Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for verification. The question is how do I load this public private key pair into a keystore? I cant use KeyStore.SetKeyEntry as it requires a certificate parameter along with the private key.

I thought that I would have to wait for the CA to send back a certificate which should then be used for loading the key pair. But If I create the keystore using the keytool command -

keytool -genkey -keyalg RSA -keysize 2048 -sigalg sha1withRSA -alias aliasname -validity 365 -keystore keystorename

and then load this keystore into the Java keystore class, the keystore object contains a privatekeyentry and a CertificateEntry. How is this possible without obtaining a certificate back from the CA.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

When you create a public/private key pair with Java code (KeyPairGenerator), the key pair normally exists in RAM only. The whole Java cryptography architecture is extensible and it is possible to use a specific KeyPairGenerator instance which does saves the private key "somewhere", but, in general, you have to arrange for the saving yourself, e.g. with the KeyStore class or more manually with explicit files (see this answer for instance).

In any case, the PKCS#10 request sent to the CA contains only the public key; the CA never learns the private key, and therefore cannot send it back to you.

The keytool command-line utility can do the storage part itself. In the "keystore" format, private keys don't exist alone but only linked to a certificate, so the keytool utility will generate a self-signed certificate accompanying the private key. This is why this command:

keytool -genkeypair -keyalg RSA -keysize 2048

will ask you a few questions, including a password (to encrypt the private key itself) and some personal things such as your name and country: these ones are for filling the self-signed certificate fields.

When you obtain the certificate from the CA, you can import it in your keystore, replacing the self-signed certificate. The "key alias" is used to designate the specific private key you wish to use. See this blog post for some details on the involved commands.

share|improve this answer
add comment

When creating a keystore with the Java keytool a keypair is generated and the certificate is signed with the private key itself. Therefore you have a self signed certificate in this case.

You can check this with the command

keytool -list -v -keystore <keystore>

The first certificate shown should have the same Owner and Issuer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.