Java Keytool Tutorial: How to generate a Self-Signed certificate using the Java Keytool

The Java keytool allows your to generate certs that you can use with applications such as Tomcat. The below tutorial will show you how to generate a self signed cert that you can use with your applications.

It starts from the very beginning and shows you how to install Java, set up a key store and generate your jks cert.

This guide will first show you how to download Java JDK.

You will then add java to your path.

Next you will use the Java keytool to create a Java keystore

You will then generate a Self-Signed cert using the Java Key tool.

This cert will be in JKS format.

Finally you will view the certificates in the keystore to see the cert which you generated using java keytool commands.

A full text tutorial can be found here:

[TylerMatthewHarris]

People like you are what makes the internet awesome, thank you

[SlimHandle]

That is impressive. I learned about SSL recently so to learn the keystore bit will help complete me

[snoggletog]

thank u so much it worked like a charm

[TCSkateboard]

Can I do it with Open JDK Instead Java SE? (It seems that needs a license...)

[Akash]

In ssl (non java) certificates you will get private key with separate certificate. I originally thought with the genkey command you used we get private key and we need to run certreq to get the certificate.

also if we try to curl the url in Linux you get error. I am not sure if adding the certificate to truststore will resolve that issue.

[akhilsuryaa]

hey how can I set validity on that certificate and how to configure it with my .jar file

[alfonsoesteves]

I was getting really confused about encrypting things with CA's private key, and the browser decryting it with public key.
Then I read that keys are interchangeble, if one encrypts, the other can decrypt, regardless of which one is the private/public. Is this correct?
Given a key pair A B.
A message encripted with A can only be decryped with B. I believe that is true, but:
If a message is able to be decryted with B, does it necessarily mean it was encryped with A.
I hope so, otherwise when the CA sing the certificates won't be prove of anything...

[SammarpanDasguptaOfficial]

Thanks a lot sit...That helps me a lot

[ShivamYadav-jeeb]

Thank you sir! I think I had hours of YouTube videos but can't find a solution for generating SHA1 fingerprint. I am so thankful to you for helping me with this problem. But, the problem I faced was my CMD, I think we need to run CMD as an administrator!

[srividhyalakshminarayanan]

Is this a private-public key pair generated? I see privatekey generated...Is it possible to generate a keypair using keytool?

[Peter-qqqp]

Hi there ...I rarely comment but this tutorial really helped me out. Thanks man!

[SalvadorChaosOfficial]

I'm a beginner, so sorry if I come off as naive:
but do I do this (create a new Keystore) for every app?
or is there a different command to add a new app Key to this existing Keystore?
or am I completely misunderstanding what a Keystore is and what it's used for? Lol

[zebakhanumbadagi]

Hi,
I am getting filenotfound exception c:local.keystore access is denied erroe

[rohitmania]

Is this just a keypair stored in a jks keystore or a propert self-signed certificate?

[neway]

This step :c:\>keytool -v -list -keystore local.keystore
I am failed
It has my local.keystore in my c drive.

[hamzameliki]

thank you too much for helping us for free, can you please tell us how import that key in connection java to mysql ?

[amanagrawal]

Do this require cmd to be open in admin mode as i am getting an error, "keystore location not found "

[elijahekerendu]

Hello Darren, I love ur video. can you also do this for windows 7. the process is quite different

[AhmedKhaled-hemf]

Thanks very much for your efforts,

Please how fix below error ?
Invalidated: [Session-3,

[seanpurcell]

My command prompt says that keytool isn't recognized as an internal or external command