| products/sources/formale sprachen/Java/openjdk-20-36_src/src/java.base/share/man/ |
|
Quellcode-Bibliothek
© Kompilation durch diese Firma
[Weder Korrektheit noch Funktionsfähigkeit der Software werden zugesichert.]
Datei: Log.java Sprache: JAVA
|
Untersuchungsergebnis.1 Download desIsabelle {Isabelle[300] Haskell[374] BAT[462]}zum Wurzelverzeichnis wechseln .\" Copyright (c) 1998, 2022, Oracle and/or its affiliates. All rights reserved. .\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. .\" .\" This code is free software; you can redistribute it and/or modify it .\" under the terms of the GNU General Public License version 2 only, as .\" published by the Free Software Foundation. .\" .\" This code is distributed in the hope that it will be useful, but WITHOUT .\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or .\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License .\" version 2 for more details (a copy is included in the LICENSE file that .\" accompanied this code). .\" .\" You should have received a copy of the GNU General Public License version .\" 2 along with this work; if not, write to the Free Software Foundation, .\" Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. .\" .\" Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA .\" or visit www.oracle.com if you need additional information or have any .\" questions. .\" '\" t .\" Automatically generated by Pandoc 2.19.2 .\" .\" Define V font for inline verbatim, using C font in formats .\" that render this, and otherwise B font. .ie "\f[CB]x\f[R]"x" \{\ . ftr V B . ftr VI BI . ftr VB B . ftr VBI BI .\} .el \{\ . ftr V CR . ftr VI CI . ftr VB CB . ftr VBI CBI .\} .TH "KEYTOOL" "1" "2023" "JDK 20" "JDK Commands" .hy .SH NAME .PP keytool - a key and certificate management utility .SH SYNOPSIS .PP \f[V]keytool\f[R] [\f[I]commands\f[R]] .TP \f[I]commands\f[R] Commands for \f[V]keytool\f[R] include the following: .RS .IP \[bu] 2 \f[V]-certreq\f[R]: Generates a certificate request .IP \[bu] 2 \f[V]-changealias\f[R]: Changes an entry\[aq]s alias .IP \[bu] 2 \f[V]-delete\f[R]: Deletes an entry .IP \[bu] 2 \f[V]-exportcert\f[R]: Exports certificate .IP \[bu] 2 \f[V]-genkeypair\f[R]: Generates a key pair .IP \[bu] 2 \f[V]-genseckey\f[R]: Generates a secret key .IP \[bu] 2 \f[V]-gencert\f[R]: Generates a certificate from a certificate request .IP \[bu] 2 \f[V]-importcert\f[R]: Imports a certificate or a certificate chain .IP \[bu] 2 \f[V]-importpass\f[R]: Imports a password .IP \[bu] 2 \f[V]-importkeystore\f[R]: Imports one or all entries from another keystore .IP \[bu] 2 \f[V]-keypasswd\f[R]: Changes the key password of an entry .IP \[bu] 2 \f[V]-list\f[R]: Lists entries in a keystore .IP \[bu] 2 \f[V]-printcert\f[R]: Prints the content of a certificate .IP \[bu] 2 \f[V]-printcertreq\f[R]: Prints the content of a certificate request .IP \[bu] 2 \f[V]-printcrl\f[R]: Prints the content of a Certificate Revocation List (CRL) file .IP \[bu] 2 \f[V]-storepasswd\f[R]: Changes the store password of a keystore .IP \[bu] 2 \f[V]-showinfo\f[R]: Displays security-related information .IP \[bu] 2 \f[V]-version\f[R]: Prints the program version .PP See \f[B]Commands and Options\f[R] for a description of these commands with their options. .RE .SH DESCRIPTION .PP The \f[V]keytool\f[R] command is a key and certificate management utility. It enables users to administer their own public/private key pairs and associated certificates for use in self-authentication (where a user authenticates themselves to other users and services) or data integrity and authentication services, by using digital signatures. The \f[V]keytool\f[R] command also enables users to cache the public keys (in the form of certificates) of their communicating peers. .PP A certificate is a digitally signed statement from one entity (person, company, and so on), which says that the public key (and some other information) of some other entity has a particular value. When data is digitally signed, the signature can be verified to check the data integrity and authenticity. Integrity means that the data hasn\[aq]t been modified or tampered with, and authenticity means that the data comes from the individual who claims to have created and signed it. .PP The \f[V]keytool\f[R] command also enables users to administer secret keys and passphrases used in symmetric encryption and decryption (Data Encryption Standard). It can also display other security-related information. .PP The \f[V]keytool\f[R] command stores the keys and certificates in a keystore. .PP The \f[V]keytool\f[R] command uses the \f[V]jdk.certpath.disabledAlgorithms\f[R] and \f[V]jdk.security.legacyAlgorithms\f[R] security properties to determine which algorithms are considered a security risk. It emits warnings when disabled or legacy algorithms are being used. The \f[V]jdk.certpath.disabledAlgorithms\f[R] and \f[V]jdk.security.legacyAlgorithms\f[R] security properties are defined in the \f[V]java.security\f[R] file (located in the JDK\[aq]s \f[V]$JAVA_HOME/conf/security\f[R] directory). .SH COMMAND AND OPTION NOTES .PP The following notes apply to the descriptions in \f[B]Commands and Options\f[R]: .IP \[bu] 2 All command and option names are preceded by a hyphen sign (\f[V]-\f[R]). .IP \[bu] 2 Only one command can be provided. .IP \[bu] 2 Options for each command can be provided in any order. .IP \[bu] 2 There are two kinds of options, one is single-valued which should be only provided once. If a single-valued option is provided multiple times, the value of the last one is used. The other type is multi-valued, which can be provided multiple times and all values are used. The only multi-valued option currently supported is the \f[V]-ext\f[R] option used to generate X.509v3 certificate extensions. .IP \[bu] 2 All items not italicized or in braces ({ }) or brackets ([ ]) are required to appear as is. .IP \[bu] 2 Braces surrounding an option signify that a default value is used when the option isn\[aq]t specified on the command line. Braces are also used around the \f[V]-v\f[R], \f[V]-rfc\f[R], and \f[V]-J\f[R] options, which have meaning only when they appear on the command line. They don\[aq]t have any default values. .IP \[bu] 2 Brackets surrounding an option signify that the user is prompted for the values when the option isn\[aq]t specified on the command line. For the \f[V]-keypass\f[R] option, if you don\[aq]t specify the option on the command line, then the \f[V]keytool\f[R] command first attempts to use the keystore password to recover the private/secret key. If this attempt fails, then the \f[V]keytool\f[R] command prompts you for the private/secret key password. .IP \[bu] 2 Items in italics (option values) represent the actual values that must be supplied. For example, here is the format of the \f[V]-printcert\f[R] command: .RS 2 .RS .PP \f[V]keytool -printcert\f[R] {\f[V]-file\f[R] \f[I]cert_file\f[R]} {\f[V]-v\f[R]} .RE .PP When you specify a \f[V]-printcert\f[R] command, replace \f[I]cert_file\f[R] with the actual file name, as follows: \f[V]keytool -printcert -file VScert.cer\f[R] .RE .IP \[bu] 2 Option values must be enclosed in quotation marks when they contain a blank (space). .SH COMMANDS AND OPTIONS .PP The keytool commands and their options can be grouped by the tasks that they perform. .PP \f[B]Commands for Creating or Adding Data to the Keystore\f[R]: .IP \[bu] 2 \f[V]-gencert\f[R] .IP \[bu] 2 \f[V]-genkeypair\f[R] .IP \[bu] 2 \f[V]-genseckey\f[R] .IP \[bu] 2 \f[V]-importcert\f[R] .IP \[bu] 2 \f[V]-importpass\f[R] .PP \f[B]Commands for Importing Contents from Another Keystore\f[R]: .IP \[bu] 2 \f[V]-importkeystore\f[R] .PP \f[B]Commands for Generating a Certificate Request\f[R]: .IP \[bu] 2 \f[V]-certreq\f[R] .PP \f[B]Commands for Exporting Data\f[R]: .IP \[bu] 2 \f[V]-exportcert\f[R] .PP \f[B]Commands for Displaying Data\f[R]: .IP \[bu] 2 \f[V]-list\f[R] .IP \[bu] 2 \f[V]-printcert\f[R] .IP \[bu] 2 \f[V]-printcertreq\f[R] .IP \[bu] 2 \f[V]-printcrl\f[R] .PP \f[B]Commands for Managing the Keystore\f[R]: .IP \[bu] 2 \f[V]-storepasswd\f[R] .IP \[bu] 2 \f[V]-keypasswd\f[R] .IP \[bu] 2 \f[V]-delete\f[R] .IP \[bu] 2 \f[V]-changealias\f[R] .PP \f[B]Commands for Displaying Security-related Information\f[R]: .IP \[bu] 2 \f[V]-showinfo\f[R] .PP \f[B]Commands for Displaying Program Version\f[R]: .IP \[bu] 2 \f[V]-version\f[R] .SH COMMANDS FOR CREATING OR ADDING DATA TO THE KEYSTORE .TP \f[V]-gencert\f[R] The following are the available options for the \f[V]-gencert\f[R] command: .RS .IP \[bu] 2 {\f[V]-rfc\f[R]}: Output in RFC (Request For Comment) style .IP \[bu] 2 {\f[V]-infile\f[R] \f[I]infile\f[R]}: Input file name .IP \[bu] 2 {\f[V]-outfile\f[R] \f[I]outfile\f[R]}: Output file name .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 {\f[V]-sigalg\f[R] \f[I]sigalg\f[R]}: Signature algorithm name .IP \[bu] 2 {\f[V]-dname\f[R] \f[I]dname\f[R]}: Distinguished name .IP \[bu] 2 {\f[V]-startdate\f[R] \f[I]startdate\f[R]}: Certificate validity start date and time .IP \[bu] 2 {\f[V]-ext\f[R] \f[I]ext\f[R]}*: X.509 extension .IP \[bu] 2 {\f[V]-validity\f[R] \f[I]days\f[R]}: Validity number of days .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Adds a security provider by name (such as SunPKCS11) with an optional configure argument. The value of the security provider is the name of a security provider that is defined in a module. .RS 2 .PP For example, .RS .PP \f[V]keytool -addprovider SunPKCS11 -providerarg some.cfg ...\f[R] .RE .PP \f[B]Note:\f[R] .PP For compatibility reasons, the SunPKCS11 provider can still be loaded with \f[V]-providerclass sun.security.pkcs11.SunPKCS11\f[R] even if it is now defined in a module. This is the only module included in the JDK that needs a configuration, and therefore the most widely used with the \f[V]-providerclass\f[R] option. For legacy security providers located on classpath and loaded by reflection, \f[V]-providerclass\f[R] should still be used. .RE .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .RS 2 .PP For example, if \f[V]MyProvider\f[R] is a legacy provider loaded via reflection, .RS .PP \f[V]keytool -providerclass com.example.MyProvider ...\f[R] .RE .RE .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-gencert\f[R] command to generate a certificate as a response to a certificate request file (which can be created by the \f[V]keytool -certreq\f[R] command). The command reads the request either from \f[I]infile\f[R] or, if omitted, from the standard input, signs it by using the alias\[aq]s private key, and outputs the X.509 certificate into either \f[I]outfile\f[R] or, if omitted, to the standard output. When \f[V]-rfc\f[R] is specified, the output format is Base64-encoded PEM; otherwise, a binary DER is created. .PP The \f[V]-sigalg\f[R] value specifies the algorithm that should be used to sign the certificate. The \f[I]startdate\f[R] argument is the start time and date that the certificate is valid. The \f[I]days\f[R] argument tells the number of days for which the certificate should be considered valid. .PP When \f[I]dname\f[R] is provided, it is used as the subject of the generated certificate. Otherwise, the one from the certificate request is used. .PP The \f[V]-ext\f[R] value shows what X.509 extensions will be embedded in the certificate. Read \f[B]Common Command Options\f[R] for the grammar of \f[V]-ext\f[R]. .PP The \f[V]-gencert\f[R] option enables you to create certificate chains. The following example creates a certificate, \f[V]e1\f[R], that contains three certificates in its certificate chain. .PP The following commands creates four key pairs named \f[V]ca\f[R], \f[V]ca1\f[R], \f[V]ca2\f[R], and \f[V]e1\f[R]: .IP .nf \f[CB] keytool -alias ca -dname CN=CA -genkeypair -keyalg rsa keytool -alias ca1 -dname CN=CA -genkeypair -keyalg rsa keytool -alias ca2 -dname CN=CA -genkeypair -keyalg rsa keytool -alias e1 -dname CN=E1 -genkeypair -keyalg rsa \f[R] .fi .PP The following two commands create a chain of signed certificates; \f[V]ca\f[R] signs \f[V]ca1\f[R] and \f[V]ca1\f[R] signs \f[V]ca2\f[R], all of which are self-issued: .IP .nf \f[CB] keytool -alias ca1 -certreq | keytool -alias ca -gencert -ext san=dns:ca1 | keytool -alias ca1 -importcert keytool -alias ca2 -certreq | keytool -alias ca1 -gencert -ext san=dns:ca2 | keytool -alias ca2 -importcert \f[R] .fi .PP The following command creates the certificate \f[V]e1\f[R] and stores it in the \f[V]e1.cert\f[R] file, which is signed by \f[V]ca2\f[R]. As a result, \f[V]e1\f[R] should contain \f[V]ca\f[R], \f[V]ca1\f[R], and \f[V]ca2\f[R] in its certificate chain: .RS .PP \f[V]keytool -alias e1 -certreq | keytool -alias ca2 -gencert > e1.cert\f[R] .RE .RE .TP \f[V]-genkeypair\f[R] The following are the available options for the \f[V]-genkeypair\f[R] command: .RS .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 \f[V]-keyalg\f[R] \f[I]alg\f[R]: Key algorithm name .IP \[bu] 2 {\f[V]-keysize\f[R] \f[I]size\f[R]}: Key bit size .IP \[bu] 2 {\f[V]-groupname\f[R] \f[I]name\f[R]}: Group name. For example, an Elliptic Curve name. .IP \[bu] 2 {\f[V]-sigalg\f[R] \f[I]alg\f[R]}: Signature algorithm name .IP \[bu] 2 {\f[V]-signer\f[R] \f[I]alias\f[R]}: Signer alias .IP \[bu] 2 [\f[V]-signerkeypass\f[R] \f[I]arg\f[R]]: Signer key password .IP \[bu] 2 [\f[V]-dname\f[R] \f[I]name\f[R]]: Distinguished name .IP \[bu] 2 {\f[V]-startdate\f[R] \f[I]date\f[R]}: Certificate validity start date and time .IP \[bu] 2 {\f[V]-ext\f[R] \f[I]value\f[R]}*: X.509 extension .IP \[bu] 2 {\f[V]-validity\f[R] \f[I]days\f[R]}: Validity number of days .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]] }: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-genkeypair\f[R] command to generate a key pair (a public key and associated private key). When the \f[V]-signer\f[R] option is not specified, the public key is wrapped in an X.509 v3 self-signed certificate and stored as a single-element certificate chain. When the \f[V]-signer\f[R] option is specified, a new certificate is generated and signed by the designated signer and stored as a multiple-element certificate chain (containing the generated certificate itself, and the signer?s certificate chain). The certificate chain and private key are stored in a new keystore entry that is identified by its alias. .PP The \f[V]-keyalg\f[R] value specifies the algorithm to be used to generate the key pair, and the \f[V]-keysize\f[R] value specifies the size of each key to be generated. The \f[V]-sigalg\f[R] value specifies the algorithm that should be used to sign the certificate. This algorithm must be compatible with the \f[V]-keyalg\f[R] value. .PP The \f[V]-groupname\f[R] value specifies the named group (for example, the standard or predefined name of an Elliptic Curve) of the key to be generated. Only one of \f[V]-groupname\f[R] and \f[V]-keysize\f[R] can be specified. .PP The \f[V]-signer\f[R] value specifies the alias of a \f[V]PrivateKeyEntry\f[R] for the signer that already exists in the keystore. This option is used to sign the certificate with the signer?s private key. This is especially useful for key agreement algorithms (i.e. the \f[V]-keyalg\f[R] value is \f[V]XDH\f[R], \f[V]X25519\f[R], \f[V]X448\f[R], or \f[V]DH\f[R]) as these keys cannot be used for digital signatures, and therefore a self-signed certificate cannot be created. .PP The \f[V]-signerkeypass\f[R] value specifies the password of the signer?s private key. It can be specified if the private key of the signer entry is protected by a password different from the store password. .PP The \f[V]-dname\f[R] value specifies the X.500 Distinguished Name to be associated with the value of \f[V]-alias\f[R]. If the \f[V]-signer\f[R] option is not specified, the issuer and subject fields of the self-signed certificate are populated with the specified distinguished name. If the \f[V]-signer\f[R] option is specified, the subject field of the certificate is populated with the specified distinguished name and the issuer field is populated with the subject field of the signer\[aq]s certificate. If a distinguished name is not provided at the command line, then the user is prompted for one. .PP The value of \f[V]-keypass\f[R] is a password used to protect the private key of the generated key pair. If a password is not provided, then the user is prompted for it. If you press the \f[B]Return\f[R] key at the prompt, then the key password is set to the same password as the keystore password. The \f[V]-keypass\f[R] value must have at least six characters. .PP The value of \f[V]-startdate\f[R] specifies the issue time of the certificate, also known as the \[dq]Not Before\[dq] value of the X.509 certificate\[aq]s Validity field. .PP The option value can be set in one of these two forms: .PP ([\f[V]+-\f[R]]\f[I]nnn\f[R][\f[V]ymdHMS\f[R]])+ .PP [\f[I]yyyy\f[R]\f[V]/\f[R]\f[I]mm\f[R]\f[V]/\f[R]\f[I]dd\f[R]] [\f[I]HH\f[R]\f[V]:\f[R]\f[I]MM\f[R]\f[V]:\f[R]\f[I]SS\f[R]] .PP With the first form, the issue time is shifted by the specified value from the current time. The value is a concatenation of a sequence of subvalues. Inside each subvalue, the plus sign (+) means shift forward, and the minus sign (-) means shift backward. The time to be shifted is \f[I]nnn\f[R] units of years, months, days, hours, minutes, or seconds (denoted by a single character of \f[V]y\f[R], \f[V]m\f[R], \f[V]d\f[R], \f[V]H\f[R], \f[V]M\f[R], or \f[V]S\f[R] respectively). The exact value of the issue time is calculated by using the \f[V]java.util.GregorianCalendar.add(int field, int amount)\f[R] method on each subvalue, from left to right. For example, the issue time can be specified by: .IP .nf \f[CB] Calendar c = new GregorianCalendar(); c.add(Calendar.YEAR, -1); c.add(Calendar.MONTH, 1); c.add(Calendar.DATE, -1); return c.getTime() \f[R] .fi .PP With the second form, the user sets the exact issue time in two parts, year/month/day and hour:minute:second (using the local time zone). The user can provide only one part, which means the other part is the same as the current date (or time). The user must provide the exact number of digits shown in the format definition (padding with 0 when shorter). When both date and time are provided, there is one (and only one) space character between the two parts. The hour should always be provided in 24-hour format. .PP When the option isn\[aq]t provided, the start date is the current time. The option can only be provided one time. .PP The value of \f[I]date\f[R] specifies the number of days (starting at the date specified by \f[V]-startdate\f[R], or the current date when \f[V]-startdate\f[R] isn\[aq]t specified) for which the certificate should be considered valid. .RE .TP \f[V]-genseckey\f[R] The following are the available options for the \f[V]-genseckey\f[R] command: .RS .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 \f[V]-keyalg\f[R] \f[I]alg\f[R]: Key algorithm name .IP \[bu] 2 {\f[V]-keysize\f[R] \f[I]size\f[R]}: Key bit size .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-genseckey\f[R] command to generate a secret key and store it in a new \f[V]KeyStore.SecretKeyEntry\f[R] identified by \f[V]alias\f[R]. .PP The value of \f[V]-keyalg\f[R] specifies the algorithm to be used to generate the secret key, and the value of \f[V]-keysize\f[R] specifies the size of the key that is generated. The \f[V]-keypass\f[R] value is a password that protects the secret key. If a password is not provided, then the user is prompted for it. If you press the \f[B]Return\f[R] key at the prompt, then the key password is set to the same password that is used for the \f[V]-keystore\f[R]. The \f[V]-keypass\f[R] value must contain at least six characters. .RE .TP \f[V]-importcert\f[R] The following are the available options for the \f[V]-importcert\f[R] command: .RS .IP \[bu] 2 {\f[V]-noprompt\f[R]}: Do not prompt .IP \[bu] 2 {\f[V]-trustcacerts\f[R]}: Trust certificates from cacerts .IP \[bu] 2 {\f[V]-protected\f[R]}: Password is provided through protected mechanism .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 {\f[V]-file\f[R] \f[I]file\f[R]}: Input file name .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-cacerts\f[R]}: Access the cacerts keystore .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-importcert\f[R] command to read the certificate or certificate chain (where the latter is supplied in a PKCS#7 formatted reply or in a sequence of X.509 certificates) from \f[V]-file\f[R] \f[I]file\f[R], and store it in the \f[V]keystore\f[R] entry identified by \f[V]-alias\f[R]. If \f[V]-file\f[R] \f[I]file\f[R] is not specified, then the certificate or certificate chain is read from \f[V]stdin\f[R]. .PP The \f[V]keytool\f[R] command can import X.509 v1, v2, and v3 certificates, and PKCS#7 formatted certificate chains consisting of certificates of that type. The data to be imported must be provided either in binary encoding format or in printable encoding format (also known as Base64 encoding) as defined by the Internet RFC 1421 standard. In the latter case, the encoding must be bounded at the beginning by a string that starts with \f[V]-----BEGIN\f[R], and bounded at the end by a string that starts with \f[V]-----END\f[R]. .PP You import a certificate for two reasons: To add it to the list of trusted certificates, and to import a certificate reply received from a certificate authority (CA) as the result of submitting a Certificate Signing Request (CSR) to that CA. See the \f[V]-certreq\f[R] command in \f[B]Commands for Generating a Certificate Request\f[R]. .PP The type of import is indicated by the value of the \f[V]-alias\f[R] option. If the alias doesn\[aq]t point to a key entry, then the \f[V]keytool\f[R] command assumes you are adding a trusted certificate entry. In this case, the alias shouldn\[aq]t already exist in the keystore. If the alias does exist, then the \f[V]keytool\f[R] command outputs an error because a trusted certificate already exists for that alias, and doesn\[aq]t import the certificate. If \f[V]-alias\f[R] points to a key entry, then the \f[V]keytool\f[R] command assumes that you\[aq]re importing a certificate reply. .RE .TP \f[V]-importpass\f[R] The following are the available options for the \f[V]-importpass\f[R] command: .RS .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 {\f[V]-keyalg\f[R] \f[I]alg\f[R]}: Key algorithm name .IP \[bu] 2 {\f[V]-keysize\f[R] \f[I]size\f[R]}: Key bit size .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-importpass\f[R] command to imports a passphrase and store it in a new \f[V]KeyStore.SecretKeyEntry\f[R] identified by \f[V]-alias\f[R]. The passphrase may be supplied via the standard input stream; otherwise the user is prompted for it. The \f[V]-keypass\f[R] option provides a password to protect the imported passphrase. If a password is not provided, then the user is prompted for it. If you press the \f[B]Return\f[R] key at the prompt, then the key password is set to the same password as that used for the \f[V]keystore\f[R]. The \f[V]-keypass\f[R] value must contain at least six characters. .RE .SH COMMANDS FOR IMPORTING CONTENTS FROM ANOTHER KEYSTORE .TP \f[V]-importkeystore\f[R] The following are the available options for the \f[V]-importkeystore\f[R] command: .RS .IP \[bu] 2 \f[V]-srckeystore\f[R] \f[I]keystore\f[R]: Source keystore name .IP \[bu] 2 {\f[V]-destkeystore\f[R] \f[I]keystore\f[R]}: Destination keystore name .IP \[bu] 2 {\f[V]-srcstoretype\f[R] \f[I]type\f[R]}: Source keystore type .IP \[bu] 2 {\f[V]-deststoretype\f[R] \f[I]type\f[R]}: Destination keystore type .IP \[bu] 2 [\f[V]-srcstorepass\f[R] \f[I]arg\f[R]]: Source keystore password .IP \[bu] 2 [\f[V]-deststorepass\f[R] \f[I]arg\f[R]]: Destination keystore password .IP \[bu] 2 {\f[V]-srcprotected\f[R]}: Source keystore password protected .IP \[bu] 2 {\f[V]-destprotected\f[R]}: Destination keystore password protected .IP \[bu] 2 {\f[V]-srcprovidername\f[R] \f[I]name\f[R]}: Source keystore provider name .IP \[bu] 2 {\f[V]-destprovidername\f[R] \f[I]name\f[R]}: Destination keystore provider name .IP \[bu] 2 {\f[V]-srcalias\f[R] \f[I]alias\f[R]}: Source alias .IP \[bu] 2 {\f[V]-destalias\f[R] \f[I]alias\f[R]}: Destination alias .IP \[bu] 2 [\f[V]-srckeypass\f[R] \f[I]arg\f[R]]: Source key password .IP \[bu] 2 [\f[V]-destkeypass\f[R] \f[I]arg\f[R]]: Destination key password .IP \[bu] 2 {\f[V]-noprompt\f[R]}: Do not prompt .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP \f[B]Note:\f[R] .PP This is the first line of all options: .RS .PP \f[V]-srckeystore\f[R] \f[I]keystore\f[R] \f[V]-destkeystore\f[R] \f[I]keystore\f[R] .RE .PP Use the \f[V]-importkeystore\f[R] command to import a single entry or all entries from a source keystore to a destination keystore. .PP \f[B]Note:\f[R] .PP If you do not specify \f[V]-destkeystore\f[R] when using the \f[V]keytool -importkeystore\f[R] command, then the default keystore used is \f[V]$HOME/.keystore\f[R]. .PP When the \f[V]-srcalias\f[R] option is provided, the command imports the single entry identified by the alias to the destination keystore. If a destination alias isn\[aq]t provided with \f[V]-destalias\f[R], then \f[V]-srcalias\f[R] is used as the destination alias. If the source entry is protected by a password, then \f[V]-srckeypass\f[R] is used to recover the entry. If \f[V]-srckeypass\f[R] isn\[aq]t provided, then the \f[V]keytool\f[R] command attempts to use \f[V]-srcstorepass\f[R] to recover the entry. If \f[V]-srcstorepass\f[R] is not provided or is incorrect, then the user is prompted for a password. The destination entry is protected with \f[V]-destkeypass\f[R]. If \f[V]-destkeypass\f[R] isn\[aq]t provided, then the destination entry is protected with the source entry password. For example, most third-party tools require \f[V]storepass\f[R] and \f[V]keypass\f[R] in a PKCS #12 keystore to be the same. To create a PKCS#12 keystore for these tools, always specify a \f[V]-destkeypass\f[R] that is the same as \f[V]-deststorepass\f[R]. .PP If the \f[V]-srcalias\f[R] option isn\[aq]t provided, then all entries in the source keystore are imported into the destination keystore. Each destination entry is stored under the alias from the source entry. If the source entry is protected by a password, then \f[V]-srcstorepass\f[R] is used to recover the entry. If \f[V]-srcstorepass\f[R] is not provided or is incorrect, then the user is prompted for a password. If a source keystore entry type isn\[aq]t supported in the destination keystore, or if an error occurs while storing an entry into the destination keystore, then the user is prompted either to skip the entry and continue or to quit. The destination entry is protected with the source entry password. .PP If the destination alias already exists in the destination keystore, then the user is prompted either to overwrite the entry or to create a new entry under a different alias name. .PP If the \f[V]-noprompt\f[R] option is provided, then the user isn\[aq]t prompted for a new destination alias. Existing entries are overwritten with the destination alias name. Entries that can\[aq]t be imported are skipped and a warning is displayed. .RE .SH COMMANDS FOR GENERATING A CERTIFICATE REQUEST .TP \f[V]-certreq\f[R] The following are the available options for the \f[V]-certreq\f[R] command: .RS .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 {\f[V]-sigalg\f[R] \f[I]alg\f[R]}: Signature algorithm name .IP \[bu] 2 {\f[V]-file\f[R] \f[I]file\f[R]}: Output file name .IP \[bu] 2 [ \f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-dname\f[R] \f[I]name\f[R]}: Distinguished name .IP \[bu] 2 {\f[V]-ext\f[R] \f[I]value\f[R]}: X.509 extension .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-certreq\f[R] command to generate a Certificate Signing Request (CSR) using the PKCS #10 format. .PP A CSR is intended to be sent to a CA. The CA authenticates the certificate requestor (usually offline) and returns a certificate or certificate chain to replace the existing certificate chain (initially a self-signed certificate) in the keystore. .PP The private key associated with \f[I]alias\f[R] is used to create the PKCS #10 certificate request. To access the private key, the correct password must be provided. If \f[V]-keypass\f[R] isn\[aq]t provided at the command line and is different from the password used to protect the integrity of the keystore, then the user is prompted for it. If \f[V]-dname\f[R] is provided, then it is used as the subject in the CSR. Otherwise, the X.500 Distinguished Name associated with alias is used. .PP The \f[V]-sigalg\f[R] value specifies the algorithm that should be used to sign the CSR. .PP The CSR is stored in the \f[V]-file\f[R] \f[I]file\f[R]. If a file is not specified, then the CSR is output to \f[V]-stdout\f[R]. .PP Use the \f[V]-importcert\f[R] command to import the response from the CA. .RE .SH COMMANDS FOR EXPORTING DATA .TP \f[V]-exportcert\f[R] The following are the available options for the \f[V]-exportcert\f[R] command: .RS .IP \[bu] 2 {\f[V]-rfc\f[R]}: Output in RFC style .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 {\f[V]-file\f[R] \f[I]file\f[R]}: Output file name .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-cacerts\f[R]}: Access the cacerts keystore .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]] }: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-exportcert\f[R] command to read a certificate from the keystore that is associated with \f[V]-alias\f[R] \f[I]alias\f[R] and store it in the \f[V]-file\f[R] \f[I]file\f[R]. When a file is not specified, the certificate is output to \f[V]stdout\f[R]. .PP By default, the certificate is output in binary encoding. If the \f[V]-rfc\f[R] option is specified, then the output in the printable encoding format defined by the Internet RFC 1421 Certificate Encoding Standard. .PP If \f[V]-alias\f[R] refers to a trusted certificate, then that certificate is output. Otherwise, \f[V]-alias\f[R] refers to a key entry with an associated certificate chain. In that case, the first certificate in the chain is returned. This certificate authenticates the public key of the entity addressed by \f[V]-alias\f[R]. .RE .SH COMMANDS FOR DISPLAYING DATA .TP \f[V]-list\f[R] The following are the available options for the \f[V]-list\f[R] command: .RS .IP \[bu] 2 {\f[V]-rfc\f[R]}: Output in RFC style .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-cacerts\f[R]}: Access the cacerts keystore .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]] }: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-list\f[R] command to print the contents of the keystore entry identified by \f[V]-alias\f[R] to \f[V]stdout\f[R]. If \f[V]-alias\f[R] \f[I]alias\f[R] is not specified, then the contents of the entire keystore are printed. .PP By default, this command prints the SHA-256 fingerprint of a certificate. If the \f[V]-v\f[R] option is specified, then the certificate is printed in human-readable format, with additional information such as the owner, issuer, serial number, and any extensions. If the \f[V]-rfc\f[R] option is specified, then the certificate contents are printed by using the printable encoding format, as defined by the Internet RFC 1421 Certificate Encoding Standard. .PP \f[B]Note:\f[R] .PP You can\[aq]t specify both \f[V]-v\f[R] and \f[V]-rfc\f[R] in the same command. Otherwise, an error is reported. .RE .TP \f[V]-printcert\f[R] The following are the available options for the \f[V]-printcert\f[R] command: .RS .IP \[bu] 2 {\f[V]-rfc\f[R]}: Output in RFC style .IP \[bu] 2 {\f[V]-file\f[R] \f[I]cert_file\f[R]}: Input file name .IP \[bu] 2 {\f[V]-sslserver\f[R] \f[I]server\f[R][\f[V]:\f[R]\f[I]port\f[R]]}:: Secure Sockets Layer (SSL) server host and port .IP \[bu] 2 {\f[V]-jarfile\f[R] \f[I]JAR_file\f[R]}: Signed \f[V].jar\f[R] file .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-trustcacerts\f[R]}: Trust certificates from cacerts .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-protected\f[R]}: Password is provided through protected mechanism .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-printcert\f[R] command to read and print the certificate from \f[V]-file\f[R] \f[I]cert_file\f[R], the SSL server located at \f[V]-sslserver\f[R] \f[I]server\f[R][\f[V]:\f[R]\f[I]port\f[R]], or the signed JAR file specified by \f[V]-jarfile\f[R] \f[I]JAR_file\f[R]. It prints its contents in a human-readable format. When a port is not specified, the standard HTTPS port 443 is assumed. .PP \f[B]Note:\f[R] .PP The \f[V]-sslserver\f[R] and \f[V]-file\f[R] options can\[aq]t be provided in the same command. Otherwise, an error is reported. If you don\[aq]t specify either option, then the certificate is read from \f[V]stdin\f[R]. .PP When\f[V]-rfc\f[R] is specified, the \f[V]keytool\f[R] command prints the certificate in PEM mode as defined by the Internet RFC 1421 Certificate Encoding standard. .PP If the certificate is read from a file or \f[V]stdin\f[R], then it might be either binary encoded or in printable encoding format, as defined by the RFC 1421 Certificate Encoding standard. .PP If the SSL server is behind a firewall, then the \f[V]-J-Dhttps.proxyHost=proxyhost\f[R] and \f[V]-J-Dhttps.proxyPort=proxyport\f[R] options can be specified on the command line for proxy tunneling. .PP \f[B]Note:\f[R] .PP This command can be used independently of a keystore. This command does not check for the weakness of a certificate\[aq]s signature algorithm if it is a trusted certificate in the user keystore (specified by \f[V]-keystore\f[R]) or in the \f[V]cacerts\f[R] keystore (if \f[V]-trustcacerts\f[R] is specified). .RE .TP \f[V]-printcertreq\f[R] The following are the available options for the \f[V]-printcertreq\f[R] command: .RS .IP \[bu] 2 {\f[V]-file\f[R] \f[I]file\f[R]}: Input file name .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-printcertreq\f[R] command to print the contents of a PKCS #10 format certificate request, which can be generated by the \f[V]keytool -certreq\f[R] command. The command reads the request from file. If there is no file, then the request is read from the standard input. .RE .TP \f[V]-printcrl\f[R] The following are the available options for the \f[V]-printcrl\f[R] command: .RS .IP \[bu] 2 {\f[V]-file crl\f[R]}: Input file name .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-trustcacerts\f[R]}: Trust certificates from cacerts .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-protected\f[R]}: Password is provided through protected mechanism .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-printcrl\f[R] command to read the Certificate Revocation List (CRL) from \f[V]-file crl\f[R] . A CRL is a list of the digital certificates that were revoked by the CA that issued them. The CA generates the \f[V]crl\f[R] file. .PP \f[B]Note:\f[R] .PP This command can be used independently of a keystore. This command attempts to verify the CRL using a certificate from the user keystore (specified by \f[V]-keystore\f[R]) or the \f[V]cacerts\f[R] keystore (if \f[V]-trustcacerts\f[R] is specified), and will print out a warning if it cannot be verified. .RE .SH COMMANDS FOR MANAGING THE KEYSTORE .TP \f[V]-storepasswd\f[R] The following are the available options for the \f[V]-storepasswd\f[R] command: .RS .IP \[bu] 2 [\f[V]-new\f[R] \f[I]arg\f[R]]: New password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-cacerts\f[R]}: Access the cacerts keystore .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-storepasswd\f[R] command to change the password used to protect the integrity of the keystore contents. The new password is set by \f[V]-new\f[R] \f[I]arg\f[R] and must contain at least six characters. .RE .TP \f[V]-keypasswd\f[R] The following are the available options for the \f[V]-keypasswd\f[R] command: .RS .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]old_keypass\f[R]]: Key password .IP \[bu] 2 [\f[V]-new\f[R] \f[I]new_keypass\f[R]]: New password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-storepass\f[R] \f[I]arg\f[R]}: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-keypasswd\f[R] command to change the password (under which private/secret keys identified by \f[V]-alias\f[R] are protected) from \f[V]-keypass\f[R] \f[I]old_keypass\f[R] to \f[V]-new\f[R] \f[I]new_keypass\f[R]. The password value must contain at least six characters. .PP If the \f[V]-keypass\f[R] option isn\[aq]t provided at the command line and the \f[V]-keypass\f[R] password is different from the keystore password (\f[V]-storepass\f[R] \f[I]arg\f[R]), then the user is prompted for it. .PP If the \f[V]-new\f[R] option isn\[aq]t provided at the command line, then the user is prompted for it. .RE .TP \f[V]-delete\f[R] The following are the available options for the \f[V]-delete\f[R] command: .RS .IP \[bu] 2 [\f[V]-alias\f[R] \f[I]alias\f[R]]: Alias name of the entry to process .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-cacerts\f[R]}: Access the cacerts keystore .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-delete\f[R] command to delete the \f[V]-alias\f[R] \f[I]alias\f[R] entry from the keystore. When not provided at the command line, the user is prompted for the \f[V]alias\f[R]. .RE .TP \f[V]-changealias\f[R] The following are the available options for the \f[V]-changealias\f[R] command: .RS .IP \[bu] 2 {\f[V]-alias\f[R] \f[I]alias\f[R]}: Alias name of the entry to process .IP \[bu] 2 [\f[V]-destalias\f[R] \f[I]alias\f[R]]: Destination alias .IP \[bu] 2 [\f[V]-keypass\f[R] \f[I]arg\f[R]]: Key password .IP \[bu] 2 {\f[V]-keystore\f[R] \f[I]keystore\f[R]}: Keystore name .IP \[bu] 2 {\f[V]-cacerts\f[R]}: Access the cacerts keystore .IP \[bu] 2 [\f[V]-storepass\f[R] \f[I]arg\f[R]]: Keystore password .IP \[bu] 2 {\f[V]-storetype\f[R] \f[I]type\f[R]}: Keystore type .IP \[bu] 2 {\f[V]-providername\f[R] \f[I]name\f[R]}: Provider name .IP \[bu] 2 {\f[V]-addprovider\f[R] \f[I]name\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by name (such as SunPKCS11) with an optional configure argument. .IP \[bu] 2 {\f[V]-providerclass\f[R] \f[I]class\f[R] [\f[V]-providerarg\f[R] \f[I]arg\f[R]]}: Add security provider by fully qualified class name with an optional configure argument. .IP \[bu] 2 {\f[V]-providerpath\f[R] \f[I]list\f[R]}: Provider classpath .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .IP \[bu] 2 {\f[V]-protected\f[R]}: Password provided through a protected mechanism .PP Use the \f[V]-changealias\f[R] command to move an existing keystore entry from \f[V]-alias\f[R] \f[I]alias\f[R] to a new \f[V]-destalias\f[R] \f[I]alias\f[R]. If a destination alias is not provided, then the command prompts you for one. If the original entry is protected with an entry password, then the password can be supplied with the \f[V]-keypass\f[R] option. If a key password is not provided, then the \f[V]-storepass\f[R] (if provided) is attempted first. If the attempt fails, then the user is prompted for a password. .RE .SH COMMANDS FOR DISPLAYING SECURITY-RELATED INFORMATION .TP \f[V]-showinfo\f[R] The following are the available options for the \f[V]-showinfo\f[R] command: .RS .IP \[bu] 2 {\f[V]-tls\f[R]}: Displays TLS configuration information .IP \[bu] 2 {\f[V]-v\f[R]}: Verbose output .PP Use the \f[V]-showinfo\f[R] command to display various security-related information. The \f[V]-tls\f[R] option displays TLS configurations, such as the list of enabled protocols and cipher suites. .RE .SH COMMANDS FOR DISPLAYING PROGRAM VERSION .PP You can use \f[V]-version\f[R] to print the program version of \f[V]keytool\f[R]. .SH COMMANDS FOR DISPLAYING HELP INFORMATION .PP You can use \f[V]--help\f[R] to display a list of \f[V]keytool\f[R] commands or to display help information about a specific \f[V]keytool\f[R] command. .IP \[bu] 2 To display a list of \f[V]keytool\f[R] commands, enter: .RS 2 .RS .PP \f[V]keytool --help\f[R] .RE .RE .IP \[bu] 2 To display help information about a specific \f[V]keytool\f[R] command, enter: .RS 2 .RS .PP \f[V]keytool -<command> --help\f[R] .RE .RE .SH COMMON COMMAND OPTIONS .PP The \f[V]-v\f[R] option can appear for all commands except \f[V]--help\f[R]. When the \f[V]-v\f[R] option appears, it signifies verbose mode, which means that more information is provided in the output. .PP The \f[V]-J\f[R]\f[I]option\f[R] argument can appear for any command. When the \f[V]-J\f[R]\f[I]option\f[R] is used, the specified \f[I]option\f[R] string is passed directly to the Java interpreter. This option doesn\[aq]t contain any spaces. It\[aq]s useful for adjusting the execution environment or memory usage. For a list of possible interpreter options, enter \f[V]java -h\f[R] or \f[V]java -X\f[R] at the command line. .PP These options can appear for all commands operating on a keystore: .TP \f[V]-storetype\f[R] \f[I]storetype\f[R] This qualifier specifies the type of keystore to be instantiated. .TP \f[V]-keystore\f[R] \f[I]keystore\f[R] The keystore location. .RS .PP If the JKS \f[V]storetype\f[R] is used and a keystore file doesn\[aq]t yet exist, then certain \f[V]keytool\f[R] commands can result in a new keystore file being created. For example, if \f[V]keytool -genkeypair\f[R] is called and the \f[V]-keystore\f[R] option isn\[aq]t specified, the default keystore file named \f[V].keystore\f[R] is created in the user\[aq]s home directory if it doesn\[aq]t already exist. Similarly, if the \f[V]-keystore ks_file\f[R] option is specified but \f[V]ks_file\f[R] doesn\[aq]t exist, then it is created. For more information on the JKS \f[V]storetype\f[R], see the \f[B]KeyStore Implementation\f[R] section in \f[B]KeyStore aliases\f[R]. .PP Note that the input stream from the \f[V]-keystore\f[R] option is passed to the \f[V]KeyStore.load\f[R] method. If \f[V]NONE\f[R] is specified as the URL, then a null stream is passed to the \f[V]KeyStore.load\f[R] method. \f[V]NONE\f[R] should be specified if the keystore isn\[aq]t file-based. For example, when the keystore resides on a hardware token device. .RE .TP \f[V]-cacerts\f[R] \f[I]cacerts\f[R] Operates on the \f[I]cacerts\f[R] keystore . This option is equivalent to \f[V]-keystore\f[R] \f[I]path_to_cacerts\f[R] \f[V]-storetype\f[R] \f[I]type_of_cacerts\f[R]. An error is reported if the \f[V]-keystore\f[R] or \f[V]-storetype\f[R] option is used with the \f[V]-cacerts\f[R] option. .TP \f[V]-storepass\f[R] [\f[V]:env\f[R] | \f[V]:file\f[R] ] \f[I]argument\f[R] The password that is used to protect the integrity of the keystore. .RS .PP If the modifier \f[V]env\f[R] or \f[V]file\f[R] isn\[aq]t specified, then the password has the value \f[I]argument\f[R], which must contain at least six characters. Otherwise, the password is retrieved as follows: .IP \[bu] 2 \f[V]env\f[R]: Retrieve the password from the environment variable named \f[I]argument\f[R]. .IP \[bu] 2 \f[V]file\f[R]: Retrieve the password from the file named \f[I]argument\f[R]. .PP \f[B]Note:\f[R] All other options that require passwords, such as \f[V]-keypass\f[R], \f[V]-srckeypass\f[R], \f[V]-destkeypass\f[R], \f[V]-srcstorepass\f[R], and \f[V]-deststorepass\f[R], accept the \f[V]env\f[R] and \f[V]file\f[R] modifiers. Remember to separate the password option and the modifier with a colon (:). .PP The password must be provided to all commands that access the keystore contents. For such commands, when the \f[V]-storepass\f[R] option isn\[aq]t provided at the command line, the user is prompted for it. .PP When retrieving information from the keystore, the password is optional. If a password is not specified, then the integrity of the retrieved information can\[aq]t be verified and a warning is displayed. .RE .TP \f[V]-providername\f[R] \f[I]name\f[R] Used to identify a cryptographic service provider\[aq]s name when listed in the security properties file. .TP \f[V]-addprovider\f[R] \f[I]name\f[R] Used to add a security provider by name (such as SunPKCS11) . .TP \f[V]-providerclass\f[R] \f[I]class\f[R] Used to specify the name of a cryptographic service provider\[aq]s master class file when the service provider isn\[aq]t listed in the security properties file. .TP \f[V]-providerpath\f[R] \f[I]list\f[R] Used to specify the provider classpath. .TP \f[V]-providerarg\f[R] \f[I]arg\f[R] Used with the \f[V]-addprovider\f[R] or \f[V]-providerclass\f[R] option to represent an optional string input argument for the constructor of \f[I]class\f[R] name. .TP \f[V]-protected=true\f[R]|\f[V]false\f[R] Specify this value as \f[V]true\f[R] when a password must be specified by way of a protected authentication path, such as a dedicated PIN reader. Because there are two keystores involved in the \f[V]-importkeystore\f[R] command, the following two options, \f[V]-srcprotected\f[R] and \f[V]-destprotected\f[R], are provided for the source keystore and the destination keystore respectively. .TP \f[V]-ext\f[R] {\f[I]name\f[R]{\f[V]:critical\f[R]} {\f[V]=\f[R]\f[I]value\f[R]}} Denotes an X.509 certificate extension. The option can be used in \f[V]-genkeypair\f[R] and \f[V]-gencert\f[R] to embed extensions into the generated certificate, or in \f[V]-certreq\f[R] to show what extensions are requested in the certificate request. The option can appear multiple times. The \f[I]name\f[R] argument can be a supported extension name (see \f[B]Supported Named Extensions\f[R]) or an arbitrary OID number. The \f[I]value\f[R] argument, when provided, denotes the argument for the extension. When \f[I]value\f[R] is omitted, the default value of the extension or the extension itself requires no argument. The \f[V]:critical\f[R] modifier, when provided, means the extension\[aq]s \f[V]isCritical\f[R] attribute is \f[V]true\f[R]; otherwise, it is \f[V]false\f[R]. You can use \f[V]:c\f[R] in place of \f[V]:critical\f[R]. .TP \f[V]-conf\f[R] \f[I]file\f[R] Specifies a pre-configured options file. .SH PRE-CONFIGURED OPTIONS FILE .PP A pre-configured options file is a Java properties file that can be specified with the \f[V]-conf\f[R] option. Each property represents the default option(s) for a keytool command using \[dq]keytool.\f[I]command_name\f[R]\[dq] as the property name. A special property named \[dq]keytool.all\[dq] represents the default option(s) applied to all commands. A property value can include \f[V]${prop}\f[R] which will be expanded to the system property associated with it. If an option value includes white spaces inside, it should be surrounded by quotation marks (\[dq] or \[aq]). All property names must be in lower case. .PP When \f[V]keytool\f[R] is launched with a pre-configured options file, the value for \[dq]keytool.all\[dq] (if it exists) is prepended to the \f[V]keytool\f[R] command line first, with the value for the command name (if it exists) comes next, and the existing options on the command line at last. For a single-valued option, this allows the property for a specific command to override the \[dq]keytool.all\[dq] value, and the value specified on the command line to override both. For multiple-valued options, all of them will be used by \f[V]keytool\f[R]. .PP For example, given the following file named \f[V]preconfig\f[R]: .IP .nf \f[CB] # A tiny pre-configured options file keytool.all = -keystore ${user.home}/ks keytool.list = -v keytool.genkeypair = -keyalg rsa \f[R] .fi .PP \f[V]keytool -conf preconfig -list\f[R] is identical to .RS .PP \f[V]keytool -keystore \[ti]/ks -v -list\f[R] .RE .PP \f[V]keytool -conf preconfig -genkeypair -alias me\f[R] is identical to .RS .PP \f[V]keytool -keystore \[ti]/ks -keyalg rsa -genkeypair -alias me\f[R] .RE .PP \f[V]keytool -conf preconfig -genkeypair -alias you -keyalg ec\f[R] is identical to .RS .PP \f[V]keytool -keystore \[ti]/ks -keyalg rsa -genkeypair -alias you -keyalg ec\f[R] .RE .PP which is equivalent to .RS .PP \f[V]keytool -keystore \[ti]/ks -genkeypair -alias you -keyalg ec\f[R] .RE .PP because \f[V]-keyalg\f[R] is a single-valued option and the \f[V]ec\f[R] value specified on the command line overrides the preconfigured options file. .SH EXAMPLES OF OPTION VALUES .PP The following examples show the defaults for various option values: .IP .nf \f[CB] -alias \[dq]mykey\[dq] -keysize 2048 (when using -genkeypair and -keyalg is \[dq]DSA\[dq]) 3072 (when using -genkeypair and -keyalg is \[dq]RSA\[dq], \[dq]RSASSA-PSS\[dq], or \[dq]D 384 (when using -genkeypair and -keyalg is \[dq]EC\[dq]) 255 (when using -genkeypair and -keyalg is \[dq]EdDSA\[dq], or \[dq]XDH) 56 (when using -genseckey and -keyalg is \[dq]DES\[dq]) 168 (when using -genseckey and -keyalg is \[dq]DESede\[dq]) -validity 90 -keystore <the file named .keystore in the user\[aq]s home directory> -destkeystore <the file named .keystore in the user\[aq]s home directory> -storetype <the value of the \[dq]keystore.type\[dq] property in the security properties file, which is returned by the static getDefaultType method in java.security.KeyStore> -file stdin (if reading) stdout (if writing) -protected false \f[R] .fi .PP When generating a certificate or a certificate request, the default signature algorithm (\f[V]-sigalg\f[R] option) is derived from the algorithm of the underlying private key to provide an appropriate level of security strength as follows: .PP Default Signature Algorithms .TS tab(@); l l l. T{ keyalg T}@T{ keysize T}@T{ default sigalg T} _ T{ DSA T}@T{ any size T}@T{ SHA256withDSA T} T{ RSA T}@T{ < 624 T}@T{ SHA256withRSA (keysize is too small for using SHA-384) T} T{ T}@T{ <= 7680 T}@T{ SHA384withRSA T} T{ T}@T{ > 7680 T}@T{ SHA512withRSA T} T{ EC T}@T{ < 512 T}@T{ SHA384withECDSA T} T{ T}@T{ >= 512 T}@T{ SHA512withECDSA T} T{ RSASSA-PSS T}@T{ < 624 T}@T{ RSASSA-PSS (with SHA-256, keysize is too small for T} T{ T}@T{ T}@T{ using SHA-384) T} T{ T}@T{ <= 7680 T}@T{ RSASSA-PSS (with SHA-384) T} T{ T}@T{ > 7680 T}@T{ RSASSA-PSS (with SHA-512) T} T{ EdDSA T}@T{ 255 T}@T{ Ed25519 T} T{ T}@T{ 448 T}@T{ Ed448 T} T{ Ed25519 T}@T{ 255 T}@T{ Ed25519 T} T{ Ed448 T}@T{ 448 T}@T{ Ed448 T} .TE .IP \[bu] 2 An RSASSA-PSS signature algorithm uses a \f[V]MessageDigest\f[R] algorithm as its hash and MGF1 algorithms. .IP \[bu] 2 EdDSA supports 2 key sizes: Ed25519 and Ed448. When generating an EdDSA key pair using \f[V]-keyalg EdDSA\f[R], a user can specify \f[V]-keysize 255\f[R] or \f[V]-keysize 448\f[R] to generate Ed25519 or Ed448 key pairs. When no \f[V]-keysize\f[R] is specified, an Ed25519 key pair is generated. A user can also directly specify \f[V]-keyalg Ed25519\f[R] or \f[V]-keyalg Ed448\f[R] to generate a key pair with the expected key size. .PP \f[B]Note:\f[R] .PP To improve out of the box security, default key size and signature algorithm names are periodically updated to stronger values with each release of the JDK. If interoperability with older releases of the JDK is important, make sure that the defaults are supported by those releases. Alternatively, you can use the \f[V]-keysize\f[R] or \f[V]-sigalg\f[R] options to override the default values at your own risk. .SH SUPPORTED NAMED EXTENSIONS .PP The \f[V]keytool\f[R] command supports these named extensions. The names aren\[aq]t case-sensitive. .TP \f[V]BC\f[R] or \f[V]BasicContraints\f[R] Values: .RS .PP The full form is \f[V]ca:\f[R]{\f[V]true\f[R]|\f[V]false\f[R]}[\f[V],pathlen:\f[R]\f[I]len\f[R]] or \f[I]len\f[R], which is short for \f[V]ca:true,pathlen:\f[R]\f[I]len\f[R]. .PP When \f[I]len\f[R] is omitted, the resulting value is \f[V]ca:true\f[R]. .RE .TP \f[V]KU\f[R] or \f[V]KeyUsage\f[R] Values: .RS .PP \f[I]usage\f[R](\f[V],\f[R] \f[I]usage\f[R])* .PP \f[I]usage\f[R] can be one of the following: .IP \[bu] 2 \f[V]digitalSignature\f[R] .IP \[bu] 2 \f[V]nonRepudiation\f[R] (\f[V]contentCommitment\f[R]) .IP \[bu] 2 \f[V]keyEncipherment\f[R] .IP \[bu] 2 \f[V]dataEncipherment\f[R] .IP \[bu] 2 \f[V]keyAgreement\f[R] .IP \[bu] 2 \f[V]keyCertSign\f[R] .IP \[bu] 2 \f[V]cRLSign\f[R] .IP \[bu] 2 \f[V]encipherOnly\f[R] .IP \[bu] 2 \f[V]decipherOnly\f[R] .PP Provided there is no ambiguity, the \f[I]usage\f[R] argument can be abbreviated with the first few letters (such as \f[V]dig\f[R] for \f[V]digitalSignature\f[R]) or in camel-case style (such as \f[V]dS\f[R] for \f[V]digitalSignature\f[R] or \f[V]cRLS\f[R] for \f[V]cRLSign\f[R]). The \f[I]usage\f[R] values are case-sensitive. .RE .TP \f[V]EKU\f[R] or \f[V]ExtendedKeyUsage\f[R] Values: .RS .PP \f[I]usage\f[R](\f[V],\f[R] \f[I]usage\f[R])* .PP \f[I]usage\f[R] can be one of the following: .IP \[bu] 2 \f[V]anyExtendedKeyUsage\f[R] .IP \[bu] 2 \f[V]serverAuth\f[R] .IP \[bu] 2 \f[V]clientAuth\f[R] .IP \[bu] 2 \f[V]codeSigning\f[R] .IP \[bu] 2 \f[V]emailProtection\f[R] .IP \[bu] 2 \f[V]timeStamping\f[R] .IP \[bu] 2 \f[V]OCSPSigning\f[R] .IP \[bu] 2 Any OID string .PP Provided there is no ambiguity, the \f[I]usage\f[R] argument can be abbreviated with the first few letters or in camel-case style. The \f[I]usage\f[R] values are case-sensitive. .RE .TP \f[V]SAN\f[R] or \f[V]SubjectAlternativeName\f[R] Values: .RS .PP \f[I]type\f[R]\f[V]:\f[R]\f[I]value\f[R](\f[V],\f[R] \f[I]type\f[R]\f[V]:\f[R]\f[I]value\f[R])* .PP \f[I]type\f[R] can be one of the following: .IP \[bu] 2 \f[V]EMAIL\f[R] .IP \[bu] 2 \f[V]URI\f[R] .IP \[bu] 2 \f[V]DNS\f[R] .IP \[bu] 2 \f[V]IP\f[R] .IP \[bu] 2 \f[V]OID\f[R] .PP The \f[I]value\f[R] argument is the string format value for the \f[I]type\f[R]. .RE .TP \f[V]IAN\f[R] or \f[V]IssuerAlternativeName\f[R] Values: .RS .PP Same as \f[V]SAN\f[R] or \f[V]SubjectAlternativeName\f[R]. .RE .TP \f[V]SIA\f[R] or \f[V]SubjectInfoAccess\f[R] Values: .RS .PP \f[I]method\f[R]\f[V]:\f[R]\f[I]location-type\f[R]\f[V]:\f[R]\f[I]location-value \f[I]method\f[R]\f[V]:\f[R]\f[I]location-type\f[R]\f[V]:\f[R]\f[I]location-value .PP \f[I]method\f[R] can be one of the following: .IP \[bu] 2 \f[V]timeStamping\f[R] .IP \[bu] 2 \f[V]caRepository\f[R] .IP \[bu] 2 Any OID .PP The \f[I]location-type\f[R] and \f[I]location-value\f[R] arguments can be any \f[I]type\f[R]\f[V]:\f[R]\f[I]value\f[R] supported by the \f[V]SubjectAlternativeName\f[R] extension. .RE .TP \f[V]AIA\f[R] or \f[V]AuthorityInfoAccess\f[R] Values: .RS .PP Same as \f[V]SIA\f[R] or \f[V]SubjectInfoAccess\f[R]. .PP The \f[I]method\f[R] argument can be one of the following: .IP \[bu] 2 \f[V]ocsp\f[R] .IP \[bu] 2 \f[V]caIssuers\f[R] .IP \[bu] 2 Any OID .RE .PP When \f[I]name\f[R] is OID, the value is the hexadecimal dumped Definite Encoding Rules (DER) encoding of the \f[V]extnValue\f[R] for the extension excluding the OCTET STRING type and length bytes. Other than standard hexadecimal numbers (0-9, a-f, A-F), any extra characters are ignored in the HEX string. Therefore, both 01:02:03:04 and 01020304 are accepted as identical values. When there is no value, the extension has an empty value field. .PP A special name \f[V]honored\f[R], used only in \f[V]-gencert\f[R], denotes how the extensions included in the certificate request should be honored. The value for this name is a comma-separated list of \f[V]all\f[R] (all requested extensions are honored), \f[I]name\f[R]{\f[V]:\f[R][\f[V]critical\f[R]|\f[V]non-critical\f[R]]} (the named extension is honored, but it uses a different \f[V]isCritical\f[R] attribute), and \f[V]-name\f[R] (used with \f[V]all\f[R], denotes an exception). Requested extensions aren\[aq]t honored by default. .PP If, besides the\f[V]-ext honored\f[R] option, another named or OID \f[V]-ext\f[R] option is provided, this extension is added to those --> -------------------- --> maximum size reached --> -------------------- [ zur Elbe Produktseite wechseln0.335Quellennavigators ] |