|
JCA - Certificates, 'keytool' and 'keystore'
Part:
1
2
3
This chapter describes some parts of the JCA (Java Cryptography Architecture)
which has been included in JDK since 1.1:
- What is a certificate and a certificate chain?
- What is "keystore"?
- What are the functions offered by "keytool"?
- Examples of using "keytool".
Certificates and Certificate Chains
Certificate: A digitally signed statement from the issuer saying
that the public key of the subject has some specific value.
The above definition is copied from the JDK 1.3.1 documentation. It has
a couple of important terms:
- "signed statement" - The certificate must be signed by the issuer with
a digital signature.
- "issuer" - The person or organization who is issuing this certificate.
- "public key" - The public key of a key pair selected by the subject.
- "subject" - The person or organization who owns the public key.
X.509 Certificate - A certificate written in X.509 standard format.
X.509 standard was introduction in 1988. It requires a certificate to have
the following information:
- Version - X.509 standard version number.
- Serial Number - A sequence number given to each certificate.
- Signature Algorithm Identifier - Name of the algorithm used
to sign this certificate by the issuer
- Issuer Name - Name of the issuer.
- Validity Period - Period during which this certificate is valid.
- Subject Name - Name of the owner of the public key.
- Subject Public Key Information - The public key and its related information.
How can you get a certificate for your own public key?
- Requesting it from a Certificate Authority (CA), like VeriSign, Thawte or Entrust.
- Doing it yourself - using tools like JDK "keytool" to generate a self-signed certificate.
Certificate Chain: A series of certificates that one certificate signs the
public key of the issuer of the next certificate. Usually the top certificate
(the first certificate) is self-signed, where issuer signed its own public key.
What is "keystore"?
"keystore" - A database used by JDK "keytool" command and KeyStore class to store your own private keys,
and public key certificates you received from someone else. "keystore" supports
the following features:
- Two types of entries: key entries for private keys and certificate entries for
public key certificates.
- A key entry contains the private key and a certificate chain of the corresponding
public key.
- Every entry has a unique alias name.
- Key entries are protected by separate passwords.
- "keystore" may have different implementations from different security package providers.
The default implementation from Sun is called JKS.
(Continued on next part...)
Part:
1
2
3
| 