keytool

keytool command [options]

keytool is a key and certificate management utility included with the Java Development Kit. It generates cryptographic key pairs, creates certificate signing requests (CSRs), imports and exports X.509 certificates, and manages keystores that store private keys and trusted certificate chains used by Java applications for SSL/TLS, code signing, and authentication.The tool supports multiple keystore formats including the legacy Java KeyStore (JKS) and the industry-standard PKCS#12 format. It is commonly used to configure HTTPS for Java-based web servers, establish trust relationships by importing CA certificates, and inspect the contents of existing keystores. Each entry in a keystore is identified by an alias, and access is protected by a store-level password with optional per-key passwords.

-genkeypair

Generate key pair.

List keystore entries.

Export certificate.

Import certificate or certificate chain.

Generate a certificate signing request (CSR).

Print the content of a certificate file.

Import entries from another keystore.

Delete a keystore entry.

Change an entry's alias.

Generate a secret (symmetric) key.

Entry alias.

Keystore file.

Keystore type (JKS, PKCS12).

Keystore password.

Verbose output.

Display help information.

Part of the JDK, available wherever Java is installed. The default keystore type changed from JKS to PKCS12 in Java 9. Keystore passwords and key passwords should be kept secure. The `-storepass` flag exposes the password in process listings; omit it to be prompted interactively.

keytool has been part of the JDK since early versions, providing certificate and key management for Java applications.

openssl(1), java(1), jarsigner(1)