22
22
.\" t
23
23
.\" Automatically generated by Pandoc 2.3.1
24
24
.\"
25
- .TH "KEYTOOL" "1" "2022" "JDK 19\- ea " "JDK Commands"
25
+ .TH "KEYTOOL" "1" "2022" "JDK 19" "JDK Commands"
26
26
.hy
27
27
.SH NAME
28
28
.PP
@@ -433,7 +433,7 @@ single\-element certificate chain.
433
433
When the \f[CB] \- signer \f[ R ] option is specified, a new certificate is
434
434
generated and signed by the designated signer and stored as a
435
435
multiple\- element certificate chain (containing the generated
436
- certificate itself, and the signer??? s certificate chain).
436
+ certificate itself, and the signer?s certificate chain).
437
437
The certificate chain and private key are stored in a new keystore entry
438
438
that is identified by its alias.
439
439
.PP
@@ -453,15 +453,15 @@ specified.
453
453
The \f[CB] \- signer \f[ R ] value specifies the alias of a
454
454
\f[CB] PrivateKeyEntry \f[ R ] for the signer that already exists in the
455
455
keystore.
456
- This option is used to sign the certificate with the signer??? s private
456
+ This option is used to sign the certificate with the signer?s private
457
457
key.
458
458
This is especially useful for key agreement algorithms (i.e.
459
459
the \f[CB] \- keyalg \f[ R ] value is \f[CB] XDH \f[ R ] , \f[CB] X25519 \f[ R ] ,
460
460
\f[CB] X448 \f[ R ] , or \f[CB] DH \f[ R ] ) as these keys cannot be used for digital
461
461
signatures, and therefore a self\- signed certificate cannot be created.
462
462
.PP
463
463
The \f[CB] \- signerkeypass \f[ R ] value specifies the password of the
464
- signer??? s private key.
464
+ signer?s private key.
465
465
It can be specified if the private key of the signer entry is protected
466
466
by a password different from the store password.
467
467
.PP
@@ -1571,8 +1571,9 @@ The following examples show the defaults for various option values:
1571
1571
\- alias \ "mykey"
1572
1572
1573
1573
\- keysize
1574
- \ \ \ \ 2048 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "RSA", \ "DSA", \ "RSASSA \- PSS", \ or \ "DH")
1575
- \ \ \ \ 256 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "EC")
1574
+ \ \ \ \ 2048 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "DSA")
1575
+ \ \ \ \ 3072 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "RSA", \ "RSASSA \- PSS", \ or \ "DH")
1576
+ \ \ \ \ 384 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "EC")
1576
1577
\ \ \ \ 255 \ (when \ using \ \- genkeypair \ and \ \- keyalg \ is \ "EdDSA", \ or \ "XDH)
1577
1578
\ \ \ \ 56 \ (when \ using \ \- genseckey \ and \ \- keyalg \ is \ "DES")
1578
1579
\ \ \ \ 168 \ (when \ using \ \- genseckey \ and \ \- keyalg \ is \ "DESede")
@@ -1600,6 +1601,7 @@ signature algorithm (\f[CB]\-sigalg\f[R] option) is derived from the
1600
1601
algorithm of the underlying private key to provide an appropriate level
1601
1602
of security strength as follows:
1602
1603
.PP
1604
+ Default Signature Algorithms
1603
1605
.TS
1604
1606
tab(@ ) ;
1605
1607
l l l .
1621
1623
T{
1622
1624
RSA
1623
1625
T} @T{
1624
- <= 3072
1626
+ < 624
1625
1627
T} @T{
1626
- SHA256withRSA
1628
+ SHA256withRSA (keysize is too small for using SHA \- 384)
1627
1629
T}
1628
1630
T{
1629
1631
T} @T{
@@ -1640,28 +1642,27 @@ T}
1640
1642
T{
1641
1643
EC
1642
1644
T} @T{
1643
- < 384
1644
- T} @T{
1645
- SHA256withECDSA
1646
- T}
1647
- T{
1648
- T} @T{
1649
1645
< 512
1650
1646
T} @T{
1651
1647
SHA384withECDSA
1652
1648
T}
1653
1649
T{
1654
1650
T} @T{
1655
- = 512
1651
+ > = 512
1656
1652
T} @T{
1657
1653
SHA512withECDSA
1658
1654
T}
1659
1655
T{
1660
1656
RSASSA\- PSS
1661
1657
T} @T{
1662
- <= 3072
1658
+ < 624
1659
+ T} @T{
1660
+ RSASSA\- PSS (with SHA\- 256, keysize is too small for
1661
+ T}
1662
+ T{
1663
+ T} @T{
1663
1664
T} @T{
1664
- RSASSA \- PSS (with SHA\- 256 )
1665
+ using SHA\- 384 )
1665
1666
T}
1666
1667
T{
1667
1668
T} @T{
@@ -1946,9 +1947,9 @@ distinguished name is \f[CB]myname\f[R], \f[CB]mygroup\f[R],
1946
1947
\f[CB] mycompany \f[ R ] , and a two\- letter country code of
1947
1948
\f[CB] mycountry \f[ R ] .
1948
1949
It uses the RSA key generation algorithm to create the keys; both are
1949
- 2048 bits
1950
+ 3072 bits.
1950
1951
.PP
1951
- The command uses the default SHA256withRSA signature algorithm to create
1952
+ The command uses the default SHA384withRSA signature algorithm to create
1952
1953
a self\- signed certificate that includes the public key and the
1953
1954
distinguished name information.
1954
1955
The certificate is valid for 180 days, and is associated with the
0 commit comments