I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole thing work together.
From my understanding, I need to generate a X509 certificate using Java keytool to act as root CA and then use it's private key to sign the new certificates that I am generating using Bouncy Castle at runtime.
I generated a new certificate using keytool and the following command:
keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048
When I tried reading this keystore and certificate programmatically, I found out that the private key of the certificate is not stored in the keystore or there was no way to read the private key.
I have the following questions:
How do I generate a root CA using keytool?
What should be the output format of the root CA so I can read the private key? Is my current approach of writing the cert to a keystore wrong?