I have a problem with a Websphere keyset. I create a keystore using a public key that was generated on another computer with keytool using this command:
keytool -import -noprompt -alias eeccstore -keystore eeccstore.jks -file D:\Keys\eecc_public.key -storepass password
After that, in Websphere Server I create the KeyStore as follows in the next image:
Keystore usages: Key set keystores
Create keystore in Websphere Server
I use the same password that I use to create the KeyStore with Keytool.
Then I create the keySet in WebSphere Server as follows in the next image:
Create keyset in Websphere Server
In my java code I use the keyset as follows:
KeySetHelper ksh = KeySetHelper.getInstance();
KeyPair key = (KeyPair)ksh.getLatestKeyForKeySet("eeccKeySet");
And the console shows me this:
java.lang.NullPointerException
com.ibm.ws.crypto.config.WSKeySet.getLatestKey(WSKeySet.java:257)
com.ibm.websphere.crypto.KeySetHelper.getLatestKeyForKeySet
I understand that the server can not find any key in the KeySet but I don't know what I could be doing wrong.
Thank you in advance for your support.
Reggard!
After days of searching, I found a solution. Instead to access a KeySet, I access to KeyStore directly and get not the key, but the X509 certificate with wich can create the public key and use it to encrypt any text.
char [] passch = password.toCharArray();
com.ibm.crypto.provider.JavaKeyStore keystore = new JavaKeyStore();
keystore.engineLoad(new FileInputStream(new File(pathKeyFileJKS)), null);
KeyStore.TrustedCertificateEntry privKeyEntry = (TrustedCertificateEntry)
keystore.engineGetEntry("eecc-KeyStore", new KeyStore.PasswordProtection(passch));
X509CertImpl cert = (X509CertImpl) privKeyEntry.getTrustedCertificate();
cert.checkValidity();
PublicKey publicKey = cert.getPublicKey();
Where password variable contains the password that I use to create the eecc_public.key file, pathKeyFileJKS contains the path where create the jks file and "eecc-KeyStore" is the name that I use to create my keyStore in WebSphere Server.
Related
On Windows 10/11, I can either import a certificate to certmgr.msc and certlm.msc. If I understand this right, certmgr.msc stores the certificates and keys of the local user, while certlm.msc stores the certificates and keys of the local machine.
I can read certificates which were imported to certmgr.msc with a java application like this:
KeyStore keyStore;
keyStore = KeyStore.getInstance("Windows-MY");
keyStore.load(null, null);
KeyStore trustStore;
trustStore = KeyStore.getInstance("Windows-ROOT");
trustStore.load(null, null);
However this code snippet does not read the certificates and keys which I imported to certlm.msc. How can I do that?
I would need help about this exception that I don't understand...
and I don't even find anything on google about that.
*java.security.KeyStoreException] : [The supplied keystore is not configured correctly, it must contain the 'decryptionKey' alias and the 'signingKey' alias at com.entrust.toolkit.x509.jsse.d.<
What are these aliases ? Do you have idea of the reason why they are missing?
This is the line of code throwing the exception
CLIENT_KEYSTORE_PATH = full path of the "client certificate" pfx file.
CLIENT_KEYSTORE_PASS = password of the pfx file
KeyStore cks = KeyStore.getInstance("PKCS12");
cks.load(new FileInputStream(CLIENT_KEYSTORE_PATH), CLIENT_KEYSTORE_PASS.toCharArray());
SSLContext sslcontext = SSLContexts.custom().loadKeyMaterial(cks, CLIENT_KEYSTORE_PASS.toCharArray()).build();
Thank you for your help
Checkout the keytool command that comes bundeld with Java binaries.
You can find how to use it googling on line.
Don't miss the key store type option to specify PKCS12
Here there is a link to one place for example.
Error: "The keystore does not contain a private key associated with this alias"
Problem
When importing a Code Signing Certificate for Sun Java or Symantec SSL Certificate into a keystore, you receive the following error:
Error: "The keystore does not contain a private key associated with this alias"
Cause
This error occurs when one of the following conditions are true:
The certificate is being imported into the incorrect keystore.
The certificate is being imported into the incorrect alias.
Solution:
To resolve this problem:
Locate the correct Keystore. The keystore must be the same keystore
that was used to originally generate the Certificate Signing Request
(CSR). If a new keystore was generated with the same name and alias,
the hash will be different. Therefore, the certificate will still not
match the private key in the keystore.
Locate the correct alias. To verify the alias, run the following
command:
keytool -list -v -keystore [keystore name]
The correct alias will state Entry type: keyEntry
Once you have located the correct keystore and alias, run the following command to import the certificate:
keytool -import -trustcacerts -keystore [keystore_filename] -alias [alias_name] -file [cert_file]
Resource Link:
https://knowledge.symantec.com/support/code-signing-support/index?page=content&id=SO6863&pmv=print&actp=PRINT&viewlocale=en_US
I'm trying to set up a DTLS server on Android based on the example java files from Californium.Scandium. Initially I ran into issues because the keystore and truststore were in jks format and I did not have the key passwords. Hence, I created my own PKCS12 keystore and truststore using Portecle.
KeyStore keyStore = KeyStore.getInstance("PKCS12");
in = getResources().openRawResource(R.raw.keystore);
keyStore.load(in, KEY_STORE_PASSWORD.toCharArray());
KeyStore trustStore = KeyStore.getInstance("PKCS12");
inTrust = getResources().openRawResource(R.raw.truststore);
trustStore.load(inTrust, TRUST_STORE_PASSWORD.toCharArray());
After that, the code did not throw any errors during keystore loading but upon running the application I get this:
FATAL EXCEPTION: main
Process: com.example.admin.securesend, PID: 3402
java.lang.RuntimeException: Unable to start activity
ComponentInfo{com.example.admin.securesend/com.example.admin.securesend.DTLSServer}: java.lang.IllegalStateException: Keys must be ECDSA capable when support for an ECDHE_ECDSA based cipher suite is configured
Edit: I realised that my keys were created using SHA instead of ECDSA. I'm not very familiar with keystores and keys, so I'm assuming that my keystore is now valid and I just need to generate the appropriate keys for the system and plant them into the key. How do I create keys using ECDSA and transfer them into my keystore?
Ok, let's first get the terminology right:
RSA: That's the type of keys that you have created with portecle.
DSA: Another key type, very rarely used. Also a signature algorithm.
EC: Elliptic curve keys are what you want to generate.
ECDSA: A signature algorithm for EC keys.
SHA: A hashing algorithm, used to generate a hash value of the data to be signed.
For generating EC keys you can use keytool (with Java 7 or higher):
keytool -genkeypair -alias ec -keyalg EC -keysize 256 -sigalg SHA256withECDSA -validity 365 -storetype JKS -keystore ectest.jks -storepass 123456
This command generates a 256 bit EC key on a SEC curve (secp256r1) and a self signed certificate using ECDSA with SHA256.
If you prefer GUI tools, KeyStore Explorer is another way to generate EC keys:
so here's what I'm trying to do:
I connect to my SSL server
It sends me two certificates, and one of them is self-signed
At this stage, there are no problems, I've:
X509Certificate[] myTwoCerts;
// with 2 certificates in there, and I'm sure it's there because, I print them in my console.
Now I want to create .p12 file with 2 certificates inside.
Until now, I've tried something like this:
KeyStore pkcs12Store = KeyStore.getInstance("PKCS12");
pkcs12Store.load(null, null);
X509Certificate cert1 = myTwoCerts[0];
X509Certificate cert2 = myTwoCerts[1]
String alias1 = "FIRST";
String alias2 = "SECOND";
pkcs12Store.setCertificateEntry(alias1, cert2);
pkcs12Store.setCertificateEntry(alias2, cert2);
But I'm getting the following Exception:
Exception in thread "main" java.security.KeyStoreException: TrustedCertEntry not supported
Can anybody help me plz??
The PKCS12 keystore in Java cannot be used to store certificates or certificate chains without their private keys.
See this note in the JCA reference guide:
"pkcs12" is another option. This is a cross platform keystore based on the RSA PKCS12 Personal Information Exchange Syntax Standard. This standard is primarily meant for storing or transporting a user's private keys, certificates, and miscellaneous secrets. As of JDK 6, standards for storing Trusted Certificates in "pkcs12" have not been established yet, and thus "jks" or "jceks" should be used for trusted certificates.
(Despite mentioning JDK 6, this still is in the JDK 7 documentation.)
If you want to store a private key + certificate (chain) in a PKCS#12 store in Java, there needs to be a private key and you need to use the setKeyEntry method.
keytool -trustcacerts -keystore keystore.p12 -storetype pkcs12 -alias root -genkeypair
KeyStore pkcs12 = KeyStore.getInstance("PKCS12");
String filename = "/tmp/keystore.p12";
keyStore.load(
new FileInputStream(/*"myKeyStore.jks"*/filename),
password);
I'm having trouble issuing certificate to a hard token, What I have is a PKCS12 keystore I have created and want to move it to a hardtoken as a PKCS11.
I can successfully generate keys and certificate and save them in a p12 keystore and can import the p12 file to hardtoken using admin console of this device.
But when I try to do the final step programatically I have different result.
Imported p12 file using admin tool what I have in device is
-Serial number
-Signature and key exchange usage
Certificate
Private Key
Public key
Imported all steps programatically
-Serial number
-Signing &encryption
Certificate
Private Key
and the final result is that end user can't use the device for signing.
I'm using SunPKCS11.
Edit: Code used for importing the key:
KeyStore.PrivateKeyEntry priEntry =
new KeyStore.PrivateKeyEntry(keys.getPrivate(), certificateArray);
KeyStore.PasswordProtection password =
new KeyStore.PasswordProtection(pass.toCharArray());
store.setEntry("Entry", priEntry, password);
EDIT 2 keytool -list
The funny thing is that when I use the following command output is the very same
keytool -keystore NONE -storetype pkcs11 -list