OpenJDK 27 · sun.security.tools.keytool.Main · APIdia, the JavaDoc alternative

Modifier and Type	Class and Description
pack-priv static enum	Main.Command
private static class	Main.ExitException
pack-priv static enum	Main.Option
private static class	Main.SecretKeyConstraintsParameters

Field Summary

Modifier and Type	Field and Description
private String	alias
private boolean	cacerts
private KeyStore	caks
private static final Collator	collator
private Main.Command	command
private static final byte[]	CRLF
private boolean	debug
private String	dest
private char[]	destKeyPass
private static final DisabledAlgorithmConstraints	DISABLED_CHECK
private String	dname
private static final String[]	extSupported
private String	filename
private String	groupName
private final List<String>	ids
private String	infilename
private String	inplaceBackupName
private boolean	inplaceImport
private boolean	isPasswordlessKeyStore
private String	jarfile
private String	keyAlgName
private static final String	keyAlias
private char[]	keyPass
private char[]	keyPassNew
private int	keysize
private KeyStore	keyStore
private File	ksfile
private String	ksfname
private boolean	kssave
private InputStream	ksStream
private static final DisabledAlgorithmConstraints	LEGACY_CHECK
private char[]	newPass
private static final String	NONE
private boolean	noprompt
private boolean	nowarn
private boolean	nullStream
private String	outfilename
private static final String	P11KEYSTORE
private static final String	P12KEYSTORE
private final Set<char[]>	passwords
private String	pathlist
private boolean	protectedPath
private Set<Pair<String, String>>	providerClasses
private String	providerName
private Set<Pair<String, String>>	providers
private static final ResourceBundle	rb
private boolean	rfc
private static final Set<CryptoPrimitive>	SIG_PRIMITIVE_SET
private String	sigAlgName
private String	signerAlias
private char[]	signerKeyPass
private char[]	srckeyPass
private String	srcksfname
private boolean	srcprotectedPath
private String	srcProviderName
private char[]	srcstorePass
private String	srcstoretype
private String	sslserver
private String	startDate
private char[]	storePass
private char[]	storePassNew
private String	storetype
private boolean	tlsInfo
private boolean	token
private boolean	trustcacerts
private final Set<X509Certificate>	trustedCerts
private final List<String>	v3ext
private long	validity
private boolean	verbose
private final List<String>	weakWarnings

Access	Constructor and Description
public	Main()

Method Summary

Modifier and Type	Method and Description
private boolean	Returns: true if the certificate was added, otherwise false. addTrustedCert(String alias, InputStream in) Imports a certificate and adds it to the list of trusted certificates.
private CertPathConstraintsParameters	buildCertPathConstraint(X509Certificate xcert, TrustAnchor anchor)
private boolean	Returns: true if successful, false otherwise. buildChain(Pair<String, X509Certificate> the cert that needs to be verified. certToVerify, Vector<Pair<String, X509Certificate>> the chain that's being built. chain, Hashtable<Principal, Vector<Pair<String, X509Certificate>>> the pool of trusted certs certs) Recursively tries to establish chain from pool of certs starting from certToVerify until a self-signed cert is found, and fill the certs found into chain.
private KeyStore	buildTrustedCerts()
private void	checkWeak(String label, String sigAlg, Key key)
private void	checkWeak(String label, CRL crl, Key key)
private void	checkWeakConstraint(String label, String sigAlg, Key key, CertPathConstraintsParameters cpcp)
private void	checkWeakConstraint(String label, Certificate[] certs)
private void	checkWeakConstraint(String label, Certificate cert, CertPathConstraintsParameters cpcp)
private void	checkWeakConstraint(String label, SecretKey secKey, Main.SecretKeyConstraintsParameters skcp)
private void	checkWeakConstraint(String label, PKCS10 p10, CertPathConstraintsParameters cpcp)
private void	checkWeakConstraint(String label, CRL crl, Key key, CertPathConstraintsParameters cpcp)
private void	checkWeakConstraint(String label, String keyAlg, Main.SecretKeyConstraintsParameters skcp)
private X509Certificate[]	convertCerts(Certificate[] certs)
private GeneralName	Returns: which one createGeneralName(String one of 5 known types t, String value v, int X.509 extension type exttype) Create a GeneralName object from known types
private CertificateExtensions	Returns: the created CertificateExtensions createV3Extensions(CertificateExtensions the requested extensions, can be null, used for -gencert requestedEx, CertificateExtensions the original extensions, can be null, used for -selfcert existingEx, List<String> -ext values, Read keytool doc extstrs, PublicKey the public key for the certificate pkey, KeyIdentifier the subject key identifier for the authority (issuer) aSubjectKeyId) Create X509v3 extensions from a string representation.
private void	doCertReq(String alias, String sigAlgName, PrintStream out) Creates a PKCS#10 cert signing request, corresponding to the keys (and name) associated with a given alias.
private void	doChangeKeyPasswd(String alias) Changes a key password.
private void	doChangeStorePasswd()
private void	doCloneEntry(String original alias orig, String destination alias dest, boolean if the password can be changed changePassword) Clones an entry
pack-priv void	doCommands(PrintStream out) Execute the commands.
private void	doDeleteEntry(String alias) Deletes an entry from the keystore.
private void	doExportCert(String alias, PrintStream out) Exports a certificate from the keystore.
private void	doGenCert(String alias, String sigAlgName, InputStream in, PrintStream out) Generate a certificate: Read PKCS10 request from in, and print certificate to out.
private void	doGenCRL(PrintStream out)
private void	doGenKeyPair(String alias, String dname, String keyAlgName, int keysize, String groupName, String sigAlgName, String signerAlias) Creates a new key pair and self-signed certificate.
private void	doGenSecretKey(String alias, String keyAlgName, int keysize) Creates a new secret key.
private void	doImportIdentityDatabase(InputStream in) Imports a JDK 1.1-style identity database.
private void	doImportKeyStore(KeyStore srcKS) import all keys and certs from importkeystore.
private void	doImportKeyStoreAll(KeyStore srckeystore)
private int	Returns: 1 if the import action succeed 0 if user choose to ignore an alias-dumplicated entry 2 if setEntry throws Exception doImportKeyStoreSingle(KeyStore srckeystore, String alias) Import a single entry named alias from srckeystore
private void	doPrintCert(final PrintStream out)
private void	doPrintCertReq(InputStream in, PrintStream out)
private void	doPrintCRL(String src, PrintStream out)
private void	doPrintEntries(PrintStream out) Prints all keystore entries.
private void	doPrintEntry(String alias, PrintStream out) Prints a single keystore entry.
private void	doPrintVersion()
private void	doSelfCert(String alias, String dname, String sigAlgName) Creates a self-signed certificate, and stores it as a single-element certificate chain.
private void	doShowInfo()
private static String	dotToNull(String input)
private void	dumpCert(Certificate cert, PrintStream out) Writes an X.509 certificate in base64 or binary encoding to an output stream.
private String	ecGroupNameForSize(int size)
private void	errorNeedArgument(String flag)
private Certificate[]	Returns: the established chain, might be null if user decides not establishCertChain(Certificate optional existing certificate, mostly likely be the original self-signed cert created by -genkeypair. It must have the same public key as certToVerify but cannot be the same cert. userCert, Certificate the starting certificate to build the chain certToVerify) Establishes a certificate chain (using trusted certificates in the keystore and cacerts), starting with the reply (certToVerify) and ending at a self-signed certificate found in the keystore.
private ObjectIdentifier	findOidForExtName(String type)
private TrustAnchor	findTrustAnchor(List<X509Certificate> chain)
private static String	Returns: the full name fullDisplayKeyName(Key the key object, cannot be null key) Returns the full display name of the given key object.
private Certificate	generateCertificate(InputStream in)
private Collection<? extends Certificate>	generateCertificates(InputStream in)
private String	Returns: the string entered by the user, without the \n at the end getAlias(String the {0} of "Enter {0} alias name: " in prompt line prompt) Prompts user for alias name.
private String	getCertFingerPrint(String mdAlg, Certificate cert) Gets the requested fingerprint of the certificate.
private static String	getCompatibleSigAlgName(PrivateKey key) If no signature algorithm was specified at the command line, we choose one that is compatible with the selected private key
private char[]	getKeyPasswd(String alias, String otherAlias, char[] otherKeyPass) Prompts user for key password.
private Date	getLastDate(Date firstDate, long validity)
private char[]	getNewPasswd(String the message that gets prompted on the screen prompt, char[] the current (i.e., old) password oldPasswd) Prompts user for new password.
private char[]	getPass(String modifier, String arg)
private static Pair<String, Certificate>	Returns: `cert` itself if it's already inside `ks`, or a certificate inside `ks` who signs `cert`, or null otherwise. A label is added. getSigner(Certificate the certificate whose signer is searched, not null cert, KeyStore the keystore to search with, not null ks) Locates a signer for a given certificate from a given keystore and returns the signer's certificate.
private static Date	getStartDate(String the value of -startdate option s) Returns the issue time that's specified the -startdate option
private X500Name	getX500Name() Gets an X.500 name suitable for inclusion in a certification request.
private String	Returns: the user's decision, can only be "YES" or "NO" getYesNoReply(String prompt) Prompts user for yes/no decision.
pack-priv boolean	inplaceImportCheck()
private String	inputString(BufferedReader in, String prompt, String defaultValue)
private String	Returns: the string entered by the user, without the \n at the end inputStringFromStdin(String the prompt string printed prompt) Prompts user for an input string from the command line (System.in)
private boolean	Returns: true if the certificate reply was installed, otherwise false. installReply(String alias, InputStream in) Processes a certificate reply from a certificate authority.
pack-priv boolean	isKeyStoreRelated(Main.Command cmd)
private boolean	isTrustedCert(Certificate cert)
private void	keystorecerts2Hashtable(KeyStore ks, Hashtable<Principal, Vector<Pair<String, X509Certificate>>> hash) Stores the (leaf) certificates of a keystore in a hashtable.
public static Collection<? extends CRL>	loadCRLs(String the source, which means System.in if null, or a URI, or a bare file path name src) Loads CRLs from a source.
pack-priv KeyStore	Returns: the src KeyStore loadSourceKeyStore() Load the srckeystore from a stream, used in -importkeystore
public static void	main(String[] args)
private static String	oneInMany(String label, int i, int num)
private static String	oneInManys(String label, int certNo, int certCnt, int signerNo, int signerCnt)
private static int	Returns: the position of a single match, or -1 if none matched oneOf(String the command provided by user s, KnownOIDs... the legal command set represented by KnownOIDs enums. list) Match a command with a command set.
private static int	Returns: the position of a single match, or -1 if none matched oneOf(String the command provided by user s, String... the legal command set. If there is a null, commands after it are regarded experimental, which means they are supported but their existence should not be revealed to user. list) Match a command with a command set.
private static int	Returns: the position of a single match, or -1 if none matched oneOfMatch(BiFunction<String, String, Boolean> a BiFunction which returns `true` if the 1st argument (user input) matches the 2nd one (full command) matcher, String the command provided by user s, String... the legal command set list) Match a command with a command set.
pack-priv String[]	parseArgs(String[] args) Parse command line arguments.
private void	printCertFromStream(InputStream in, PrintStream out) Reads a certificate (or certificate chain) and prints its contents in a human-readable format.
private void	printCRL(CRL crl, PrintStream out)
private static void	printExtensions(String title, CertificateExtensions exts, PrintStream out)
private void	printNoIntegrityWarning() Prints warning about missing integrity check.
private void	printWeakWarnings(boolean newLine)
private void	printX509Cert(X509Certificate cert, PrintStream out) Prints a certificate in a human-readable format.
private char[]	promptForCredential()
private char[]	promptForKeyPass(String the entry we will set password for alias, String the original entry of doing a dup, null if generate new orig, char[] the password to copy from if user press ENTER origPass) Prompt the user for a keypass when generating a key entry.
public static List<CRL>	readCRLsFromCert(X509Certificate cert) Returns CRLs described in a X509Certificate's CRLDistributionPoints Extension.
private Pair<KeyStore.Entry, char[]>	Returns: an array of objects, where the 1st element in the array is the recovered entry, and the 2nd element is the password used to recover it (null if no password). recoverEntry(KeyStore ks, String alias, char[] pstore, char[] pkey) Recovers entry associated with given alias.
private Pair<Key, char[]>	Returns: an array of objects, where the 1st element in the array is the recovered private key, and the 2nd element is the password used to recover it. recoverKey(String alias, char[] storePass, char[] keyPass) Recovers (private) key associated with given alias.
public int	run(String[] args, PrintStream out)
private static void	setExt(CertificateExtensions result, Extension ex)
private static BufferedReader	stdinAwareReader(InputStream in)
private void	tinyHelp()
private void	usage() Prints the usage of this tool.
private Certificate[]	validateReply(String the alias name alias, Certificate the user certificate of the alias userCert, Certificate[] the chain provided in the reply replyCerts) Validates chain in certification reply, and returns the ordered elements of the chain (with user certificate first, and root certificate last in the array).
private static String	verifyCRL(KeyStore ks, CRL crl)
private String	withWeak(String alg)
private String	withWeakConstraint(String alg, CertPathConstraintsParameters cpcp)
private String	withWeakConstraint(Key key, CertPathConstraintsParameters cpcp)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

public final Class Main

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary