I have a server with a self signed certificate, but also requires client side cert authentication. I am having a rough time trying to get the raw CA server cert so I can import it into a keystore. Anyone have some suggestions on how to easily do that? Thanks.

Java keytool easy way to add server cert from url/port

I&#39;m using *openssl* to create self-signed certs. I&#39;m getting this error with the certs I generated:

&gt; javax.net.ssl.SSLHandshakeException:
&gt; java.security.cert.CertificateException: No subject alternative names
&gt; present

&lt;br&gt;
Does anyone know how to specify &quot;Subject alternative name&quot; while creating a cert?
This is how I&#39;m generating a keystore:
       
    sudo $JAVA_HOME/bin/keytool -genkey -dname &quot;CN=192.168.x.xxx, OU=I, O=I, L=T, ST=On, C=CA&quot; -alias tomcat -validity 3650 -keyalg RSA -keystore /root/.keystore -keypass abcd -storepass abcd

To generate a key:

     openssl s_client -connect 192.168.x.xxx:8443 2&gt;/dev/null

Please help! Thanks!

How to add subject alernative name to ssl certs?

I understand that the keystore would usually hold private/public keys and the trust store only public keys (and represents the list of trusted parties you intend to communicate with). Well, that&#39;s my first assumption, so if that&#39;s not correct, I probably haven&#39;t started very well...

**I was interested though in understanding how / when you distinguish the stores when using keytool.**

So, far I&#39;ve created a keystore using

    keytool -import -alias bob -file bob.crt -keystore keystore.ks

which creates my keystore.ks file. I answer `yes` to the question do I trust bob but it is unclear to me if this has created a keystore file or a truststore file? I can set up my application to use the file as either.

    -Djavax.net.ssl.keyStore=keystore.ks -Djavax.net.ssl.keyStorePassword=x
    -Djavax.net.ssl.trustStore=keystore.ks -Djavax.net.ssl.trustStorePassword=x

and with `System.setProperty( &quot;javax.net.debug&quot;, &quot;ssl&quot;)` set, I can see the certificate under trusted certifications (but not under the keystore section). The particular certificate I&#39;m importing has only a public key and I intend to use it to send stuff over an SSL connection to Bob (but perhaps that&#39;s best left for another question!).

Any pointers or clarifications would be much appreciated. Is the output of keytool the same whatever you import and its just convention that says one is a keystore and the other a trust store? What&#39;s the relationship when using SSL etc?

Trust Store vs Key Store - creating with keytool

I have a jks keystore with no password.  When I run the command

    keytool -list -keystore mykeystore.jks

And it prompts me for the keystore password, I simply hit &#39;enter&#39;.

Please note that the keystore password IS NOT the default java password of &#39;changeit&#39;. It is blank

When I try to run

    keytool -storepasswd -keystore mykeystore.jks

to change the password to a non blank string. It firsts prompts me for the current password. Simply hitting enter since it is blank says

    keytool -storepasswd -keystore mykeystore.jks
    Enter keystore password:
    Keystore password is too short - must be at least 6 characters 

Just to confirm with everyone that the password is not &#39;changeit&#39;

    keytool -storepasswd -keystore mykeystore.jks
    Enter keystore password:  changeit
    keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

Any idea how I can change the keystore password if the existing password is blank?

Change keystore password from no password to a non blank password

I am trying to follow the Android mapping tutorial and [got to this part where I had to get an API key](http://code.google.com/android/add-ons/google-apis/mapkey.html#getdebugfingerprint).

I have found my `debug.keystore` but there does not appear to be a `keytool` application in the directory:

&lt;!-- language-all: lang-none --&gt;

    C:\Documents and Settings\tward\\.android&gt;ls
    adb_usb.ini      avd       debug.keystore  repositories.cfg androidtool.cfg  ddms.cfg  default.keyset

There is also no `keytool` in this directory:

    C:\Android\android-sdk-windows\tools&gt;ls
    AdbWinApi.dll     apkbuilder.bat       etc1tool.exe         mksdcard.exe
    AdbWinUsbApi.dll  ddms.bat             fastboot.exe         source.properties
    Jet               dmtracedump.exe      hierarchyviewer.bat  sqlite3.exe
    NOTICE.txt        draw9patch.bat       hprof-conv.exe       traceview.bat
    adb.exe           emulator.exe         layoutopt.bat        zipalign.exe
    android.bat       emulator_NOTICE.txt  lib

I am using *Eclipse* as my editor and believe that I have downloaded all the latest SDK.

What am I doing wrong?


I can’t find the Android keytool

I have a Java client trying to access a server with a self-signed certificate.

When I try to Post to the server, I get the following error:

&gt; unable to find valid certification path to requested target

Having done some research on the issue, I then did the following.

 1. Saved my servers domain name as a `root.cer` file.
 2. In my Glassfish server&#39;s JRE, I ran this:&lt;br /&gt;
    `keytool -import -alias example -keystore cacerts -file root.cer`
 3. To check the cert was added to my cacert successfully, I did this:&lt;br /&gt;
    `keytool -list -v -keystore cacerts`&lt;br /&gt;
    I can see the cert is present.
 4. I then restarted Glassfish and retired the &#39;post&#39;.

I am still getting thesame error.

I have a feeling this is because my Glassfish is not actually reading the cacert file that I have amended but maybe some other one.

Have any of you had this issue and can push me in the right direction?


Unable to find valid certification path to requested target - error even after cert imported

It looks like a standard question, but I couldn&#39;t find clear directions anywhere.

I have java code trying to connect to a server with probably self-signed (or expired) certificate. The code reports the following error :

    [HttpMethodDirector] I/O exception (javax.net.ssl.SSLHandshakeException) caught 
    when processing request: sun.security.validator.ValidatorException: PKIX path 
    building failed: sun.security.provider.certpath.SunCertPathBuilderException: 
    unable to find valid certification path to requested target

As I understand it, I have to use [keytool][1] and tell java that it&#39;s OK to allow this connection. 

All instructions to fix this problem assume I&#39;m fully proficient with keytool, such as 

&gt; generate private key for server and import it into keystore

Is there anybody who could post detailed instructions?  

I&#39;m running unix, so bash script would be best.

Not sure if it&#39;s important, but code executed in jboss.

  [1]: http://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html

Accept server&#39;s self-signed ssl certificate in Java client

I am reading an development guide of Facebook Developers at [here][1] 

It says that I must use keytool to export the signature for my app such as:

```cmd
keytool -exportcert -alias androiddebugkey -keystore ~/.android/debug.keystore | openssl sha1 -binary | openssl base64
```

I do not know how to find the keytool in order to run it. I tried to open a Windows command prompt and paste the above command, but it did not work.

  [1]: http://developers.facebook.com/docs/guides/mobile/#android.

How can I find and run the keytool

I am using Java `keytool`. I have exported a self-signed `.pem` certificate from my keystore. Is there a command to view the certificate details directly from the `.pem` file (not of the certificate in the keystore)?

How to view the contents of a .pem certificate?

I wish to generate an application signature for my app which will later be integrated with Facebook. In one of Facebook&#39;s tutorials, I found this command:

    keytool -exportcert -alias androiddebugkey -keystore ~/.android/debug.keystore | openssl sha1 -binary | openssl base64

In the tutorial, it says that by running this cmd, my process of generating the signature will start.

However, this command gives an error:

    openssl is not recognized as an internal or external command

How can I get rid of this?

        

Openssl is not recognized as an internal or external command

When I use the command:

    C:\&gt;keytool -list -alias androiddebugkey 
                -keystore .android\debug.keystore 
                -storepass android -keypass android


I get this error:

&gt; &#39;keytool&#39; is not recognized as an internal or external command, operable program or batch file.

I&#39;m not able to get the certificate fingerprint(MD5) on my computer.

I have ensured that the keystore file is present in the appropriate location.

Any help?

ERROR:&#39;keytool&#39; is not recognized as an internal or external command, operable program or batch file

I do want to import a self signed certificate into Java so any Java application that will try to establish a SSL connection will trust this certificate.

So far, I managed to import it in
    
    keytool -import -trustcacerts -noprompt -storepass changeit -alias $REMHOST -file $REMHOST.pem
    keytool -import -trustcacerts -noprompt -keystore cacerts -storepass changeit -alias $REMHOST -file $REMHOST.pem

Still, when I try to run [`HTTPSClient.class`](http://adywicaksono.wordpress.com/2007/07/15/ssl-connection-with-java/) I still get:

&lt;pre&gt;javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target&lt;/pre&gt;


How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?

I&#39;m trying to connect a Java Web API via HTTPS; however, an exception is thrown:

    javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException

I followed these steps which I learned from online keytool &amp; SSL cert tutorials:

1. I copied the HTTPS URL into the browser, downloaded the SSL certificates &amp; Installed them in the browser using Internet Explorer.

2. Exported the certificates to a path on my computer, the certificates were saved as `.cer`

3. Used the keytool&#39;s import option. The command below executed without any errors.

        keytool -import -alias downloadedCertAlias -keystore C:\path\to\my\keystore\cacerts.file -file C:\path\of\exportedCert.cer


4. I was prompted for a password at the command prompt, which I entered then I was authenticated. 

5. The `cmd` window printed some certificate data &amp; signatures and I was prompted with the question:  

    &gt; Trust this certificate?

 I answered yes.

6. The cmd prompt displayed 
  
    &gt; Certificate was added to keystore

  However after that message, another exception was displayed:

        keytool error: java.io.FileNotFoundException: C:\Program files\...\cacerts &lt;Access Denied&gt;

Finally when I checked the keystore , the SSL certificate was not added and my application gives the same exception I was getting earlier when trying to connect:

    (javax.net.ssl.SSLHandshakeException:sun.security.validator.ValidatorException)

Java Keytool error after importing certificate , &quot;keytool error: java.io.FileNotFoundException &amp; Access Denied&quot;

I need to use mapview control in android and I can&#39;t seem to understand how to run `keytool`.
Is it installed with eclipse? I can&#39;t seem to find a download link.

Thanks



Where is the Keytool application?

I need to import a certificate into my JVM keystore. I am using the following:

    keytool -import -alias daldap -file somecert.cer


so I would need to probably change my call into something like:

    keytool -import -alias daldap -file somecert.cer -keystore cacerts –storepass changeit

How do I find out what keystore my JVM is using?

As I was going through some posts on the Internet learning more about *signing your Android app*, I got post like **how to sign the app**, and something about **what if you have lost your keystore file or password.**

The question I am here to ask is that, I have never created a keystore, or its alias, or its password, so how on this earth can I forget it?

I know that for Android we use the password **android**, so, if the password is by default android how can one forget it? (I&#39;m sure there must be some other way to create new keystores).

Finally, if android is the default password, **what is the default alias?**

I have never set any passwords to my keystore and alias, so how are they created?

I need to sign Android application (`.apk`).  
I have `.pfx` file. I converted it to `.cer` file via Internet Explorer and then converted `.cer` to `.keystore` using keytool. Then I&#39;ve tried to sign `.apk` with jarsigner but it says that .keystore doesn&#39;t content a private key.

What I&#39;m doing wrong?

How to convert .pfx file to keystore with private key?

I&#39;m trying to import a trusted certificated into the [Java cacerts keystore][1], but I have a problem. I tried to list existing trusted certificates and it seems that the keystore isn&#39;t password protected. 

    $ keytool -list -keystore cacerts
    Enter keystore password:
    
    *****************  WARNING WARNING WARNING  *****************
    * The integrity of the information stored in your keystore  *
    * has NOT been verified!  In order to verify its integrity, *
    * you must provide your keystore password.                  *
    *****************  WARNING WARNING WARNING  *****************
    
    Keystore type: JKS
    Keystore provider: SUN
    
    Your keystore contains 76 entries

I tried to import a trusted certificate:

    $ keytool -importcert -alias &quot;JiraCert&quot; -file /root/c9ssl.crt -keystore /etc/java-6-sun/security/cacerts
    Enter keystore password:  
    Keystore password is too short - must be at least 6 characters
    Enter keystore password:  
    Keystore password is too short - must be at least 6 characters
    Enter keystore password:  
    Keystore password is too short - must be at least 6 characters
    Too many failures - try later

I also tried to change the password from &quot;none&quot; to something:

    $ keytool -storepasswd -keystore cacerts.back
    Enter keystore password:
    Keystore password is too short - must be at least 6 characters
    Enter keystore password:
    Keystore password is too short - must be at least 6 characters
    Enter keystore password:
    Keystore password is too short - must be at least 6 characters
    Too many failures - try later

  [1]: http://confluence.atlassian.com/display/JIRA/Connecting+to+SSL+services

How do I get into a non-password protected Java keystore or change the password?

Using some batch file, I want to add the untrusted self signed certificate within Java Keystore.

**Command is**

    %JAVA_HOME%/bin/keytool -import -v -trustcacerts -alias server-alias
    -file server.cer -keystore cacerts.jks -keypass changeit -storepass changeit

After running above command, the screen promts for Trust of certificate using Y/N.

    Trust this certificate? [no]:

But I don&#39;t want to provide Y/N here.

Is there a way to complete the import using a single command or some additional import switch if any?


Add Self Signed Certificate without promting Yes/No from User

I am trying to import a certificate and a key file into the keystore but I&#39;m unable to do that.

How can I create a keystore by importing both an existing certificate (abc.crt) and abc.key files?

How can I create keystore from an existing certificate (abc.crt) and abc.key files?

I used the following steps to create a new Java keystore with a pair of private/public key to be used by a Java (internal) server with TLS. Please notice that the certificate is selfsigned:
	
1) Generate key with AES256

	openssl genrsa -aes256 -out server.key 1024

2) Generate cert request for CA

	openssl req -x509 -sha256 -new -key server.key -out server.csr

3) Generate self signed expiry-time 10 years

	openssl x509 -sha256 -days 3652 -in server.csr -signkey server.key -out selfsigned.crt


4) Use a program like [KeyStoreExplorer](http://keystore-explorer.sourceforge.net/) to import the pair (private key and selfsigned certificate) in a new JKS 

This works but I&#39;d like to implement the last step without using a GUI.

I know how to import the self signed certificate only:

    // create the keystore and import the public key. THIS WILL NOT IMPORT THE PRIVATE KEY SO THE KEYSTORE CAN&#39;T BE USED ON THE SERVER TO MAKE THE TLS CONNECTION
	/usr/java/jdk1.6.0_45/bin/keytool -import -alias myservercert -file server.crt -keystore mykeystore.jks

So the question is: how can I create a Java KeyStore and import both the certificate with the public key and the private key without using a GUI?

Importing the private-key/public-certificate pair in the Java KeyStore

I have tried to execute keytool from Java bin directory but I get an error with warning bash: keytool: command not found.

    root@xxxxxx]# keytool -genkey -alias mypassword -keyalg RSA

    bash: keytools: command not found



keytool error bash: keytool: command not found

I&#39;m trying to make sense of how to upload an app onto Google Play while using Google Play App Signing.

Here is what I did:

 1. Created an app
 2. Used keytool.exe to generate a key for that app
 3. Uploaded the app to Google Play
 4. Enrolled in the Google Play App Signing
 5. Try to upload the app again without success. 

It complains that the certificate is not the certificate

&gt; Upload new APK to Production
&gt; 
&gt; Upload failed
&gt; You uploaded an APK that is not signed with the upload certificate. You must use the same certificate. The upload certificate has fingerprint:
&gt; [ SHA1: 0C:... ]
and the certificate used to sign the APK that you uploaded have fingerprint:
&gt; [ SHA1: 2D:... ]

After searching for a while. I find out how to put the certificated posted on my Google Play console in my keystore. Something like this:

keytool.exe -importcert -file upload.pem -keystore myapp-release-key.keystore

The certificate seems to be in. When I list the contents of the keystore, here&#39;s what I get:

keytool.exe -list -keystore trackcoachfull-release-key.keystore
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

myappfull, May 18, 2017, PrivateKeyEntry,
Certificate fingerprint (SHA1): 2D:...
uploadkey, May 19, 2017, trustedCertEntry,
Certificate fingerprint (SHA1): 0C:...

Now, where I&#39;m blocked...

In Android Studio, I try to generate a signed APK with the uploadkey.

Build &gt; Generate Signed APK
Select the keystore above
Enter the keystore password
Select the uploadkey as the key alias
I&#39;m force to enter a key password.

Error in Android Studio:

&gt; Error:Execution failed for task &#39;:app:packageFullRelease&#39;.
&gt; &gt; com.android.ide.common.signing.KeytoolException: Failed to read key uploadkey from store
&gt; &quot;C:\Users\Admin\AndroidStudioProjects\keystores\myappfull-release-key.keystore&quot;:
&gt; trusted certificate entries are not password-protected

My question is this: 

How do you generate an APK signed with an upload key provided by Google Play?

Thanks




Signing an APK with an upload key provided by Google Play

I&#39;m automating some things that involve the android keytool and jarsigner. The tool takes a keystore, the password for the keystore, the alias name, and the password for the alias / key, and I&#39;m trying to find a way to explicitly check to see if the supplied password for the alias / key is correct.

Any ideas? Also, I need to check it without a jar file to sign - getting that file in my context is lengthy, so I want to abort sooner rather than later.

Check android keystore keypass for correctness

**ERROR MESSAGE**:

&lt;!-- language: none --&gt;

    jarsigner: Certificate chain not found for: project_foo.&lt;br/&gt;
    project_foo must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

**QUESTION**:
How do I include a public key certificate chain to address the error?

**BACKGROUND**:
The App Developer has completed an Android app and delivered an unsigned APK called Foo.apk. My objective is to sign and zipalign the APK in preparation for uploading it to the Google Play store. My keystore is located at C:\Path\\.keystore on a Windows machine.

**COMMAND LINE**, my command:&lt;br/&gt;

&lt;!-- language: none --&gt;

    jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore C:\Path\\.keystore Foo.apk project_foo

**COMMAND LINE**, response:&lt;br/&gt;

&lt;!-- language: none --&gt;

    Enter Passphrase for keystore:
    jarsigner: Certificate chain not found for: project_foo.&lt;br/&gt;
    project_foo must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain.

**ALSO TRIED**:
Verified that I remember the correct password. Using &#39;keytool -list&#39; from the command line shows me the expected list (it includes one private key).

**PREVIOUS OS QUESTION**: https://stackoverflow.com/questions/5259263/certificate-chain-not-found asked using a `.cer` file from Verisign. I have no similar file available.

**OTHER INFORMATION**: Windows 7 machine, using standard Windows command prompt.

All Keytool Solutions on Gang of Coders

Total of 25 Keytool Solutions