Solved

How to extract a private key cert from a nks (command line, instead of GUI)

Posted on 2014-04-13
6
630 Views
Last Modified: 2014-04-15
I perform the following command from an exercise:

 keytool -genkey -alias First_Java_Cert -keyalg RSA -keystore /home/first/keystore/keystore.jks -storepass passw0rd -dname "CN=first, O=IBM, C=GB" -keypass passw0rd

So I just created a certificate with both a private and public key using the keytool.

Now I perform the following:

 keytool -export -keystore /home/first/keystore/keystore.jks -storepass passw0rd -alias First_Java_Cert -file /home/import/First_Java_Cert.cer

This extracts a certificate with a public key.

(Am I correct in my assumptions so far?)

So using a command line program (non-GUI) that would come with either Windows or Java, could someone please post how to extract a private key from the .jks

Thanks
0
Comment
Question by:Anthony Lucia
  • 4
  • 2
6 Comments
 
LVL 28

Accepted Solution

by:
becraig earned 500 total points
ID: 39997952
Ok so here are some steps:
first you want to convert the jks to pkcs or p12 / pfx
keytool -importkeystore -srckeystore "C:\certs\test.jks" -srcstoretype JKS -srcstorepass SomePassword -destkeystore "C:\certs\test.pfx" -deststoretype PKCS12 -deststorepass SomePassword

Then use openssl to export the private key:
Public key Export
One being the public key which you can export with the command:
openssl.exe pkcs12 -in C:\certs\test.pfx -clcerts -nokeys -out publicCert.pem

The next one being the private key which you get with the following command:
Private key Export
>>openssl.exe pkcs12 -in C:\certs\test.pfx -nocerts -out privateKey.pem
0
 

Author Comment

by:Anthony Lucia
ID: 39997975
In this example it says

Private key Export
>>openssl.exe pkcs12 -in C:\certs\test.pfx -nocerts -out privateKey.pem 

Open in new window


Regarding the option -nocerts, Does this mean that a private key does not have a certificate  (Does the above command not extract a cert)

Also stated:

Public key Export
One being the public key which you can export with the command:
openssl.exe pkcs12 -in C:\certs\test.pfx -clcerts -nokeys -out publicCert.pem

Open in new window


Regarding the option -nokeys, why does it say -nokeys, when you are clearly exporting a public key ?
0
 
LVL 28

Assisted Solution

by:becraig
becraig earned 500 total points
ID: 39997990
The language may seem misleading
Nocerts: outputs only private key
No keys: outputs only the certificates does not output private key

More info on open ssl  commands.
http://wiki.openssl.org/index.php/Command_Line_Utilities
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 28

Assisted Solution

by:becraig
becraig earned 500 total points
ID: 39999310
Let me know if this resolves the question for you.
0
 

Author Comment

by:Anthony Lucia
ID: 39999768
So if I use nocerts, it will output ONLY the private key, without an encompassing certificate ?
0
 
LVL 28

Assisted Solution

by:becraig
becraig earned 500 total points
ID: 39999829
Exactly you will be outputting only the private key.

As you notice the command is outputting the private key to a .pem / .key file.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Many companies are looking to get out of the datacenter business and to services like Microsoft Azure to provide Infrastructure as a Service (IaaS) solutions for legacy client server workloads, rather than continuing to make capital investments in h…
It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now