If a code signer does not yet have a suitable private key for
signing the code, the key must first be generated, along with a
corresponding public key that can be used by the
code receiver's runtime system to verify the signature.
This lesson assumes you don't yet have such keys.
You are going to create a keystore named susanstore and
create an entry with a newly-generated public/private key pair
(with the public key in a certificate).
Now, pretend you are Susan Jones and you
work for the Purchasing department of company "ABC".
In your command window, type the following command to create a
keystore named susanstore and
generate keys for Susan Jones:
keytool -genkey -alias signFiles -keypass kpi135
-keystore susanstore -storepass ab987c
(Please note: This must be typed as a single line. Multiple lines
are used in the example just for legibility purposes.)
keytool Command Subparts
Before we discuss the "distinguished name" information you will be prompted
for, let's look at what each of the above keytool subparts mean:
- -genkey is the command for generating keys.
- -alias signFiles indicates the alias to be used in the future to refer to the
keystore entry containing the keys that will be generated.
- -keypass kpi135 specifies a password for the private key about to be
generated. This password will always need to be used in order to access the
keystore entry containing that key. Note: the entry doesn't have to have its
own password; if you don't include a -keypass option, you will be
prompted for
the key password and given the option of letting it be the same as the keystore
password.
- -keystore susanstore indicates the name (and optionally path)
of the keystore you are creating
(if a keystore by this name doesn't yet exist) or using (if it already exists).
- -storepass ab987c indicates the keystore password;
if you don't include a
-storepass option, you will be prompted
for the keystore password.
Note: For security reasons you actually should not supply your
(key or keystore) passwords on the command line, because they can be
intercepted more easily that way. Instead, you should
leave off the -keypass and -storepass
options and type your passwords when you are prompted for them.
Distinguished Name Information
If you use the above command, you will be prompted for your
"distinguished name" information.
Below are shown the prompts,
along with what you should type (which is indicated in bold):
What is your first and last name?
[Unknown]: Susan Jones
What is the name of your organizational unit?
[Unknown]: Purchasing
What is the name of your organization?
[Unknown]: ABC
What is the name of your City or Locality?
[Unknown]: Cupertino
What is the name of your State or Province?
[Unknown]: CA
What is the two-letter country code for this unit?
[Unknown]: US
Is correct?
[no]: y
Command Results
The above keytool command creates the keystore named susanstore
(if it doesn't already exist) in the
same directory in which the command is executed, and assigns it the password
"ab987c".
It generates a public/private key pair for the entity whose "distinguished
name" has a
common name of "Susan Jones", organizational unit of "Purchasing", etc.
It creates a self-signed certificate that includes the public key and
the distinguished name information. (The distinguised name you supply will be used as the "subject" field in the certificate.)
This certificate will be valid
for 90 days, which is the default validity period if you don't specify a
-validity option. The certificate is associated
with the private key in a keystore entry referred to by the
alias "signFiles". The private key is assigned the password "kpi135".
Note: The command could be shorter if option defaults
are accepted and/or you wish to be prompted for various values.
Whenever you execute a keytool command, defaults are used for
unspecified options that have default values, and you are prompted for any
required values. For the genkey command, options with default
values include alias (whose default is "mykey"), validity (90 days), and
keystore (the file named .keystore in your home directory).
Required values include dname, storepass, and keypass.
