1
- .\" t
2
1
.\" Copyright (c) 1998, 2020, Oracle and/or its affiliates. All rights reserved.
3
2
.\" DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4
3
.\"
8
7
.\"
9
8
.\" This code is distributed in the hope that it will be useful, but WITHOUT
10
9
.\" ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11
- .\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
10
+ .\" FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12
11
.\" version 2 for more details (a copy is included in the LICENSE file that
13
12
.\" accompanied this code).
14
13
.\"
20
19
.\" or visit www.oracle.com if you need additional information or have any
21
20
.\" questions.
22
21
.\"
22
+ .\" t
23
23
.\" Automatically generated by Pandoc 2.3.1
24
24
.\"
25
- .TH "KEYTOOL" "1" "2020" "JDK 15 " "JDK Commands"
25
+ .TH "KEYTOOL" "1" "2020" "JDK 16 " "JDK Commands"
26
26
.hy
27
27
.SH NAME
28
28
.PP
@@ -980,6 +980,28 @@ Sockets Layer (SSL) server host and port
980
980
.IP \[bu ] 2
981
981
{\f[CB] \- jarfile \f[ R ] \f[I] JAR_file \f[ R ] }: Signed \f[CB] \& .jar \f[ R ] file
982
982
.IP \[bu ] 2
983
+ {\f[CB] \- keystore \f[ R ] \f[I] keystore \f[ R ] }: Keystore name
984
+ .IP \[bu ] 2
985
+ {\f[CB] \- trustcacerts \f[ R ] }: Trust certificates from cacerts
986
+ .IP \[bu ] 2
987
+ [\f[CB] \- storepass \f[ R ] \f[I] arg \f[ R ] ]: Keystore password
988
+ .IP \[bu ] 2
989
+ {\f[CB] \- storetype \f[ R ] \f[I] type \f[ R ] }: Keystore type
990
+ .IP \[bu ] 2
991
+ {\f[CB] \- providername \f[ R ] \f[I] name \f[ R ] }: Provider name
992
+ .IP \[bu ] 2
993
+ {\f[CB] \- addprovider \f[ R ] \f[I] name \f[ R ] [\f[CB] \- providerarg \f[ R ]
994
+ \f[I] arg \f[ R ] ]}: Add security provider by name (such as SunPKCS11) with
995
+ an optional configure argument.
996
+ .IP \[bu ] 2
997
+ {\f[CB] \- providerclass \f[ R ] \f[I] class \f[ R ] [\f[CB] \- providerarg \f[ R ]
998
+ \f[I] arg \f[ R ] ]}: Add security provider by fully qualified class name with
999
+ an optional configure argument.
1000
+ .IP \[bu ] 2
1001
+ {\f[CB] \- providerpath \f[ R ] \f[I] list \f[ R ] }: Provider classpath
1002
+ .IP \[bu ] 2
1003
+ {\f[CB] \- protected \f[ R ] }: Password is provided through protected mechanism
1004
+ .IP \[bu ] 2
983
1005
{\f[CB] \- v \f[ R ] }: Verbose output
984
1006
.PP
985
1007
Use the \f[CB] \- printcert \f[ R ] command to read and print the certificate
@@ -1012,7 +1034,11 @@ command line for proxy tunneling.
1012
1034
.PP
1013
1035
\f[B] Note: \f[ R ]
1014
1036
.PP
1015
- This option can be used independently of a keystore.
1037
+ This command can be used independently of a keystore.
1038
+ This command does not check for the weakness of a certificate\[aq ] s
1039
+ signature algorithm if it is a trusted certificate in the user keystore
1040
+ (specified by \f[CB] \- keystore \f[ R ] ) or in the \f[CB] cacerts \f[ R ] keystore
1041
+ (if \f[CB] \- trustcacerts \f[ R ] is specified).
1016
1042
.RE
1017
1043
.TP
1018
1044
.B \f[CB] \- printcertreq \f[ R ]
@@ -1038,6 +1064,28 @@ command:
1038
1064
.IP \[bu ] 2
1039
1065
{\f[CB] \- file \ crl \f[ R ] }: Input file name
1040
1066
.IP \[bu ] 2
1067
+ {\f[CB] \- keystore \f[ R ] \f[I] keystore \f[ R ] }: Keystore name
1068
+ .IP \[bu ] 2
1069
+ {\f[CB] \- trustcacerts \f[ R ] }: Trust certificates from cacerts
1070
+ .IP \[bu ] 2
1071
+ [\f[CB] \- storepass \f[ R ] \f[I] arg \f[ R ] ]: Keystore password
1072
+ .IP \[bu ] 2
1073
+ {\f[CB] \- storetype \f[ R ] \f[I] type \f[ R ] }: Keystore type
1074
+ .IP \[bu ] 2
1075
+ {\f[CB] \- providername \f[ R ] \f[I] name \f[ R ] }: Provider name
1076
+ .IP \[bu ] 2
1077
+ {\f[CB] \- addprovider \f[ R ] \f[I] name \f[ R ] [\f[CB] \- providerarg \f[ R ]
1078
+ \f[I] arg \f[ R ] ]}: Add security provider by name (such as SunPKCS11) with
1079
+ an optional configure argument.
1080
+ .IP \[bu ] 2
1081
+ {\f[CB] \- providerclass \f[ R ] \f[I] class \f[ R ] [\f[CB] \- providerarg \f[ R ]
1082
+ \f[I] arg \f[ R ] ]}: Add security provider by fully qualified class name with
1083
+ an optional configure argument.
1084
+ .IP \[bu ] 2
1085
+ {\f[CB] \- providerpath \f[ R ] \f[I] list \f[ R ] }: Provider classpath
1086
+ .IP \[bu ] 2
1087
+ {\f[CB] \- protected \f[ R ] }: Password is provided through protected mechanism
1088
+ .IP \[bu ] 2
1041
1089
{\f[CB] \- v \f[ R ] }: Verbose output
1042
1090
.PP
1043
1091
Use the \f[CB] \- printcrl \f[ R ] command to read the Certificate Revocation
@@ -1048,7 +1096,11 @@ The CA generates the \f[CB]crl\f[R] file.
1048
1096
.PP
1049
1097
\f[B] Note: \f[ R ]
1050
1098
.PP
1051
- This option can be used independently of a keystore.
1099
+ This command can be used independently of a keystore.
1100
+ This command attempts to verify the CRL using a certificate from the
1101
+ user keystore (specified by \f[CB] \- keystore \f[ R ] ) or the \f[CB] cacerts \f[ R ]
1102
+ keystore (if \f[CB] \- trustcacerts \f[ R ] is specified), and will print out a
1103
+ warning if it cannot be verified.
1052
1104
.RE
1053
1105
.SH COMMANDS FOR MANAGING THE KEYSTORE
1054
1106
.TP
@@ -1479,9 +1531,9 @@ The following examples show the defaults for various option values:
1479
1531
\- alias \ "mykey"
1480
1532
1481
1533
\- keysize
1482
- \ \ \ \ 2048 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "RSA")
1483
- \ \ \ \ 2048 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "DSA")
1534
+ \ \ \ \ 2048 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "RSA", \ "DSA", \ or \ "RSASSA \- PSS")
1484
1535
\ \ \ \ 256 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "EC")
1536
+ \ \ \ \ 255 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "EdDSA")
1485
1537
\ \ \ \ 56 \ (when \ using \ \- genseckey \ and \ \- keyalg \ is \ "DES")
1486
1538
\ \ \ \ 168 \ (when \ using \ \- genseckey \ and \ \- keyalg \ is \ "DESede")
1487
1539
@@ -1564,7 +1616,66 @@ T}@T{
1564
1616
T} @T{
1565
1617
SHA512withECDSA
1566
1618
T}
1619
+ T{
1620
+ RSASSA\- PSS
1621
+ T} @T{
1622
+ <= 3072
1623
+ T} @T{
1624
+ RSASSA\- PSS (with SHA\- 256)
1625
+ T}
1626
+ T{
1627
+ T} @T{
1628
+ <= 7680
1629
+ T} @T{
1630
+ RSASSA\- PSS (with SHA\- 384)
1631
+ T}
1632
+ T{
1633
+ T} @T{
1634
+ > 7680
1635
+ T} @T{
1636
+ RSASSA\- PSS (with SHA\- 512)
1637
+ T}
1638
+ T{
1639
+ EdDSA
1640
+ T} @T{
1641
+ 255
1642
+ T} @T{
1643
+ Ed25519
1644
+ T}
1645
+ T{
1646
+ T} @T{
1647
+ 448
1648
+ T} @T{
1649
+ Ed448
1650
+ T}
1651
+ T{
1652
+ Ed25519
1653
+ T} @T{
1654
+ 255
1655
+ T} @T{
1656
+ Ed25519
1657
+ T}
1658
+ T{
1659
+ Ed448
1660
+ T} @T{
1661
+ 448
1662
+ T} @T{
1663
+ Ed448
1664
+ T}
1567
1665
.TE
1666
+ .IP \[bu ] 2
1667
+ An RSASSA\- PSS signature algorithm uses a \f[CB] MessageDigest \f[ R ]
1668
+ algorithm as its hash and MGF1 algorithms.
1669
+ .IP \[bu ] 2
1670
+ EdDSA supports 2 key sizes: Ed25519 and Ed448.
1671
+ When generating an EdDSA key pair using \f[CB] \- keyalg \ EdDSA \f[ R ] , a user
1672
+ can specify \f[CB] \- keysize \ 255 \f[ R ] or \f[CB] \- keysize \ 448 \f[ R ] to
1673
+ generate Ed25519 or Ed448 key pairs.
1674
+ When no \f[CB] \- keysize \f[ R ] is specified, an Ed25519 key pair is
1675
+ generated.
1676
+ A user can also directly specify \f[CB] \- keyalg \ Ed25519 \f[ R ] or
1677
+ \f[CB] \- keyalg \ Ed448 \f[ R ] to generate a key pair with the expected key
1678
+ size.
1568
1679
.PP
1569
1680
\f[B] Note: \f[ R ]
1570
1681
.PP
0 commit comments