keytool加解密工具使用笔记、jks等

最新推荐文章于 2025-10-23 09:41:26 发布

原创最新推荐文章于 2025-10-23 09:41:26 发布 · 232 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#笔记

文章目录

- keytool
- - - 生成jks文件
    - 查看jks文件
  - 修改jks文件 todo

keytool是jdk自带的加解密工具。

jks(java keyStore)是java密码库文件。

keytool

生成jks文件

keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -keystore mykeystore.jks -storepass changeit -validity 3650 -dname "CN=myname, OU=myunit, O=myorg, L=mycity, S=mystate, C=mycountry"

    -alias： 密钥的别名，对应 encrypt.key-store.alias 配置
    -keystore： 生成的密钥库文件名
    -storepass： 密钥库密码，对应 encrypt.key-store.password 配置
    -keypass： 私钥密码（与 storepass 一致时可不单独配置） ， 对应 encrypt.key-store.secret 配置
    -validity # 有效期
    -dname： 可填写任意组织信息 。 CN:名字与姓氏；OU：组织单位名称；O：组织名称；L：城市或区域名称；S：省/市/自治区名称；C：双字母国家/地区代码

查看jks文件

keytool -v -list -keystore mykeystore.jks -storepass changeit

正常输出效果：

keytool -v -list -keystore mykeystore.jks -storepass changeit
Keystore type: jks
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: mykey
Creation date: Sep 15, 2025
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=myname, OU=myunit, O=myorg, L=mycity, ST=mystate, C=mycountry
Issuer: CN=myname, OU=myunit, O=myorg, L=mycity, ST=mystate, C=mycountry
Serial number: 54adfdcf
Valid from: Mon Sep 15 15:09:12 CST 2025 until: Thu Sep 13 15:09:12 CST 2035
Certificate fingerprints:
         MD5:  57:15:6A:25:13:1F:EF:55:08:9E:A6:8E:24:26:18:61
         SHA1: DF:39:FF:19:42:91:DB:89:C5:63:74:AE:77:1B:49:1D:6A:58:EB:3D
         SHA256: CD:2B:DD:AA:07:FF:44:10:8D:A2:26:1A:8A:CC:1C:A6:58:F8:0B:DA:03:E6:24:FE:31:C4:6D:04:13:C4:A6:8B
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 83 6F D5 F0 69 F5 21 FB   2F A2 E9 1D AD 54 9C 7A  .o..i.!./....T.z
0010: 35 58 67 EF                                        5Xg.
]
]



*******************************************
*******************************************



Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore mykeystore.jks -destkeystore mykeystore.jks -deststoretype pkcs12".

如果密码不对，会报错：

keytool -v -list -keystore mykeystore.jks -storepass changeit2
keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect
java.io.IOException: Keystore was tampered with, or password was incorrect
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:783)
        at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56)
        at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224)
        at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70)
        at java.security.KeyStore.load(KeyStore.java:1445)
        at sun.security.tools.keytool.Main.doCommands(Main.java:823)
        at sun.security.tools.keytool.Main.run(Main.java:366)
        at sun.security.tools.keytool.Main.main(Main.java:359)
Caused by: java.security.UnrecoverableKeyException: Password verification failed
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:781)
        ... 7 more