We Keep Coding

Websphere keyset not get the latest key

I have a problem with a Websphere keyset. I create a keystore using a public key that was generated on another computer with keytool using this command:
keytool -import -noprompt -alias eeccstore -keystore eeccstore.jks -file D:\Keys\eecc_public.key -storepass password
After that, in Websphere Server I create the KeyStore as follows in the next image:
Keystore usages: Key set keystores
Create keystore in Websphere Server
I use the same password that I use to create the KeyStore with Keytool.
Then I create the keySet in WebSphere Server as follows in the next image:
Create keyset in Websphere Server
In my java code I use the keyset as follows:
KeySetHelper ksh = KeySetHelper.getInstance();
KeyPair key = (KeyPair)ksh.getLatestKeyForKeySet("eeccKeySet");
And the console shows me this:
java.lang.NullPointerException
com.ibm.ws.crypto.config.WSKeySet.getLatestKey(WSKeySet.java:257)
com.ibm.websphere.crypto.KeySetHelper.getLatestKeyForKeySet
I understand that the server can not find any key in the KeySet but I don't know what I could be doing wrong.
Thank you in advance for your support.
Reggard!

After days of searching, I found a solution. Instead to access a KeySet, I access to KeyStore directly and get not the key, but the X509 certificate with wich can create the public key and use it to encrypt any text.
char [] passch = password.toCharArray();
com.ibm.crypto.provider.JavaKeyStore keystore = new JavaKeyStore();
keystore.engineLoad(new FileInputStream(new File(pathKeyFileJKS)), null);
KeyStore.TrustedCertificateEntry privKeyEntry = (TrustedCertificateEntry)
keystore.engineGetEntry("eecc-KeyStore", new KeyStore.PasswordProtection(passch));
X509CertImpl cert = (X509CertImpl) privKeyEntry.getTrustedCertificate();
cert.checkValidity();
PublicKey publicKey = cert.getPublicKey();
Where password variable contains the password that I use to create the eecc_public.key file, pathKeyFileJKS contains the path where create the jks file and "eecc-KeyStore" is the name that I use to create my keyStore in WebSphere Server.

Java Keystore : missing decryptionKey and signingKey aliases

I would need help about this exception that I don't understand...
and I don't even find anything on google about that.
*java.security.KeyStoreException] : [The supplied keystore is not configured correctly, it must contain the 'decryptionKey' alias and the 'signingKey' alias at com.entrust.toolkit.x509.jsse.d.&lt
What are these aliases ? Do you have idea of the reason why they are missing?
This is the line of code throwing the exception
CLIENT_KEYSTORE_PATH = full path of the "client certificate" pfx file.
CLIENT_KEYSTORE_PASS = password of the pfx file
KeyStore cks = KeyStore.getInstance("PKCS12");
cks.load(new FileInputStream(CLIENT_KEYSTORE_PATH), CLIENT_KEYSTORE_PASS.toCharArray());
SSLContext sslcontext = SSLContexts.custom().loadKeyMaterial(cks, CLIENT_KEYSTORE_PASS.toCharArray()).build();
Thank you for your help

Checkout the keytool command that comes bundeld with Java binaries.
You can find how to use it googling on line.
Don't miss the key store type option to specify PKCS12
Here there is a link to one place for example.

Error: "The keystore does not contain a private key associated with this alias"
Problem
When importing a Code Signing Certificate for Sun Java or Symantec SSL Certificate into a keystore, you receive the following error:
Error: "The keystore does not contain a private key associated with this alias"
Cause
This error occurs when one of the following conditions are true:
The certificate is being imported into the incorrect keystore.
The certificate is being imported into the incorrect alias.
Solution:
To resolve this problem:
Locate the correct Keystore. The keystore must be the same keystore
that was used to originally generate the Certificate Signing Request
(CSR). If a new keystore was generated with the same name and alias,
the hash will be different. Therefore, the certificate will still not
match the private key in the keystore.
Locate the correct alias. To verify the alias, run the following
command:
keytool -list -v -keystore [keystore name]
The correct alias will state Entry type: keyEntry
Once you have located the correct keystore and alias, run the following command to import the certificate:
keytool -import -trustcacerts -keystore [keystore_filename] -alias [alias_name] -file [cert_file]
Resource Link:
https://knowledge.symantec.com/support/code-signing-support/index?page=content&id=SO6863&pmv=print&actp=PRINT&viewlocale=en_US

keytool: import certificate chain from several .cer files

Our IT dept gave me 4 .cer files, that constitute certificate chain: thawte_root.cer->intermediate1_pem.cer->intermediate2_pem.cer->our_company.cer.
I need to sign some code (via jarsigner) using our_company.cer.
Therefore, I have to create a keystore, containing our_company.cer and the chain-to-the-root.
I've tried to simply concatenate these 4 files into one using notepad and then import the resulting file, but keystore imports only the first one and when I try to launch jarsigner, I get
"jarsigner: Certificate chain not found for: our_company. our_company must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain."
I get the same message when I import only our_company.cer or when I import each certificate one-by-one.
So the question is: how can I import 4 certificates as one chain?
Thanks in advance. Vitaly.

Chain all certificates into one file (order is sub to root)
cat intermediate2_pem.cer intermediate1_pem.cer thawte_root.cer > chain.cer
Run this openssl command
openssl pkcs12 -export -in our_company.cer -inkey private.key -out company.p12 -name company -CAfile chain.pem -caname sub2 -caname sub1 -caname root -chain
Create keystore
keytool -importkeystore -destkeystore company.keystore -srckeystore company.p12 -srcstoretype PKCS12 -alias company
Your keystore will be ready (pick a password and type it in for all circumstances). You will also need to have your private.key ready.
See this link for more detailed information.

As you probably know, code signing works using public-key encryption. To sign code you need to have a private key, and clients wanting to use your code must trust the corresponding public key.
The CER files that you have are certificate files corresponding to the public keys. When you import them with keytool -importcert without the corresponding private keys, they are imported as trusted certificates. (See the documentation for more details. Depending on your system setup, you probably don't need to import them all - you probably already trust the Thawte certificate, for example.)
Since you want to sign code as YourCompany, you will need the private key corresponding to our_company.cer - I suppose your IT department can provide this, since it will have been used to generate the Certificate Signing Request sent to Thawte. If they are not willing to pass this on to you you will need to generate your own private/public key pair using keytool -genkeypair, generate a CSR with keytool -certreq and send it to your IT department who can then issue you a certificate. The final chain of trust in this case would be thawte_root.cer->intermediate1_pem.cer->intermediate2_pem.cer->our_company.cer->your_department.cer

Create PKCS12 certificate in JAVA

so here's what I'm trying to do:
I connect to my SSL server
It sends me two certificates, and one of them is self-signed
At this stage, there are no problems, I've:
X509Certificate[] myTwoCerts;
// with 2 certificates in there, and I'm sure it's there because, I print them in my console.
Now I want to create .p12 file with 2 certificates inside.
Until now, I've tried something like this:
KeyStore pkcs12Store = KeyStore.getInstance("PKCS12");
pkcs12Store.load(null, null);
X509Certificate cert1 = myTwoCerts[0];
X509Certificate cert2 = myTwoCerts[1]
String alias1 = "FIRST";
String alias2 = "SECOND";
pkcs12Store.setCertificateEntry(alias1, cert2);
pkcs12Store.setCertificateEntry(alias2, cert2);
But I'm getting the following Exception:
Exception in thread "main" java.security.KeyStoreException: TrustedCertEntry not supported
Can anybody help me plz??

The PKCS12 keystore in Java cannot be used to store certificates or certificate chains without their private keys.
See this note in the JCA reference guide:
"pkcs12" is another option. This is a cross platform keystore based on the RSA PKCS12 Personal Information Exchange Syntax Standard. This standard is primarily meant for storing or transporting a user's private keys, certificates, and miscellaneous secrets. As of JDK 6, standards for storing Trusted Certificates in "pkcs12" have not been established yet, and thus "jks" or "jceks" should be used for trusted certificates.
(Despite mentioning JDK 6, this still is in the JDK 7 documentation.)
If you want to store a private key + certificate (chain) in a PKCS#12 store in Java, there needs to be a private key and you need to use the setKeyEntry method.

keytool -trustcacerts -keystore keystore.p12 -storetype pkcs12 -alias root -genkeypair
KeyStore pkcs12 = KeyStore.getInstance("PKCS12");
String filename = "/tmp/keystore.p12";
keyStore.load(
new FileInputStream(/*"myKeyStore.jks"*/filename),
password);

Lost Code Signing Certificate Alias

Our company purchased a code signing certificate from Thawte a few weeks ago. When we finally received the certificate from the purchasing team they didn't know the alias for the certificate!
I don't seem to be able to import the cert without the alias and they have no clue at all what it is. Is there a way of retrieving the alias? Has anybody else run into this problem? Is there any way of importing without the alias?

The alias is specified during the creation of the private key of the RSA certificate. It is not decided by the certificate signing authority, rather by the person creating the private and public keys.
I can't speak on whether your purchasing department ought to know this, but you'll need to check with the person/department who generated the CSR to determine the toolkit used to generate the CSR, and the key store format.
Now, assuming that the Java keytool utility was utilized to create the CSR, and that the private key is managed in a JKS keystore, you can utilize the keytool command to determine the contents (and hence the alias) of the keystore. This can be done using the keytool -list as indicated in the other answer. A sample run is demonstrated below, with the alias appearing in the output:
keytool -list -v -keystore foo.jks
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: foo
Creation date: Sep 1, 2010
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=foo, OU=foo, O=foo, L=foo, ST=foo, C=foo
Issuer: CN=foo, OU=foo, O=foo, L=foo, ST=foo, C=foo
Note that you do not need to know the keystore password to read the contents of the keystore, in which case a warning will be displayed.
In case you are using another toolkit and/or keystore format, you'll need to adopt a similar approach to determine the contents of the keystore, for the alias is not bound to appear in the CSR.

Try with:
keytool -list -keystore certificate.jks
(Note that if your keystore isn't JKS, for example, PKCS12, you can add an optional -storetype option to change the keystore type:)
keytool -list -keystore certificate.p12 -storetype PKCS12
You'll have something like:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
mykey, Feb 1, 2010, trustedCertEntry,
Certificate fingerprint (MD5): 0F:73:59:5C:35:8C:F2:F0:27:7E:F7:B7:AF:0A:95:B4
Your certificate alias is shown on the first line of the certificate description, here 'mykey'.