Commonly used Keytool commands(Cheatsheet)

Keytool is a utility in jdk/bin/ directoty. If jdk path is not set in environment variables then run below commands directly from that directory.

use ./keytool if running in linux distributions.

Generate a Java keystore and key pair
keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048

Generate a keystore and self signed certificate
keytool -genkey -keyalg RSA -alias selfsigned -keystore keysto­re.jks -storepass password -validity 360 -keysize 2048

Generate a certificate signing request (CSR) for an existing Java keystore

keytool -certreq -alias mydomain -keystore keysto­re.jks -file mydoma­in.csr

Import a root or intermediate CA certif­icate to an existing Java keystore

keytool -import -trustcacerts -alias root -file Thawte.crt -keystore keystore.jks

Import a signed primary certificate to an existing Java keystore

keytool -import -trustcacerts -alias mydomain -file mydomain.crt -keystore keystore.jks

Import New CA into Trusted Certs

keytool -import -trustcacerts -file /path_to_ca.pem -alias CA_ALIAS -keystore $JAVA_HOME/jre/lib/security/cacerts

Check a standalone certificate

keytool -printcert -v -file mydomain.crt

Check which certificates are in a Java keystore

keytool -list -v -keystore keystore.jks

Check a particular keystore entry using an alias

keytool -list -v -keystore keystore.jks -alias mydomain

List Trusted CA Certs

keytool -list -v -keystore $JAVA_HOME/jre/lib/security/cacerts

Delete a certif­icate from a Java Keytool keystore

keytool -delete -alias mydomain -keystore keystore.jks

Change a Java keystore password

keytool -storepasswd -new new_storepass -keystore keystore.jks

Note: To access the keystore contents, password will be prompt and it must be provided.