Provided by: gcj-4.8-jre-headless_4.8.4-2ubuntu1~14.04.4_amd64 bug

NAME

       gkeytool - Manage private keys and public certificates

SYNOPSIS

       keytool [COMMAND] ...

DESCRIPTION

       Cryptographic credentials, in a Java environment, are usually stored in a Key Store. The
       Java SDK specifies a Key Store as a persistent container of two types of objects: Key
       Entries and Trusted Certificates. The security tool keytool is a Java-based application
       for managing those types of objects.

       A Key Entry represents the private key part of a key-pair used in Public-Key Cryptography,
       and a signed X.509 certificate which authenticates the public key part for a known entity;
       i.e. the owner of the key-pair. The X.509 certificate itself contains the public key part
       of the key-pair.

       A Trusted Certificate is a signed X.509 certificate issued by a trusted entity. The Trust
       in this context is relative to the User of the keytool. In other words, the existence of a
       Trusted Certificate in the Key Store processed by a keytool command implies that the User
       trusts the Issuer of that Trusted Certificate to also sign, and hence authenticates, other
       Subjects the tool may process.

       Trusted Certificates are important because they allow the tool to mechanically construct
       Chains of Trust starting from one of the Trusted Certificates in a Key Store and ending
       with a certificate whose Issuer is potentially unknown. A valid chain is an ordered list,
       starting with a Trusted Certificate (also called the anchor), ending with the target
       certificate, and satisfying the condition that the Subject of certificate "#i" is the
       Issuer of certificate "#i + 1".

       The keytool is invoked from the command line as follows:

               keytool [COMMAND] ...

       Multiple COMMANDs may be specified at once, each complete with its own options. keytool
       will parse all the arguments, before processing, and executing, each "COMMAND". If an
       exception occurs while executing one COMMAND keytool will abort. Note however that because
       the implementation of the tool uses code to parse command line options that also supports
       GNU-style options, you have to separate each command group with a double-hyphen; e.g

               keytool -list -- -printcert -alias mykey

OPTIONS

       - Add/Update commands
           -genkey [OPTION]...
               Generate a new Key Entry, eventually creating a new key store.

           -import [OPTION]...
               Add, to a key store, Key Entries (private keys and certificate chains
               authenticating the public keys) and Trusted Certificates (3rd party certificates
               which can be used as Trust Anchors when building chains-of-trust).

           -selfcert [OPTION]...
               Generate a new self-signed Trusted Certificate.

           -cacert [OPTION]...
               Import a CA Trusted Certificate.

           -identitydb [OPTION]...
               NOT IMPLEMENTED YET.Import a JDK 1.1 style Identity Database.

       - Export commands
           -certreq [OPTION]...
               Issue a Certificate Signing Request (CSR) which can be then sent to a
               Certification Authority (CA) to issue a certificate signed (by the CA) and
               authenticating the Subject of the request.

           -export [OPTION]...
               Export a certificate from a key store.

       - Display commands
           -list [OPTION]...
               Print one or all certificates in a key store to "STDOUT".

           -printcert [OPTION]...
               Print a human-readable form of a certificate, in a designated file, to "STDOUT".

       - Management commands
           -keyclone [OPTION]...
               Clone a Key Entry in a key store.

           -storepasswd [OPTION]...
               Change the password protecting a key store.

           -keypasswd [OPTION]...
               Change the password protecting a Key Entry in a key store.

           -delete [OPTION]...
               Delete a Key Entry or a Trusted Certificate from a key store.

       Common options

       The following OPTIONs are used in more than one COMMAND. They are described here to reduce
       redundancy.

       -alias Alias
           Every entry, be it a Key Entry or a Trusted Certificate, in a key store is uniquely
           identified by a user-defined Alias string. Use this option to specify the Alias to use
           when referring to an entry in the key store. Unless specified otherwise, a default
           value of "mykey" shall be used when this option is omitted from the command line.

       -keyalg ALGORITHM
           Use this option to specify the canonical name of the key-pair generation algorithm.
           The default value for this option is "DSS" (a synonym for the Digital Signature
           Algorithm also known as DSA).

       -keysize SIZE
           Use this option to specify the number of bits of the shared modulus (for both the
           public and private keys) to use when generating new keys. A default value of 1024 will
           be used if this option is omitted from the command line.

       -validity DAY_COUNT
           Use this option to specify the number of days a newly generated certificate will be
           valid for. The default value is 90 (days) if this option is omitted from the command
           line.

       -storetype STORE_TYPE
           Use this option to specify the type of the key store to use. The default value, if
           this option is omitted, is that of the property "keystore.type" in the security
           properties file, which is obtained by invoking the static method call
           "getDefaultType()" in "java.security.KeyStore".

       -storepass PASSWORD
           Use this option to specify the password protecting the key store. If this option is
           omitted from the command line, you will be prompted to provide a password.

       -keystore URL
           Use this option to specify the location of the key store to use. The default value is
           a file URL referencing the file named .keystore located in the path returned by the
           call to "java.lang.System#getProperty(String)" using "user.home" as argument.

           If a URL was specified, but was found to be malformed --e.g. missing protocol
           element-- the tool will attempt to use the URL value as a file-name (with absolute or
           relative path-name) of a key store --as if the protocol was "file:".

       -provider PROVIDER_CLASS_NAME
           A fully qualified class name of a Security Provider to add to the current list of
           Security Providers already installed in the JVM in-use. If a provider class is
           specified with this option, and was successfully added to the runtime --i.e. it was
           not already installed-- then the tool will attempt to removed this Security Provider
           before exiting.

       -file FILE
           Use this option to designate a file to use with a command. When specified with this
           option, the value is expected to be the fully qualified path of a file accessible by
           the File System. Depending on the command, the file may be used as input or as output.
           When this option is omitted from the command line, "STDIN" will be used instead, as
           the source of input, and "STDOUT" will be used instead as the output destination.

       -v  Unless specified otherwise, use this option to enable more verbose output.

       Add/Update commands

       The -genkey command

       Use this command to generate a new key-pair (both private and public keys), and save these
       credentials in the key store as a Key Entry, associated with the designated (if was
       specified with the -alias option) or default (if the -alias option is omitted) Alias.

       The private key material will be protected with a user-defined password (see -keypass
       option). The public key on the other hand will be part of a self-signed X.509 certificate,
       which will form a 1-element chain and will be saved in the key store.

       -alias ALIAS
           See Common Options for more details.

       -keyalg ALGORITHM
           See Common Options for more details.

       -keysize KEY_SIZE
           See Common Options for more details.

       -sigalg ALGORITHM
           The canonical name of the digital signature algorithm to use for signing certificates.
           If this option is omitted, a default value will be chosen based on the type of the
           key-pair; i.e., the algorithm that ends up being used by the -keyalg option. If the
           key-pair generation algorithm is "DSA", the value for the signature algorithm will be
           "SHA1withDSA". If on the other hand the key-pair generation algorithm is "RSA", then
           the tool will use "MD5withRSA" as the signature algorithm.

       -dname NAME
           This a mandatory value for the command. If no value is specified --i.e. the -dname
           option is omitted-- the tool will prompt you to enter a Distinguished Name to use as
           both the Owner and Issuer of the generated self-signed certificate.

           See Common Options for more details.

       -keypass PASSWORD
           Use this option to specify the password which the tool will use to protect the newly
           created Key Entry.

           If this option is omitted, you will be prompted to provide a password.

       -validity DAY_COUNT
           See Common Options for more details.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -import command

       Use this command to read an X.509 certificate, or a PKCS#7 Certificate Reply from a
       designated input source and incorporate the certificates into the key store.

       If the Alias does not already exist in the key store, the tool treats the certificate read
       from the input source as a new Trusted Certificate. It then attempts to discover a chain-
       of-trust, starting from that certificate and ending at another Trusted Certificate,
       already stored in the key store. If the -trustcacerts option is present, an additional key
       store, of type "JKS" named cacerts, and assumed to be present in ${JAVA_HOME}/lib/security
       will also be consulted if found --"${JAVA_HOME}" refers to the location of an installed
       Java Runtime Environment (JRE). If no chain-of-trust can be established, and unless the
       "-noprompt" option has been specified, the certificate is printed to "STDOUT" and the user
       is prompted for a confirmation.

       If Alias exists in the key store, the tool will treat the certificate(s) read from the
       input source as a Certificate Reply, which can be a chain of certificates, that eventually
       would replace the chain of certificates associated with the Key Entry of that Alias. The
       substitution of the certificates only occurs if a chain-of-trust can be established
       between the bottom certificate of the chain read from the input file and the Trusted
       Certificates already present in the key store. Again, if the -trustcacerts option is
       specified, additional Trusted Certificates in the same cacerts key store will be
       considered. If no chain-of-trust can be established, the operation will abort.

       -alias ALIAS
           See Common Options for more details.

       -file FILE
           See Common Options for more details.

       -keypass PASSWORD
           Use this option to specify the password which the tool will use to protect the Key
           Entry associated with the designated Alias, when replacing this Alias' chain of
           certificates with that found in the certificate reply.

           If this option is omitted, and the chain-of-trust for the certificate reply has been
           established, the tool will first attempt to unlock the Key Entry using the same
           password protecting the key store. If this fails, you will then be prompted to provide
           a password.

       -noprompt
           Use this option to prevent the tool from prompting the user.

       -trustcacerts
           Use this option to indicate to the tool that a key store, of type "JKS", named
           cacerts, and usually located in lib/security in an installed Java Runtime Environment
           should be considered when trying to establish chain-of-trusts.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -selfcert command

       Use this command to generate a self-signed X.509 version 1 certificate. The newly
       generated certificate will form a chain of one element which will replace the previous
       chain associated with the designated Alias (if -alias option was specified), or the
       default Alias (if -alias option was omitted).

       -alias ALIAS
           See Common Options for more details.

       -sigalg ALGORITHM
           The canonical name of the digital signature algorithm to use for signing the
           certificate. If this option is omitted, a default value will be chosen based on the
           type of the private key associated with the designated Alias. If the private key is a
           "DSA" one, the value for the signature algorithm will be "SHA1withDSA". If on the
           other hand the private key is an "RSA" one, then the tool will use "MD5withRSA" as the
           signature algorithm.

       -dname NAME
           Use this option to specify the Distinguished Name of the newly generated self-signed
           certificate. If this option is omitted, the existing Distinguished Name of the base
           certificate in the chain associated with the designated Alias will be used instead.

           See Common Options for more details.

       -validity DAY_COUNT
           See Common Options for more details.

       -keypass PASSWORD
           Use this option to specify the password which the tool will use to unlock the Key
           Entry associated with the designated Alias.

           If this option is omitted, the tool will first attempt to unlock the Key Entry using
           the same password protecting the key store. If this fails, you will then be prompted
           to provide a password.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -cacert command

       Use this command to import, a CA certificate and add it to the key store as a Trusted
       Certificate. The Alias for this new entry will be constructed from the FILE's base-name
       after replacing hyphens and dots with underscores.

       This command is useful when used in a script that recursively visits a directory of CA
       certificates to populate a "cacerts.gkr" Key Store of trusted certificates which can then
       be used commands that specify the -trustcacerts option.

       -file FILE
           See Common Options for more details.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -identitydb command

       NOT IMPLEMENTED YET.

       Use this command to import a JDK 1.1 style Identity Database.

       -file FILE
           See Common Options for more details.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       Export commands

       The -certreq command

       Use this command to generate a PKCS#10 Certificate Signing Request (CSR) and write it to a
       designated output destination. The contents of the destination should look something like
       the following:

               -----BEGIN NEW CERTIFICATE REQUEST-----
               MI...QAwXzEUMBIGA1UEAwwLcnNuQGdudS5vcmcxGzAZBgNVBAoMElUg
               Q2...A0GA1UEBwwGU3lkbmV5MQwwCgYDVQQIDANOU1cxCzAJBgNVBACC
               ...
               FC...IVwNVOfQLRX+O5kAhQ/a4RTZme2L8PnpvgRwrf7Eg8D6w==

               -----END NEW CERTIFICATE REQUEST-----
       IMPORTANT: Some documentation (e.g. RSA examples) claims that the "Attributes" field, in
       the CSR is "OPTIONAL" while RFC-2986 implies the opposite. This implementation considers
       this field, by default, as "OPTIONAL", unless the option -attributes is specified on the
       command line.

       -alias ALIAS
           See Common Options for more details.

       -sigalg ALGORITHM
           The canonical name of the digital signature algorithm to use for signing the
           certificate. If this option is omitted, a default value will be chosen based on the
           type of the private key associated with the designated Alias. If the private key is a
           "DSA" one, the value for the signature algorithm will be "SHA1withDSA". If on the
           other hand the private key is an "RSA" one, then the tool will use "MD5withRSA" as the
           signature algorithm.

       -file FILE
           See Common Options for more details.

       -keypass PASSWORD
           Use this option to specify the password which the tool will use to unlock the Key
           Entry associated with the designated Alias.

           If this option is omitted, the tool will first attempt to unlock the Key Entry using
           the same password protecting the key store. If this fails, you will then be prompted
           to provide a password.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       -attributes
           Use this option to force the tool to encode a "NULL" DER value in the CSR as the value
           of the "Attributes" field.

       The -export command

       Use this command to export a certificate stored in a key store to a designated output
       destination, either in binary format (if the -v option is specified), or in RFC-1421
       compliant encoding (if the -rfc option is specified instead).

       -alias ALIAS
           See Common Options for more details.

       -file FILE
           See Common Options for more details.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -rfc
           Use RFC-1421 specifications when encoding the output.

       -v  Output the certificate in binary DER encoding. This is the default output format of
           the command if neither -rfc nor "-v" options were detected on the command line. If
           both this option and the -rfc option are detected on the command line, the tool will
           opt for the RFC-1421 style encoding.

       Display commands

       The -list command

       Use this command to print one or all of a key store entries to "STDOUT". Usually this
       command will only print a fingerprint of the certificate, unless either the -rfc or the -v
       option is specified.

       -alias ALIAS
           If this option is omitted, the tool will print ALL the entries found in the key store.

           See Common Options for more details.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -rfc
           Use RFC-1421 specifications when encoding the output.

       -v  Output the certificate in human-readable format. If both this option and the -rfc
           option are detected on the command line, the tool will opt for the human-readable form
           and will not abort the command.

       The -printcert command

       Use this command to read a certificate from a designated input source and print it to
       "STDOUT" in a human-readable form.

       -file FILE
           See Common Options for more details.

       -v  See Common Options for more details.

       Management commands

       The -keyclone command

       Use this command to clone an existing Key Entry and store it under a new (different) Alias
       protecting, its private key material with possibly a new password.

       -alias ALIAS
           See Common Options for more details.

       -dest ALIAS
           Use this option to specify the new Alias which will be used to identify the cloned
           copy of the Key Entry.

       -keypass PASSWORD
           Use this option to specify the password which the tool will use to unlock the Key
           Entry associated with the designated Alias.

           If this option is omitted, the tool will first attempt to unlock the Key Entry using
           the same password protecting the key store. If this fails, you will then be prompted
           to provide a password.

       -new PASSWORD
           Use this option to specify the password protecting the private key material of the
           newly cloned copy of the Key Entry.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -storepasswd command

       Use this command to change the password protecting a key store.

       -new PASSWORD
           The new, and different, password which will be used to protect the designated key
           store.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -keypasswd command

       Use this command to change the password protecting the private key material of a
       designated Key Entry.

       -alias ALIAS
           See Common Options for more details.

           Use this option to specify the password which the tool will use to unlock the Key
           Entry associated with the designated Alias.

           If this option is omitted, the tool will first attempt to unlock the Key Entry using
           the same password protecting the key store. If this fails, you will then be prompted
           to provide a password.

       -new PASSWORD
           The new, and different, password which will be used to protect the private key
           material of the designated Key Entry.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

       The -delete command

       Use this command to delete a designated key store entry.

       -alias ALIAS
           See Common Options for more details.

       -storetype STORE_TYPE
           See Common Options for more details.

       -keystore URL
           See Common Options for more details.

       -storepass PASSWORD
           See Common Options for more details.

       -provider PROVIDER_CLASS_NAME
           See Common Options for more details.

       -v  See Common Options for more details.

BUGS

SEE ALSO

AUTHOR