Import Public Private key pair to a Keystore

Question

I have created a public private key pair using the KeyPairGenerator class in Java. From this key pair I have generated the CSR request using the PKCS10 class which has been sent to a CA for verification. The question is how do I load this public private key pair into a keystore? I cant use KeyStore.SetKeyEntry as it requires a certificate parameter along with the private key.

I thought that I would have to wait for the CA to send back a certificate which should then be used for loading the key pair. But If I create the keystore using the keytool command -

keytool -genkey -keyalg RSA -keysize 2048 -sigalg sha1withRSA -alias aliasname -validity 365 -keystore keystorename

and then load this keystore into the Java keystore class, the keystore object contains a privatekeyentry and a CertificateEntry. How is this possible without obtaining a certificate back from the CA.

Answer 1

When you create a public/private key pair with Java code (KeyPairGenerator), the key pair normally exists in RAM only. The whole Java cryptography architecture is extensible and it is possible to use a specific KeyPairGenerator instance which does saves the private key "somewhere", but, in general, you have to arrange for the saving yourself, e.g. with the KeyStore class or more manually with explicit files (see this answer for instance).

In any case, the PKCS#10 request sent to the CA contains only the public key; the CA never learns the private key, and therefore cannot send it back to you.

The keytool command-line utility can do the storage part itself. In the "keystore" format, private keys don't exist alone but only linked to a certificate, so the keytool utility will generate a self-signed certificate accompanying the private key. This is why this command:

keytool -genkeypair -keyalg RSA -keysize 2048

will ask you a few questions, including a password (to encrypt the private key itself) and some personal things such as your name and country: these ones are for filling the self-signed certificate fields.

When you obtain the certificate from the CA, you can import it in your keystore, replacing the self-signed certificate. The "key alias" is used to designate the specific private key you wish to use. See this blog post for some details on the involved commands.

Answer 2

When creating a keystore with the Java keytool a keypair is generated and the certificate is signed with the private key itself. Therefore you have a self signed certificate in this case.

You can check this with the command

keytool -list -v -keystore <keystore>

The first certificate shown should have the same Owner and Issuer.