Creating root CA to issue certificates programmatically

Question

I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole thing work together.

From my understanding, I need to generate a X509 certificate using Java keytool to act as root CA and then use it's private key to sign the new certificates that I am generating using Bouncy Castle at runtime.

I generated a new certificate using keytool and the following command:

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

When I tried reading this keystore and certificate programmatically, I found out that the private key of the certificate is not stored in the keystore or there was no way to read the private key.

I have the following questions:

1. How do I generate a root CA using keytool?

2. What should be the output format of the root CA so I can read the private key? Is my current approach of writing the cert to a keystore wrong?

Answer 1

I believe you're asking the wrong question. The right question is "Should someone new to security be working on a root CA?" and the answer is "probably not."

It is highly likely that what you're doing will expose everyone who relies on your root CA to high risk of compromise. This has been demostrated by mature companies like Dell (see, for example, http://www.computerworld.com/article/3008521/security/a-second-dangerous-dell-root-certificate-discovered.html)

There are lots of ways in which things go wrong, which are way beyond the scope of a S.SE question.

Answer 2

1. Your command is correct: keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048
2. keytool -list -v -keystore keystore.jks

It should look like this:

Enter keystore password:  

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: selfsigned
Creation date: Nov 8, 2015
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=sdf, OU=sf, O=sf, L=sf, ST=sf, C=sf
Issuer: CN=sdf, OU=sf, O=sf, L=sf, ST=sf, C=sf
Serial number: 69aa218
Valid from: Sun Nov 08 12:34:47 CET 2015 until: Wed Nov 02 12:34:47 CET 2016
Certificate fingerprints:
     MD5:  FE:7C:97:C8:62:5E:C7:AA:8C:20:E9:7A:78:21:93:8A
     SHA1: 71:55:81:1C:AF:12:10:84:30:66:A2:35:BA:EC:AB:74:C0:11:43:6E
     SHA256: 89:E5:EC:5D:CE:BA:3B:13:02:0C:27:A6:FC:EC:B8:2B:48:9F:32:23:A8:10:5D:84:9A:CE:7F:F7:D6:E4:65:67
     Signature algorithm name: SHA256withRSA
     Version: 3

Extensions: 

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 79 D9 C1 A6 17 32 97 B0   39 61 41 1F 23 F9 A8 00  y....2..9aA.#...
0010: 4A 32 F7 EA                                        J2..
]
]



*******************************************
*******************************************

Answer 3

To build new root CAs working with java keystore i prepared this small java program: https://github.com/kendarorg/JavaCaCertGenerator the certs i tried to generate with keystore as root contained a kind of recursive pointer to thmselves as parent certificate, i suppose this is the reason why they were not accepted