Definitions:
-KeyStore: It contains private keys and public certificates which are used to authenticate clients. It is used to configure on the server side.
-TrustStore: It contains trusted SSL or public certificates. usually, it is used to configure on the client side.
Create a keypair and keystore
keytool -genkeypair -alias <name> -keyalg <algorithm> -keysize <size> -dname <subject> -validity <days> -keystore <path to keystore> -storepass <password> -keypass <same password>
-alias <name>
Any value. For example, the hostname of the server, or a descriptive name like nginx node 1.
-keyalg <algorithm>
The key algorithm is normally RSA.
-keysize <size>
Use a key size of 2048.
-dname <subject>
The subject is an X.500 Distinguished Name (DN) with a CN (common name), and optionally O (organization), OU (organizational unit), C (country), and other tokens. An example DN is CN=nginx node 1, OU=Datacenter 1, OU=QA, O=IBM.
-validity <days>
The validity specifies the number of days until the personal certificate expires. For self-signed personal certificates used for internal client/server communications, there is no reason to specify short validity periods, so a ten-year expiration (3650) is acceptable.
-keystore <path to keystore>
The path to the keystore file can be anywhere, but it would normally be on the nginx conf directory (for example:/etc/nginx/conf/keystore.p12).
-storepass <password>
The keystore password can be of any value. It is used to generate a key to encrypt the keystore file.
-keypass <same password>
The key password must be the same as the storepass password.
Export a certificate from keystore
keytool -exportcert -alias <name> -keystore <path to keystore> -file <path to cert file> -storepass <password>
-exportcert
The keytool command for exporting a certificate.
-keystore <path to keystore>
The path to the keystore file can be anywhere (for example:/etc/nginx/conf/keystore.p12).
-alias <name>
Any value. For example, the hostname of the server, or a descriptive name like nginx node 1.
-file <path to the file to which the certificate is exported>
The path to the file that contains the exported certificate (for example: /etc/nginx/conf/nginx.crt). It is recommended that the name of the certificate file is different for each nginx node to identify them.
-storepass <password>
The keystore password is used in step 1.
Create a truststore
keytool -importcert -alias <name> -file <path to cert file>.crt -keystore <path to truststore> -storepass <password>
-importcert
The keytool command for importing a certificate.
- alias <name>
Any value. For example, the hostname of the server, or a descriptive name like nginx node 1.
-file <path to cert file>.crt
A certificate that is extracted from the keystore.p12.
-keystore <path to truststore>
The path to the truststore file can be anywhere (for example:/etc/nginx/conf/truststore.ts).
-storepass <password>
The truststore password.
Example
Creating a Keystore
keytool -genkey -alias node1 -keyalg RSA -keystore keystore.p12
# It asks for information with an interactive terminal
Creating a Keystore with non-interactive terminal
keytool -genkeypair -alias node1 -keyalg RSA -dname “CN=nginx node1, OU=Unit,O=Organization,L=City,S=State,C=IN” -keypass password -keystore keystore.p12 -storepass password
Export a public certificate from the store
keytool -export -alias node1 -file certificate.cer -keystore keystore.p12
Importing a certificate into the truststore
keytool -import -v -trustcacerts -alias node1 -file certificate.cer -keystore truststore.ts
# If there is no truststore.ts then it will create a new truststore.ts
Importing a certificate into the truststore with non interactive terminal
keytool -importcert -alias node1 -file certificate.cer -keystore truststore.ts -storepass password -noprompt
