keytool - see the public and private keys

Question

I created Java keystore programmatically of type jks (i.e. default type).
It is initially empty so I created a DSA certificate.

keytool -genkey -alias myCert -v -keystore trivial.keystore

How can I see the public and private keys?
I.e. is there a command that prints the private key of my certificate?
I could only find keytool -certreq which in my understanding prints the certificate as a whole:

-----BEGIN NEW CERTIFICATE REQUEST-----
MIICaTCCAicCAQAwZTELMAkGA1UEBhMCR1IxDzANBgNVBAgTBkdyZWVjZTEPMA0GA1UEBxMGQXRo
BQADLwAwLAIUQZbY/3Qq0G26fsBbWiHMbuVd3VICFE+gwtUauYiRbHh0caAtRj3qRTwl
-----END NEW CERTIFICATE REQUEST-----

I assume this is the whole certificate. How can I see private (or public key) via keytool?

score 8 · Answer 1 · answered Feb 05 '11 at 15:20

No, you cannot.
You can access the private key from code, but you cannot export it using the keytool.
Use OpenSSL if you need to export private key.

Another option: you can generate keystore in PKCS12 format. Then you can import it to a browser and then to export the private key.

score 8 · Accepted Answer · edited May 20 '16 at 21:40

You created a private (and associated public) key in your keystore. For it to be really usable, you can get it signed by a certification agency (CA) - for this is the -certreq command (you send the output to this certification agency, along with some other information and a bit of money, and they send back a certificate, which you can then import in your keystore.)

Viewing the private key is not intended ... you usually don't need this, since you use the keystore in your Java program, and this knows how to use it.

Edit: Since you want to look at your keystore, here a quick Java program which does this:

import java.io.*;
import java.security.*;
import java.security.cert.Certificate;

public class KeyPrinter {

    /**
     * to be invoked with these parameters:
     * 
     * [0]:  keystore-password
     * [1]:  filename
     * [2]:  alias
     * [3]:  entry-Password (if necessary)
     */
    public static void main(String[] params)
        throws IOException, GeneralSecurityException
    {
        char[] storePass = params[0].toCharArray();
        String fileName = params[1];
        String alias = params[2];
        KeyStore.ProtectionParameter entryPass;
        if(params.length > 3) {
        entryPass=new KeyStore.PasswordProtection(params[3].toCharArray());
        } else {
            entryPass = null;
        }

        KeyStore store = KeyStore.getInstance("JKS");
        InputStream input = new FileInputStream(fileName);
        store.load(input, storePass);

        KeyStore.Entry entry = store.getEntry(alias, entryPass);
        System.out.println(entry);

    }
}

First call keytool -list -keystore myStore to know which alias to look for, then call this program with the passwords and parameters. In case of a private key entry, it shows the key itself and additionally a self-signed certificate which contains the public key, in a readable form. In case of a "trusted certificate", it shows only the public key.

Ok, so viewing private key is not intented.What about public key?Is there a command to display public key? — Cratylus, Feb 05 '11 at 17:17
I just added a simple java class for viewing the keystore. (It was quite a bit more complicated, I even tried to format the key myself ... until I had the idea to try the `toString()` method.) — Paŭlo Ebermann, Feb 05 '11 at 23:21
@MircoWidmer – thanks for your [edit suggestion](http://stackoverflow.com/review/suggested-edits/11463131). I have no idea why people rejected it (the mentioned reasons certainly are not valid) when you were simply fixing a typo. I fixed it now. — Paŭlo Ebermann, Mar 01 '16 at 20:24
This is pretty cool, but iam not able to work with jceks, i know i can convert it just wondering if possible. — Chop Labalagun, Nov 21 '19 at 17:14

score 3 · Answer 3 · answered Aug 26 '17 at 01:36

3

keytool -list -v -alias myCert -storepass 123456 -keystore file.jks

or

keytool -list -rfc -alias myCert -storepass 123456 -keystore file.jks

as noted in

keytool -help

answered Aug 26 '17 at 01:36

user1133275

2,642
27
31

5

The command only lists public key. Private key is not accessible via keytool – emily Sep 15 '18 at 04:24
To get the private key in PEM format: openssl pkcs12 -in -nocerts -nodes – user2802945 Aug 21 '19 at 02:00

score 3 · Answer 4 · answered Feb 05 '11 at 21:41

(Portecle) is a very convenient GUI tool for managing keystores. And among other things it have an option to export private key and its associated certificate.

The common way to share your public key is to share a certificate for your keypair (it contains your public key inside)

score 1 · Answer 5 · answered Jan 17 '19 at 08:20

1

You can use keystore-explorer.

answered Jan 17 '19 at 08:20

deathangel908

8,601
8
47
81

keytool - see the public and private keys

5 Answers5

Linked