the \fIOwner\fR and \fIIssuer\fR of the generated self-signed certificate.
.Sp
See \fICommon Options\fR for more details.
.IP "\fB\-keypass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-keypass PASSWORD"
Use this option to specify the password which the tool will use to protect the newly created \fIKey Entry\fR.
.Sp
If this option is omitted, you will be prompted to provide a password.
.IP "\fB\-validity\fR \fI\s-1DAY_COUNT\s0\fR" 4
.IX Item "-validity DAY_COUNT"
See \fICommon Options\fR for more details.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-import\fR command
.IX Subsection "The -import command"
.PP
Use this command to read an X.509 certificate, or a PKCS#7 \fICertificate Reply\fR from a designated input source and incorporate the certificates into the key store.
.PP
If the \fIAlias\fR does not already exist in the key store, the tool treats the certificate read from the input source as a new \fITrusted Certificate\fR. It then attempts to discover a chain-of-trust, starting from that certificate and ending at another \fITrusted Certificate\fR, already stored in the key store. If the \fB\-trustcacerts\fR option is present, an additional key store, of type \f(CW\*(C`JKS\*(C'\fR named \fIcacerts\fR, and assumed to be present in \fI${\s-1JAVA_HOME\s0}/lib/security\fR will also be consulted if found \-\-\f(CW\*(C`${JAVA_HOME}\*(C'\fR refers to the location of an installed \fIJava Runtime Environment\fR (\s-1JRE\s0). If no chain-of-trust can be established, and unless the \f(CW\*(C`\-noprompt\*(C'\fR option has been specified, the certificate is printed to \f(CW\*(C`STDOUT\*(C'\fR and the user is prompted for a confirmation.
.PP
If \fIAlias\fR exists in the key store, the tool will treat the certificate(s) read from the input source as a \fICertificate Reply\fR, which can be a chain of certificates, that eventually would replace the chain of certificates associated with the \fIKey Entry\fR of that \fIAlias\fR. The substitution of the certificates only occurs if a chain-of-trust can be established between the bottom certificate of the chain read from the input file and the \fITrusted Certificates\fR already present in the key store. Again, if the \fB\-trustcacerts\fR option is specified, additional \fITrusted Certificates\fR in the same \fIcacerts\fR key store will be considered. If no chain-of-trust can be established, the operation will abort.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
See \fICommon Options\fR for more details.
.IP "\fB\-keypass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-keypass PASSWORD"
Use this option to specify the password which the tool will use to protect the \fIKey Entry\fR associated with the designated \fIAlias\fR, when replacing this \fIAlias\fR' chain of certificates with that found in the certificate reply.
.Sp
If this option is omitted, and the chain-of-trust for the certificate reply has been established, the tool will first attempt to unlock the \fIKey Entry\fR using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
.IP "\fB\-noprompt\fR" 4
.IX Item "-noprompt"
Use this option to prevent the tool from prompting the user.
.IP "\fB\-trustcacerts\fR" 4
.IX Item "-trustcacerts"
Use this option to indicate to the tool that a key store, of type \f(CW\*(C`JKS\*(C'\fR, named \fIcacerts\fR, and usually located in \fIlib/security\fR in an installed \fIJava Runtime Environment\fR should be considered when trying to establish chain-of-trusts.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-selfcert\fR command
.IX Subsection "The -selfcert command"
.PP
Use this command to generate a self-signed X.509 version 1 certificate. The newly generated certificate will form a chain of one element which will replace the previous chain associated with the designated \fIAlias\fR (if \fB\-alias\fR option was specified), or the default \fIAlias\fR (if \fB\-alias\fR option was omitted).
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-sigalg\fR \fI\s-1ALGORITHM\s0\fR" 4
.IX Item "-sigalg ALGORITHM"
The canonical name of the digital signature algorithm to use for signing the certificate. If this option is omitted, a default value will be chosen based on the type of the private key associated with the designated \fIAlias\fR. If the private key is a \f(CW\*(C`DSA\*(C'\fR one, the value for the signature algorithm will be \f(CW\*(C`SHA1withDSA\*(C'\fR. If on the other hand the private key is an \f(CW\*(C`RSA\*(C'\fR one, then the tool will use \f(CW\*(C`MD5withRSA\*(C'\fR as the signature algorithm.
.IP "\fB\-dname\fR \fI\s-1NAME\s0\fR" 4
.IX Item "-dname NAME"
Use this option to specify the \fIDistinguished Name\fR of the newly generated self-signed certificate. If this option is omitted, the existing \fIDistinguished Name\fR of the base certificate in the chain associated with the designated \fIAlias\fR will be used instead.
.Sp
See \fICommon Options\fR for more details.
.IP "\fB\-validity\fR \fI\s-1DAY_COUNT\s0\fR" 4
.IX Item "-validity DAY_COUNT"
See \fICommon Options\fR for more details.
.IP "\fB\-keypass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-keypass PASSWORD"
Use this option to specify the password which the tool will use to unlock the \fIKey Entry\fR associated with the designated \fIAlias\fR.
.Sp
If this option is omitted, the tool will first attempt to unlock the \fIKey Entry\fR using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-cacert\fR command
.IX Subsection "The -cacert command"
.PP
Use this command to import, a \s-1CA\s0 certificate and add it to the key store as a \fITrusted Certificate\fR. The \fIAlias\fR for this new entry will be constructed from the \s-1FILE\s0's base-name after replacing hyphens and dots with underscores.
.PP
This command is useful when used in a script that recursively visits a directory of \s-1CA\s0 certificates to populate a \f(CW\*(C`cacerts.gkr\*(C'\fR \fIKey Store\fR of trusted certificates which can then be used commands that specify the \fB\-trustcacerts\fR option.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
See \fICommon Options\fR for more details.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-identitydb\fR command
.IX Subsection "The -identitydb command"
.PP
\&\fB\s-1NOT\s0 \s-1IMPLEMENTED\s0 \s-1YET\s0\fR.
.PP
Use this command to import a \s-1JDK\s0 1.1 style Identity Database.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
See \fICommon Options\fR for more details.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
\fIExport commands\fR
.IX Subsection "Export commands"
.PP
The \fB\-certreq\fR command
.IX Subsection "The -certreq command"
.PP
Use this command to generate a PKCS#10 \fICertificate Signing Request\fR (\s-1CSR\s0) and write it to a designated output destination. The contents of the destination should look something like the following:
.PP
.Vb 6
\&        \-\-\-\-\-BEGIN NEW CERTIFICATE REQUEST\-\-\-\-\-
\&        MI...QAwXzEUMBIGA1UEAwwLcnNuQGdudS5vcmcxGzAZBgNVBAoMElUg
\&        Q2...A0GA1UEBwwGU3lkbmV5MQwwCgYDVQQIDANOU1cxCzAJBgNVBACC
\&        ...
\&        FC...IVwNVOfQLRX+O5kAhQ/a4RTZme2L8PnpvgRwrf7Eg8D6w==
\&        \-\-\-\-\-END NEW CERTIFICATE REQUEST\-\-\-\-\-
.Ve
.PP
\&\fB\s-1IMPORTANT\s0\fR: Some documentation (e.g. \s-1RSA\s0 examples) claims that the \f(CW\*(C`Attributes\*(C'\fR field, in the \s-1CSR\s0 is \f(CW\*(C`OPTIONAL\*(C'\fR while \s-1RFC\-2986\s0 implies the opposite. This implementation considers this field, by default, as \f(CW\*(C`OPTIONAL\*(C'\fR, unless the option \fB\-attributes\fR is specified on the command line.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-sigalg\fR \fI\s-1ALGORITHM\s0\fR" 4
.IX Item "-sigalg ALGORITHM"
The canonical name of the digital signature algorithm to use for signing the certificate. If this option is omitted, a default value will be chosen based on the type of the private key associated with the designated \fIAlias\fR. If the private key is a \f(CW\*(C`DSA\*(C'\fR one, the value for the signature algorithm will be \f(CW\*(C`SHA1withDSA\*(C'\fR. If on the other hand the private key is an \f(CW\*(C`RSA\*(C'\fR one, then the tool will use \f(CW\*(C`MD5withRSA\*(C'\fR as the signature algorithm.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
See \fICommon Options\fR for more details.
.IP "\fB\-keypass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-keypass PASSWORD"
Use this option to specify the password which the tool will use to unlock the \fIKey Entry\fR associated with the designated \fIAlias\fR.
.Sp
If this option is omitted, the tool will first attempt to unlock the \fIKey Entry\fR using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.IP "\fB\-attributes\fR" 4
.IX Item "-attributes"
Use this option to force the tool to encode a \f(CW\*(C`NULL\*(C'\fR \s-1DER\s0 value in the \s-1CSR\s0 as the value of the \f(CW\*(C`Attributes\*(C'\fR field.
.PP
The \fB\-export\fR command
.IX Subsection "The -export command"
.PP
Use this command to export a certificate stored in a key store to a designated output destination, either in binary format (if the \fB\-v\fR option is specified), or in \s-1RFC\-1421\s0 compliant encoding (if the \fB\-rfc\fR option is specified instead).
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
See \fICommon Options\fR for more details.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-rfc\fR" 4
.IX Item "-rfc"
Use \s-1RFC\-1421\s0 specifications when encoding the output.
.IP "\fB\-v\fR" 4
.IX Item "-v"
Output the certificate in binary \s-1DER\s0 encoding. This is the default output format of the command if neither \fB\-rfc\fR nor \f(CW\*(C`\-v\*(C'\fR options were detected on the command line. If both this option and the \fB\-rfc\fR option are detected on the command line, the tool will opt for the \s-1RFC\-1421\s0 style encoding.
.PP
\fIDisplay commands\fR
.IX Subsection "Display commands"
.PP
The \fB\-list\fR command
.IX Subsection "The -list command"
.PP
Use this command to print one or all of a key store entries to \f(CW\*(C`STDOUT\*(C'\fR. Usually this command will only print a \fIfingerprint\fR of the certificate, unless either the \fB\-rfc\fR or the \fB\-v\fR option is specified.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
If this option is omitted, the tool will print \s-1ALL\s0 the entries found in the key store.
.Sp
See \fICommon Options\fR for more details.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-rfc\fR" 4
.IX Item "-rfc"
Use \s-1RFC\-1421\s0 specifications when encoding the output.
.IP "\fB\-v\fR" 4
.IX Item "-v"
Output the certificate in human-readable format. If both this option and the \fB\-rfc\fR option are detected on the command line, the tool will opt for the human-readable form and will not abort the command.
.PP
The \fB\-printcert\fR command
.IX Subsection "The -printcert command"
.PP
Use this command to read a certificate from a designated input source and print it to \f(CW\*(C`STDOUT\*(C'\fR in a human-readable form.
.IP "\fB\-file\fR \fI\s-1FILE\s0\fR" 4
.IX Item "-file FILE"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
\fIManagement commands\fR
.IX Subsection "Management commands"
.PP
The \fB\-keyclone\fR command
.IX Subsection "The -keyclone command"
.PP
Use this command to clone an existing \fIKey Entry\fR and store it under a new (different) \fIAlias\fR protecting, its private key material with possibly a new password.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-dest\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-dest ALIAS"
Use this option to specify the new \fIAlias\fR which will be used to identify the cloned copy of the \fIKey Entry\fR.
.IP "\fB\-keypass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-keypass PASSWORD"
Use this option to specify the password which the tool will use to unlock the \fIKey Entry\fR associated with the designated \fIAlias\fR.
.Sp
If this option is omitted, the tool will first attempt to unlock the \fIKey Entry\fR using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
.IP "\fB\-new\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-new PASSWORD"
Use this option to specify the password protecting the private key material of the newly cloned copy of the \fIKey Entry\fR.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-storepasswd\fR command
.IX Subsection "The -storepasswd command"
.PP
Use this command to change the password protecting a key store.
.IP "\fB\-new\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-new PASSWORD"
The new, and different, password which will be used to protect the designated key store.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-keypasswd\fR command
.IX Subsection "The -keypasswd command"
.PP
Use this command to change the password protecting the private key material of a designated \fIKey Entry\fR.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.Sp
Use this option to specify the password which the tool will use to unlock the \fIKey Entry\fR associated with the designated \fIAlias\fR.
.Sp
If this option is omitted, the tool will first attempt to unlock the \fIKey Entry\fR using the same password protecting the key store. If this fails, you will then be prompted to provide a password.
.IP "\fB\-new\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-new PASSWORD"
The new, and different, password which will be used to protect the private key material of the designated \fIKey Entry\fR.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.PP
The \fB\-delete\fR command
.IX Subsection "The -delete command"
.PP
Use this command to delete a designated key store entry.
.IP "\fB\-alias\fR \fI\s-1ALIAS\s0\fR" 4
.IX Item "-alias ALIAS"
See \fICommon Options\fR for more details.
.IP "\fB\-storetype\fR \fI\s-1STORE_TYPE\s0\fR" 4
.IX Item "-storetype STORE_TYPE"
See \fICommon Options\fR for more details.
.IP "\fB\-keystore\fR \fI\s-1URL\s0\fR" 4
.IX Item "-keystore URL"
See \fICommon Options\fR for more details.
.IP "\fB\-storepass\fR \fI\s-1PASSWORD\s0\fR" 4
.IX Item "-storepass PASSWORD"
See \fICommon Options\fR for more details.
.IP "\fB\-provider\fR \fI\s-1PROVIDER_CLASS_NAME\s0\fR" 4
.IX Item "-provider PROVIDER_CLASS_NAME"
See \fICommon Options\fR for more details.
.IP "\fB\-v\fR" 4
.IX Item "-v"
See \fICommon Options\fR for more details.
.SH "BUGS"
.IX Header "BUGS"
.SH "SEE ALSO"
.IX Header "SEE ALSO"
.SH "AUTHOR"
.IX Header "AUTHOR"