OpenJDK 27 · sun.security.tools.keytool.CertAndKeyGen

Generate a pair of keys, and provide access to them. This class is provided primarily for ease of use.

This provides some simple certificate management functionality. Specifically, it allows you to create self-signed X.509 certificates as well as PKCS 10 based certificate signing requests.

Keys for some public key signature algorithms have algorithm parameters, such as DSS/DSA. Some sites' Certificate Authorities adopt fixed algorithm parameters, which speeds up some operations including key generation and signing. At this time, this interface supports initializing with a named group.

Also, note that at this time only signature-capable keys may be acquired through this interface. Diffie-Hellman keys, used for secure key exchange, may be supported later.

Field Summary

Modifier and Type	Field and Description
private KeyPairGenerator	keyGen
private final String	keyType
private PrivateKey	privateKey
private SecureRandom	prng
private PublicKey	publicKey
private String	sigAlg
private boolean	signerFlag
private PrivateKey	signerPrivateKey
private X500Name	signerSubjectName

Constructor Summary

Access	Constructor and Description
public	CertAndKeyGen(String type of key, e.g. "RSA", "DSA" keyType, String name of the signature algorithm, e.g. "MD5WithRSA", "MD2WithRSA", "SHAwithDSA". If set to null, a default algorithm matching the private key will be chosen after the first keypair is generated. sigAlg) Creates a CertAndKeyGen object for a particular key type and signature algorithm.
public	CertAndKeyGen(String keyType, String sigAlg, String providerName)
public	CertAndKeyGen(String type of key, e.g. "RSA", "DSA", "X25519", "DH", etc. keyType, String name of the signature algorithm, e.g. "SHA384WithRSA", "SHA256withDSA", etc. If set to null, a default algorithm matching the private key or signer's private key will be chosen after the first keypair is generated. sigAlg, String name of the provider providerName, PrivateKey (optional) signer's private key signerPrivateKey, X500Name (optional) signer's subject name signerSubjectName) Creates a CertAndKeyGen object for a particular key type, signature algorithm, and provider.

Method Summary

Modifier and Type	Method and Description
public void	generate(String name)
public void	generate(int keyBits)
private void	generateInternal() Generates a random public/private key pair.
public PrivateKey	getPrivateKey() Returns the private key of the generated key pair.
public X509Key	getPublicKey() Returns the public key of the generated key pair if it is of type `X509Key`, or null if the public key is of a different type.
public PublicKey	getPublicKeyAnyway() Always returns the public key of the generated key pair.
public X509Certificate	getSelfCertificate(X500Name X.500 name of the subject (who is also the issuer) myname, Date the issue time of the certificate firstDate, long how long the certificate should be valid, in seconds validity) Returns a self-signed X.509v3 certificate for the public key.
public X509Certificate	getSelfCertificate(X500Name myname, Date firstDate, long validity, CertificateExtensions ext)
public X509Certificate	getSelfCertificate(X500Name myname, long validity)
public void	setRandom(SecureRandom generator) Sets the source of random numbers used when generating keys.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

keyGen	back to summary
private KeyPairGenerator keyGen

keyType	back to summary
private final String keyType

privateKey	back to summary
private PrivateKey privateKey

prng	back to summary
private SecureRandom prng

publicKey	back to summary
private PublicKey publicKey

sigAlg	back to summary
private String sigAlg

signerFlag	back to summary
private boolean signerFlag

signerPrivateKey	back to summary
private PrivateKey signerPrivateKey

signerSubjectName	back to summary
private X500Name signerSubjectName

Constructor Detail

CertAndKeyGen	back to summary
public CertAndKeyGen(String keyType, String sigAlg) throws NoSuchAlgorithmException Creates a CertAndKeyGen object for a particular key type and signature algorithm. Parameters keyType:String type of key, e.g. "RSA", "DSA" sigAlg:String name of the signature algorithm, e.g. "MD5WithRSA", "MD2WithRSA", "SHAwithDSA". If set to null, a default algorithm matching the private key will be chosen after the first keypair is generated. Exceptions NoSuchAlgorithmException: on unrecognized algorithms.

CertAndKeyGen

back to summary

public CertAndKeyGen(String keyType, String sigAlg) throws NoSuchAlgorithmException

Creates a CertAndKeyGen object for a particular key type and signature algorithm.

Parameters

keyType:String: type of key, e.g. "RSA", "DSA"
sigAlg:String: name of the signature algorithm, e.g. "MD5WithRSA", "MD2WithRSA", "SHAwithDSA". If set to null, a default algorithm matching the private key will be chosen after the first keypair is generated.

Exceptions

NoSuchAlgorithmException:: on unrecognized algorithms.

CertAndKeyGen	back to summary
public CertAndKeyGen(String keyType, String sigAlg, String providerName) throws NoSuchAlgorithmException, NoSuchProviderException See Also `CertAndKeyGen(String, String, String, PrivateKey, X500Name)`

CertAndKeyGen	back to summary
public CertAndKeyGen(String keyType, String sigAlg, String providerName, PrivateKey signerPrivateKey, X500Name signerSubjectName) throws NoSuchAlgorithmException, NoSuchProviderException Creates a CertAndKeyGen object for a particular key type, signature algorithm, and provider. The newly generated cert will be signed by the signer's private key when it is provided. Parameters keyType:String type of key, e.g. "RSA", "DSA", "X25519", "DH", etc. sigAlg:String name of the signature algorithm, e.g. "SHA384WithRSA", "SHA256withDSA", etc. If set to null, a default algorithm matching the private key or signer's private key will be chosen after the first keypair is generated. providerName:String name of the provider signerPrivateKey:PrivateKey (optional) signer's private key signerSubjectName:X500Name (optional) signer's subject name Exceptions NoSuchAlgorithmException: on unrecognized algorithms. NoSuchProviderException: on unrecognized providers.

CertAndKeyGen

back to summary

public CertAndKeyGen(String keyType, String sigAlg, String providerName, PrivateKey signerPrivateKey, X500Name signerSubjectName) throws NoSuchAlgorithmException, NoSuchProviderException

Creates a CertAndKeyGen object for a particular key type, signature algorithm, and provider. The newly generated cert will be signed by the signer's private key when it is provided.

Parameters

keyType:String: type of key, e.g. "RSA", "DSA", "X25519", "DH", etc.
sigAlg:String: name of the signature algorithm, e.g. "SHA384WithRSA", "SHA256withDSA", etc. If set to null, a default algorithm matching the private key or signer's private key will be chosen after the first keypair is generated.
providerName:String: name of the provider
signerPrivateKey:PrivateKey: (optional) signer's private key
signerSubjectName:X500Name: (optional) signer's subject name

Exceptions

NoSuchAlgorithmException:: on unrecognized algorithms.
NoSuchProviderException:: on unrecognized providers.

Method Detail

generate	back to summary
public void generate(String name)

generate	back to summary
public void generate(int keyBits)

generateInternal	back to summary
private void generateInternal() Generates a random public/private key pair. Note that not all public key algorithms are currently supported for use in X.509 certificates. If the algorithm you specified does not produce X.509 compatible keys, an invalid key exception is thrown. Exceptions IllegalArgumentException: if the environment does not provide X.509 public keys for this signature algorithm.

generateInternal

back to summary

private void generateInternal()

Generates a random public/private key pair.

Note that not all public key algorithms are currently supported for use in X.509 certificates. If the algorithm you specified does not produce X.509 compatible keys, an invalid key exception is thrown.

Exceptions

IllegalArgumentException:: if the environment does not provide X.509 public keys for this signature algorithm.

getPrivateKey	back to summary
public PrivateKey getPrivateKey() Returns the private key of the generated key pair. *Be extremely careful when handling private keys. When private keys are not kept secret, they lose their ability to securely authenticate specific entities ... that is a huge security risk!*

getPrivateKey

back to summary

public PrivateKey getPrivateKey()

Returns the private key of the generated key pair.

Be extremely careful when handling private keys. When private keys are not kept secret, they lose their ability to securely authenticate specific entities ... that is a huge security risk!

getPublicKey back to summary

getPublicKey	back to summary
public X509Key getPublicKey() Returns the public key of the generated key pair if it is of type `X509Key`, or null if the public key is of a different type. XXX Note: This behaviour is needed for backwards compatibility. What this method really should return is the public key of the generated key pair, regardless of whether it is an instance of `X509Key`. Accordingly, the return type of this method should be `PublicKey`.

public X509Key getPublicKey()

Returns the public key of the generated key pair if it is of type X509Key, or null if the public key is of a different type. XXX Note: This behaviour is needed for backwards compatibility. What this method really should return is the public key of the generated key pair, regardless of whether it is an instance of X509Key. Accordingly, the return type of this method should be PublicKey.

getPublicKeyAnyway	back to summary
public PublicKey getPublicKeyAnyway() Always returns the public key of the generated key pair. Used by KeyTool only. The publicKey is not necessarily to be an instance of X509Key in some JCA/JCE providers, for example SunPKCS11.

getSelfCertificate	back to summary
public X509Certificate getSelfCertificate(X500Name myname, Date firstDate, long validity) throws CertificateException, InvalidKeyException, SignatureException, NoSuchAlgorithmException, NoSuchProviderException Returns a self-signed X.509v3 certificate for the public key. The certificate is immediately valid. No extensions. Such certificates normally are used to identify a "Certificate Authority" (CA). Accordingly, they will not always be accepted by other parties. However, such certificates are also useful when you are bootstrapping your security infrastructure, or deploying system prototypes. Parameters myname:X500Name X.500 name of the subject (who is also the issuer) firstDate:Date the issue time of the certificate validity:long how long the certificate should be valid, in seconds Exceptions CertificateException: on certificate handling errors. InvalidKeyException: on key handling errors. SignatureException: on signature handling errors. NoSuchAlgorithmException: on unrecognized algorithms. NoSuchProviderException: on unrecognized providers.

getSelfCertificate

back to summary

public X509Certificate getSelfCertificate(X500Name myname, Date firstDate, long validity) throws CertificateException, InvalidKeyException, SignatureException, NoSuchAlgorithmException, NoSuchProviderException

Returns a self-signed X.509v3 certificate for the public key. The certificate is immediately valid. No extensions.

Such certificates normally are used to identify a "Certificate Authority" (CA). Accordingly, they will not always be accepted by other parties. However, such certificates are also useful when you are bootstrapping your security infrastructure, or deploying system prototypes.

Parameters

myname:X500Name: X.500 name of the subject (who is also the issuer)
firstDate:Date: the issue time of the certificate
validity:long: how long the certificate should be valid, in seconds

Exceptions

CertificateException:: on certificate handling errors.
InvalidKeyException:: on key handling errors.
SignatureException:: on signature handling errors.
NoSuchAlgorithmException:: on unrecognized algorithms.
NoSuchProviderException:: on unrecognized providers.

getSelfCertificate	back to summary
public X509Certificate getSelfCertificate(X500Name myname, Date firstDate, long validity, CertificateExtensions ext) throws CertificateException, InvalidKeyException, SignatureException, NoSuchAlgorithmException, NoSuchProviderException

getSelfCertificate	back to summary
public X509Certificate getSelfCertificate(X500Name myname, long validity) throws CertificateException, InvalidKeyException, SignatureException, NoSuchAlgorithmException, NoSuchProviderException

setRandom	back to summary
public void setRandom(SecureRandom generator) Sets the source of random numbers used when generating keys. If you do not provide one, a system default facility is used. You may wish to provide your own source of random numbers to get a reproducible sequence of keys and signatures, or because you may be able to take advantage of strong sources of randomness/entropy in your environment.

public final Class CertAndKeyGen

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail