I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg. Was wondering why this requires an alias (i.e. of another cert in the keystore) when I haven't even gotten the cert back yet from the CA (to whom I'd send the CSR). I understand that it could be used to marry the signed cert w/ an existing key pair/self-signed cert, but what I want to do is (to create a new cert):
- Generate a CSR to send to CA ("-certreq" arg).
- Upon receipt of signed cert, gen a new key pair ("-genkeypair arg)" w/ new alias.
- Import my new cert against that alias from #2.
My contention is that I shouldn't need an existing keystore entry/alias for step# 1. Do I really need some dummy self-signed cert in the keystore 1st? Thx!