how to create certificate chain using keytool,ssl tutorial

Creating Certificate Chain using 'Keytool'
1. Create the keystore kstore and the root certifying authority's certificate rootCA first with the following command-
keytool -genkey -v -alias rootca -keyalg RSA -keystore kstore

2. Create Server's certifying authority's initial certificate CA1
keytool -genkey -v -alias CA1 -keyalg RSA -keystore kstore

java SignCertificate kstore rootCA CA1 CA1signed

How to add certificate chain to keystore
Use the CA to Create Signed Certificates in a Java Keystore

[amittikare]

thanks for accommodating the request, informative video.

[LeslieGomba]

Why did you export then re-import the CASigned cert after you signed it with th java program???
Also noticed that in your video originally the java program was invoke like this (eg. at 2min 18sec
java SignCertificate kstore rootCA CA CASignet.crt) BUT at 2min 29sec
this command appears to have changed to
java SignCertificate kstore rootCA CA CASigned
????
My basic question is after running this java program, does it sign the CA cert with rootCA and can you then immediately use this CA to sign the Server Key OR do you for some reason need to export this signed CA and re-import it before you can use it to
sign the Server Key ???

Can you clarify this?

Regards ... Leslie

[abbeydudeuk]

The voice is of an Indian and the channel name is Zariga Tongy. Its like sher ghar pe aaya tha ya maa jungle gayee thi

[irfanghori]

Dear Friend,

I received 3 certificated from my organization
1. server.crt
2. rootca.der
3.intermediate.der

the chain of trust ass follows
rootca
|-intermediate.der
|-server

I try to install the certificated with the following import statements

keytool -import -trustcacerts -alias rootca -file rootca.der -keystore mykeystore.jks -storepass welcome1

keytool -import -trustcacerts -alias intermediateca -file intermediate.der -keystore mykeystore.jks -storepass welcome1


keytool -importcert -alias server -file server.crt -keystore mykeystore.jks -keypass welcome1 -storepass welcome1

but as a resut its added to keystore, and not installed

anxiously, waiting for you reply

[udaishankar]

1:12 I do not get the java file in my env. I only get the kstore file. any idea why?

[RishabhChaturvedirc]

My scenario is the certificate is getting added as trustedCertEntry type always but my requirements is to add it as privateKeyEntry EntryType .Can you please help

[zarigatongy]

how to create certificate chain using keytool, ssl tutorial

[karamjitsinghsehdev]

Wel explained.I am getting SSL handshake exception while connecting SMTP.gmail.com from a Java web application hosted on tomcat on centos.

[jpfreeley]

@Zariga -- thanks for all the great tutorials. If there any chance that you can update this one to NOT use SignCertficate.java which is very out of date at this point and relies heavily on sun.security.x509 methods. Or can you post an updated SignCertificate.java which uses current packages and methods. Is there a way to replace SignCertificate.java with an openssl command instead? Thanks!

[rajeshrenke]

when I use keytool -genkey.. where do I see private and public key in keystore file?

[valleyview]

Sub and Like, can you show how to do this chain using makecert and signtool?

[PrashantSable]

I have public.cert file. I have exported same in keystore. Can we export it back?? What's the commnd for same

[rajeshrenke]

from where can I download SignCertificate.java file ?

[LeHungProduction]

what is command "ls SignCertificate.java kstore" ?