I have to generate a self signed root CA and use it to issue to certificates programmatically. I am new to security and certificates and I think I am missing some pieces required to make the whole thing work together.

From my understanding, I need to generate a X509 certificate using Java keytool to act as root CA and then use it's private key to sign the new certificates that I am generating using Bouncy Castle at runtime.

I generated a new certificate using keytool and the following command:

keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

When I tried reading this keystore and certificate programmatically, I found out that the private key of the certificate is not stored in the keystore or there was no way to read the private key.

I have the following questions:

  1. How do I generate a root CA using keytool?

  2. What should be the output format of the root CA so I can read the private key? Is my current approach of writing the cert to a keystore wrong?

  • That generates a (RSA) privatekey and a selfsigned cert, which are different though related things, both stored together in the keystore. The privatekey can be read from the keystore if you do it correctly, usually by loading the keystore and calling .getKey(String alias, char[] password). Commented Nov 8, 2015 at 19:32

3 Answers 3


I believe you're asking the wrong question. The right question is "Should someone new to security be working on a root CA?" and the answer is "probably not."

It is highly likely that what you're doing will expose everyone who relies on your root CA to high risk of compromise. This has been demostrated by mature companies like Dell (see, for example, http://www.computerworld.com/article/3008521/security/a-second-dangerous-dell-root-certificate-discovered.html)

There are lots of ways in which things go wrong, which are way beyond the scope of a S.SE question.

  1. Your command is correct: keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048
  2. keytool -list -v -keystore keystore.jks

It should look like this:

Enter keystore password:  

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: selfsigned
Creation date: Nov 8, 2015
Entry type: PrivateKeyEntry
Certificate chain length: 1
Owner: CN=sdf, OU=sf, O=sf, L=sf, ST=sf, C=sf
Issuer: CN=sdf, OU=sf, O=sf, L=sf, ST=sf, C=sf
Serial number: 69aa218
Valid from: Sun Nov 08 12:34:47 CET 2015 until: Wed Nov 02 12:34:47 CET 2016
Certificate fingerprints:
     MD5:  FE:7C:97:C8:62:5E:C7:AA:8C:20:E9:7A:78:21:93:8A
     SHA1: 71:55:81:1C:AF:12:10:84:30:66:A2:35:BA:EC:AB:74:C0:11:43:6E
     SHA256: 89:E5:EC:5D:CE:BA:3B:13:02:0C:27:A6:FC:EC:B8:2B:48:9F:32:23:A8:10:5D:84:9A:CE:7F:F7:D6:E4:65:67
     Signature algorithm name: SHA256withRSA
     Version: 3


#1: ObjectId: Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 79 D9 C1 A6 17 32 97 B0   39 61 41 1F 23 F9 A8 00  y....2..9aA.#...
0010: 4A 32 F7 EA                                        J2..

  • Thanks for the reply but this doesn't answer my question about the private key part. Commented Nov 16, 2015 at 2:40
  • @PranavaSheoran In the KEYSTORE's output, you can see "Entry type: PrivateKeyEntry", it's a hint that there's a private key stored inside. The Keytool command wasn't designed to display the private key itself, but if you still want to read it, in your code, you can load the keystore and use .getKey(String alias, char[] password). java-docs-getKey
    – Seb B.
    Commented Nov 16, 2015 at 6:30

To build new root CAs working with java keystore i prepared this small java program: https://github.com/kendarorg/JavaCaCertGenerator the certs i tried to generate with keystore as root contained a kind of recursive pointer to thmselves as parent certificate, i suppose this is the reason why they were not accepted

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .