Generating X.509 Certificates

Generate a Certificate Authority (CA)

Generate a RSA Private Key

openssl genrsa -out ca.key 2048

Generate a Certificate

Input: ca.key
Output: ca.pem
openssl req -new -x509 -days 365 -key ca.key -out ca.pem 

It prompts to enter the following information:

  • Country Name (2 letter code) [AU]
  • State or Province Name (full name) [Some-State]
  • Locality Name (eg, city) []
  • Organization Name (eg, company) [Internet Widgits Pty Ltd]
  • Organizational Unit Name (eg, section) []
  • Common Name (e.g. server FQDN or YOUR name) []
  • Email Address []

Prompts can be suppressed if the information is provided by using -subj parameter:

openssl req -new -x509 -days 365 -key ca.key -out ca.pem -subj '/C=US/ST=IL/L=Chicago/O=Test Organization/CN=test.common.name'

Import a X.509 Certificate to a Java Key Store

Input: ca.pem
Output: cacerts.jks
keytool -import -keystore cacerts.jks -file ca.pem

It prompts to enter a password and confirm to trust the certificate before it imports to a Java Key Store:

  • Enter keystore password
  • Trust this certificate? [no]

Generate a Certificate from a CA

Generate a RSA Private Key

openssl genrsa  -out server.key 2048

Generate a Certificate Request

openssl req -new -key server.key -out server.csr -subj '/C=US/ST=IL/L=Chicago/O=Test Organization/CN=test.server.name'

Generate a X.509 Certificate

Inputs: server.csr, ca.pem, ca.key
Output: server.pem
openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca.key -set_serial 01 -out server.pem

 Use a different serial number while generating another certificate. For example, use 02 while generating a client certificate.

openssl x509 -req -days 365 -in client.csr -CA ca.pem -CAkey ca.key -set_serial 02 -out client.pem

Export to a P12 Certificate

Inputs: server.pem, server.key
Output: server.p12
openssl pkcs12 -export -in server.pem -inkey server.key -out server.p12

It prompts to enter a password to protect the P12 certificate, which contains a private RSA key and a X.509 certificate.

Import a P12 Certificate to a Java Key Store

Input: server.p12
Output: server.jks
keytool -importkeystore -destkeystore server.jks -srckeystore server.p12 -srcstoretype PKCS12

It prompts to enter the following passwords:

  • Enter destination keystore password. It must be at least 6 characters.
  • Enter destination keystore password
  • Enter source keystore password.

Prompts can be suppressed if the information is provided by using -deststorepass, -destkeypass, and – srcstorepass parameters:

keytool -importkeystore -destkeystore server.jks -srckeystore server.p12 -srcstoretype PKCS12 -deststorepass secret -destkeypass secret -srcstorepass secret

Export a Java Key Store to a P12 Certificate

Input: server.jks
Output: server.p12
keytool -importkeystore -srckeystore server.jks -destkeystore server.p12 -deststoretype PKCS12

Retrieve a Private RSA  Key from a P12 Certificate

Input: server.p12
Output: server.key
openssl pkcs12 -in server.p12 -nodes -nocerts -out server.key

Retrieve a X.509 Certificate from a P12 Certificate

Input: server.p12
Output: server.pem
openssl pkcs12 -in server.p12 -nokeys -out server.pem

This entry was posted in Uncategorized and tagged , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s