The code signing certificates Sun uses are usually X.509/DER binary format, with the extension .cer. Sometimes they are in X.509/DER BASE64 encoded printable ASCII format, also with the extension .cer. These certificates don’t contain the private key. When certificates are stored in .keystore certificate collections, they do contain the private key.

Files

J:\Program Files\java\jdk1.6.0_06\jre\lib\security\ cacerts contains your authority certificates. Each certificate contains only a public key. There is only one cacerts file. It comes preloaded with the JRE/JDK with root signing authority certificates from Verisign and Thawte. It comes by default with password changeit.

Keystore Formats

Generating a Real Certificate

Make a backup of your \WINNT\Profiles\Administrator.keystore file. These have a habit of mysteriously corrupting themselves. If you lose it, you lose your private key, and your certificate will become worthless.

For a $200.00 USD fee, Thawte will sign your certificate request with their private key and send it back to you in either X.509/DER or preferably the more advanced PKCS #7 format which includes certificate chains. You then import that certificate into your .keystore file and you can then use it for signing your code. To import it you would use:

REM import purchased cert
keytool -import -alias pluginsigner -trustcacerts -file cert.cer

Note, you never tell the certificate authority your private key. The certificate request and the certificate they send back do not contain the private key and hence are useless to anyone who does not have access to your private key.

Generating a Phony Certificate

Since your clients have never heard of your miniature signing authority, you might try loading the phonycert.p7b into each browser who will use your code as if it were a signing authority. Even after you do that, your code still won’t work because Sun Plug-in looks in the policy and .keystore files on each client machine to decide if it will let code run. You must update all those client .keystore files with your cert so they will treat you just like a legitimate signing authority.

Creating .keystore

KeyStore ks = KeyStore.getInstance( "JCEKS", "SunJCE" );

Updating Root Certificates

Other Useful keytool Commands

If you screw up, you can start over by deleting your .keystore file, or by deleting the offending entries. Make sure you never delete the private key for one of your paid certificates though!

You can tell if a certificate includes a private key by the way keytool lists it. Signing certificates with private keys will be marked keyEntry. Authority certificates without private keys will be marked trustedCertEntry.

Keytool, however will not tell you if a certificate is DSA or RSA and how many bits it is. You can determine that with IBM’s keyman. It is best then to choose names of aliases and certificate files e.g. mindprod2006dsa.cer that will help you remember.

Exporting Private Keys

You must plan ahead and generate your private key in the .keystore where you want to it to finally reside. People not understanding the process so often lose the original private key, or find they can’t move it to where it is needed. This applies even more so to SSL certificates.

Understand the process!

• You generate a private key.
• You back it up inside the .keystore file.
• You export the corresponding public key to the certificate authority.
• They sign it with their private key and return it to you. (They never see your private key.)
• You import your signed public key back into your .keystore.
• Now the pair is ready for use, "forever" trapped in that .keystore file.

Passwords

There are also optional additional password protections on each individual item in the store. Passwords are case sensitive and must be at least 6 letters long. Best to include some digits to make them harder to guess. Putting punctuation in them will make it difficult to use them on the command line.

Here is how to change the password:

Backups

Learning More