Sun Java System Application Server Enterprise Edition 8.1 2005Q2 Administration Guide

- Previous: Using the keytool Utility
- Next: To sign a digital certificate using the keytool utility

## To generate a certificate using the `keytool` utility

Use `keytool` to generate, import, and export certificates. By default, `keytool` creates a keystore file in the directory where it is run.

1. Change to the directory where the certificate is to be run.

   Always generate the certificate in the directory containing the keystore and truststore files, by default domain-dir`/config`. For information on changing the location of these files, see To change the location of certificate files.

2. Enter the following `keytool` command to generate the certificate in the keystore file, `keystore.jks`:

       keytool -genkey -alias keyAlias-keyalg RSA
        -keypass changeit
        -storepass changeit
       -keystore keystore.jks

   Use any unique name as your keyAlias. If you have changed the keystore or private key password from their default, then substitute the new password for `changeit` in the above command.

   A prompt appears that asks for your name, organization, and other information that `keytool` uses to generate the certificate.

3. Enter the following `keytool` command to export the generated certificate to the file `server.cer` (or `client.cer` if you prefer):

       keytool -export -alias keyAlias-storepass changeit
        -file server.cer
        -keystore keystore.jks

4. If a certificate signed by a certificate authority is required, see To sign a digital certificate using the `keytool` utility.

5. To create the truststore file `cacerts.jks` and add the certificate to the truststore, enter the following `keytool` command:

       keytool -import -v -trustcacerts
       -alias keyAlias
        -file server.cer
       -keystore cacerts.jks
        -keypass changeit

   If you have changed the keystore or private key password from their default, then substitute the new password for `changeit` in the above command.

   The tool displays information about the certificate and prompts whether you want to trust the certificate.

6. Type `yes`, then press Enter.

   Then `keytool` displays something like this:

       Certificate was added to keystore
       [Saving cacerts.jks]

7. Restart the Application Server.

- Previous: Using the keytool Utility
- Next: To sign a digital certificate using the keytool utility

- © 2010, Oracle Corporation and/or its affiliates