I'm using the Java keytool command to generate keystores and openssl to revoke certificate and generate CRL. However I need to configure crlDistributionPoints extension as described in the RFC 5280.

So is there a way to configure Distribution Points with keytool ?

  • 1
    As I mentioned in another thread (security.stackexchange.com/questions/148043/…), you really should get standard CA software, instead of using low-level tools. What I get from practice, such custom and hand-made configurations will quickly become unreliable.
    – Crypt32
    Jan 12, 2017 at 10:34

2 Answers 2


Guessing here: Use raw OID with the generic -ext parameter.

But like Crypt32 said: This is terrible to manage.


Finally I found the solution, it is not documented in the oracle documentation but it exists :

the extension is -ext crl .

I hope that it will help someone.

  • Is this the same as "-ext"? Jan 17, 2017 at 15:41
  • I didn't try with OID, but I know that is the OID of crlDistributionPoints.
    – Hakim
    Jan 17, 2017 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .