Sun Java System Application Server Enterprise Edition 8.1 2005Q2 Administration Guide

- Previous: To generate a certificate using the keytool utility
- Next: Deleting a Certificate Using the keytool Utility

## To sign a digital certificate using the `keytool` utility

After creating a digital certificate, the owner must sign it to prevent forgery. E-commerce sites, or those for which authentication of identity is important can purchase a certificate from a well-known Certificate Authority (CA). If authentication is not a concern, for example if private secure communications is all that is required, save the time and expense involved in obtaining a CA certificate and use a self-signed certificate.

1. Follow the instructions on the CA’s Web site for generating certificate key pairs.

2. Download the generated certificate key pair.

   Save the certificate in the directory containing the keystore and truststore files, by default domain-dir`/config` directory. See To change the location of certificate files.

3. In your shell, change to the directory containing the certificate.

4. Use `keytool` to import the certificate into the local keystore and, if necessary, the local truststore.

       keytool -import -v -trustcacerts
       -alias keyAlias
        -file server.cer
       -keystore cacerts.jks
        -keypass changeit
       -storepass changeit

   If the keystore or private key password is not the default password, then substitute the new password for `changeit` in the above command.

5. Restart the Application Server.

- Previous: To generate a certificate using the keytool utility
- Next: Deleting a Certificate Using the keytool Utility

- © 2010, Oracle Corporation and/or its affiliates