Java keytool: Inserting a private key into an X.509 certificate

Does Java's keytool have the ability to export an X.509 certificate with a private key in it?

I am considering a scenario in w开发者_开发问答hich users generate a certificate (with the private key in it) and supply it to a signing tool. The signing tool uses the private key in the certificate to sign a target file. Eventually, the private key is removed from the certificate and the cert is attached to the target file for distribution.

---

I can't comment yet, so I'll use this form: Usually one uses PKCS #12 http://en.wikipedia.org/wiki/PKCS#12 for storing a certificate with its private Key. Also, one can store a public/private key pair in a PCKS #8 Container and ship the certificate separately.

If you're interested, i think i have some java code samples for PKCS #12 storage.

Also, the open source Java Certificate Authority EJBCA (http://www.ejbca.org/) is a great source for examples.

---

Private keys generated are never used or shared by others for any purposes. Signing tools that I know would use their own private key to generate their signature to certify your public key. For e.g. you generate a key pair using keytool and submit a CSR to a CA. CA would use their own pvt key to stamp their signature on your certificate.

---

The keytool (the commandline executable) does not have the option to export private keys. But you may use the JSA-API to do it programmatically (haven't tried, though).

---

Keys and their signed certificates are often stored in keystore containers such as PKCS12 or Java's JKS. It is also possible to extract certificates and keys into PEM format files for use in apps like Apache HTTPD.

To extract certs and keys from a JKS file it's necessary to convert it to PKCS12 format file before extracting the certs with openssl:

keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.pkcs12 -deststoretype pkcs12
openssl pkcs12 -in keystore.pkcs12 -out mycert.crt -nokeys
openssl pkcs12 -in keystore.pkcs12 -out mykey.key -nocerts