Certificate Creating Chain using `Keytool' and `SignCertificate.java'
Shamima Rahman July 2005
The Certificate Chain Structure we are going to create in this tutorial will be as follows:
rootCA
CA1
CA2
serverKey
clientKey
Follow the following steps to create the Certificate Chain:
1. Create the keystore kstore and the root certifying authority's certificate rootCA first
with the following command>keytool -genkey -v -alias rootca -keyalg RSA -keystore kstore
2. Create Server's certifying authority's initial certificate CA1 >keytool -genkey -v -alias CA1 -keyalg RSA -keystore kstore
3. Sign CA1 with rootCA using SignCertificate.java and store the new signed
certificate as CA1signed >java SignCertificate kstore rootCA CA1 CA1signed
4. Now export the new signed certificate to a file CA1signed.crt >keytool -export -alias CA1signed -keystore kstore -file CA1signed.crt You will notice a new file CA1signed.crt being created in the same directory as the keystore's.
Creating Certificate Chain using `Keytool' and `SignCertificate.java'
5. Then import the file CA1signed.crt back to the keystore kstore as CA1 (Notice here
the certificate alias name to which you are importing the file has to be the same you have created in the at first as Server's Certifying Authority's certificate, in this case CA1) > keytool -import -alias CA1 -keystore kstore -file CA1signed.crt A screenshot of the last three commands mentioned
6. Now if you see the list of keyentries in the keystore kstore you will see 3 entries in
total and also the entry CA1 has Certificate chain length of 2 > keytool -list -v -keystore kstore
Computer Security
UHCL
2
Creating Certificate Chain using `Keytool' `SignCertificate.java'
Now and follow steps 2-5 to create a signed certificate for the Server. Following are the steps you should be performing next-
7. Create an initial certificate serverKey for the Server >keytool -genkey -v -alias serverKey -keyalg RSA -keystore kstore
8. Sign serverKey with CA1 using SignCertificate.java and store the new signed
certificate as serverKeysigned >java SignCertificate kstore CA1 serverKey serverKeysigned
9. Export this new signed certificate serverKeysigned to a file serverKeysigned.crt >keytool -export -alias serverKeysigned -keystore kstore -file serverKeysigned.crt A new file named serverKeysigned.crt will be created as the same way it was created for CA1 before.
10. Import the file serverKeysigned.crt back to the keystore kstore as serverKey
> keytool -import -alias serverKey -keystore kstore -file serverKeysigned.crt
Computer Security
UHCL
3
Creating Certificate Chain using `Keytool' and `SignCertificate.java'
11. Now if you see the list of k...