Why does "keytool.exe" with "-certreq" arg require an alias?

Question

I'm using the "keytool.exe" JDK utility to try to create a CSR (Certificate Signing Request) with the "-certreq" arg. Was wondering why this requires an alias (i.e. of another cert in the keystore) when I haven't even gotten the cert back yet from the CA (to whom I'd send the CSR). I understand that it could be used to marry the signed cert w/ an existing key pair/self-signed cert, but what I want to do is (to create a new cert):

1. Generate a CSR to send to CA ("-certreq" arg).
2. Upon receipt of signed cert, gen a new key pair ("-genkeypair arg)" w/ new alias.
3. Import my new cert against that alias from #2.

My contention is that I shouldn't need an existing keystore entry/alias for step# 1. Do I really need some dummy self-signed cert in the keystore 1st? Thx!

Answer 1

You need to generate the key pair before sending a certificate request, because that certificate request contains the public key and is signed with the private key. Generating a new key pair after the CSR is therefore not possible as you would get a different public key than the one in the returned certificate, and the private key would therefore not match the public key in the certificate.

Java's way of handling private keys is very much tied to TLS and X.509 / PKIX. That means that for a private key to exist it is required to be bound to a certificate chain and an alias. Because of this the private key is generated with a self-signed certificate that simply contains the information also in the CSR. Only recently Java is embracing a more flexible way of handling key stores - it has also switched to PKCS#12 key stores as default for that.

The tie of private keys with certificate chains was a design decision for Java - I'm not sure of the why, I presume it is to simplify matters.

Answer 2

A certificate for a CSR is the public key of a key pair plus some metadata. You are effectively asking a member of the trusted public key infrastructure to "vouch for" your public key as coming from you. Once the metadata has been validated by the authority, they will issue you a certificate with your public key that is signed by the authority.

Once you have a signed certificate, follow the Oracle documentation to merge it into your keystore with your existing key pair: https://docs.oracle.com/cd/E19509-01/820-3503/ggezu/index.html. This will overwrite your unsigned public key in the store with the signed version from the issuing Certificate Authority. (thanks Maarten Bowedes)

The authority is signing the public half of your original key pair as coming from you. If you generate a new key pair and overwrite your alias you will effectively be writing over the private key associated with your (now valid) certificate.