I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole thing work together.

From my understanding, I need to generate a X509 certificate using Java keytool to act as root CA and then use it's private key to sign the new certificates that I am generating using Bouncy Castle at runtime.

I generated a new certificate using keytool and the following command:

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

When I tried reading this keystore and certificate programmatically, I found out that the private key of the certificate is not stored in the keystore or there was no way to read the private key.

I have the following questions:

  1. How do I generate a root CA using keytool?

  2. What should be the output format of the root CA so I can read the private key? Is my current approach of writing the cert to a keystore wrong?

  • That generates a (RSA) privatekey and a selfsigned cert, which are different though related things, both stored together in the keystore. The privatekey can be read from the keystore if you do it correctly, usually by loading the keystore and calling .getKey(String alias, char[] password). – dave_thompson_085 Nov 8 '15 at 19:32

I believe you're asking the wrong question. The right question is "Should someone new to security be working on a root CA?" and the answer is "probably not."

It is highly likely that what you're doing will expose everyone who relies on your root CA to high risk of compromise. This has been demostrated by mature companies like Dell (see, for example, http://www.computerworld.com/article/3008521/security/a-second-dangerous-dell-root-certificate-discovered.html)

There are lots of ways in which things go wrong, which are way beyond the scope of a S.SE question.

| improve this answer | |
  1. Your command is correct: keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048
  2. keytool -list -v -keystore keystore.jks

It should look like this:

Enter keystore password:  

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: selfsigned
Creation date: Nov 8, 2015
Entry type: PrivateKeyEntry
Certificate chain length: 1
Owner: CN=sdf, OU=sf, O=sf, L=sf, ST=sf, C=sf
Issuer: CN=sdf, OU=sf, O=sf, L=sf, ST=sf, C=sf
Serial number: 69aa218
Valid from: Sun Nov 08 12:34:47 CET 2015 until: Wed Nov 02 12:34:47 CET 2016
Certificate fingerprints:
     MD5:  FE:7C:97:C8:62:5E:C7:AA:8C:20:E9:7A:78:21:93:8A
     SHA1: 71:55:81:1C:AF:12:10:84:30:66:A2:35:BA:EC:AB:74:C0:11:43:6E
     SHA256: 89:E5:EC:5D:CE:BA:3B:13:02:0C:27:A6:FC:EC:B8:2B:48:9F:32:23:A8:10:5D:84:9A:CE:7F:F7:D6:E4:65:67
     Signature algorithm name: SHA256withRSA
     Version: 3


#1: ObjectId: Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 79 D9 C1 A6 17 32 97 B0   39 61 41 1F 23 F9 A8 00  y....2..9aA.#...
0010: 4A 32 F7 EA                                        J2..

| improve this answer | |
  • Thanks for the reply but this doesn't answer my question about the private key part. – Pranava Sheoran Nov 16 '15 at 2:40
  • @PranavaSheoran In the KEYSTORE's output, you can see "Entry type: PrivateKeyEntry", it's a hint that there's a private key stored inside. The Keytool command wasn't designed to display the private key itself, but if you still want to read it, in your code, you can load the keystore and use .getKey(String alias, char[] password). java-docs-getKey – Seb B. Nov 16 '15 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.