We need to create an HTTP service that can create and return a certificate signed by a trusted parent certificate. Our initial plan was to use keytool in the bin directory of our jdk in a Servlet using Runtime.exec, but it seems the keytool commands require answers to prompts on the command line.
For example: keytool -genkey -alias mydomain -keyalg RSA -keystore keystore.jks -keysize 2048
asks a number of questions on the command line.
Our next idea was to use java.security.KeyStore, but I don't see a way to export and persist the store, we will want to keep all our certificates in a jks file. If the web container goes down we definitely need to be able to keep all the PKI artifacts.