Cratylus Cratylus - 2 years ago 151
Java Question

keytool - see the public and private keys

I created Java keystore programmatically of type jks (i.e. default type).

It is initially empty so I created a DSA certificate.

keytool -genkey -alias myCert -v -keystore trivial.keystore

How can I see the public and private keys?

I.e. is there a command that prints the private key of my certificate?

I could only find
keytool -certreq
which in my understanding prints the certificate as a whole:


I assume this is the whole certificate. How can I see private (or public key) via keytool?

Answer Source

You created a private (and associated public) key in your keystore. For it to be really usable, you can get it signed by a certification agency (CA) - for this is the -certreq command (you send the output to this certification agency, along with some other information and a bit of money, and they send back a certificate, which you can then import in your keystore.)

Viewing the private key is not intended ... you usually don't need this, since you use the keystore in your Java program, and this knows how to use it.

Edit: Since you want to look at your keystore, here a quick Java program which does this:


public class KeyPrinter {

     * to be invoked with these parameters:
     * [0]:  keystore-password
     * [1]:  filename
     * [2]:  alias
     * [3]:  entry-Password (if necessary)
    public static void main(String[] params)
        throws IOException, GeneralSecurityException
        char[] storePass = params[0].toCharArray();
        String fileName = params[1];
        String alias = params[2];
        KeyStore.ProtectionParameter entryPass;
        if(params.length > 3) {
        entryPass=new KeyStore.PasswordProtection(params[3].toCharArray());
        } else {
            entryPass = null;

        KeyStore store = KeyStore.getInstance("JKS");
        InputStream input = new FileInputStream(fileName);
        store.load(input, storePass);

        KeyStore.Entry entry = store.getEntry(alias, entryPass);


First call keytool -list -keystore myStore to know which alias to look for, then call this program with the passwords and parameters. In case of a private key entry, it shows the key itself and additionally a self-signed certificate which contains the public key, in a readable form. In case of a "trusted certificate", it shows only the public key.

Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download