Extending expiration date of trustedCertEntry within a keystore

java certificate keystore private-key truststore
McLovin picture McLovin · Nov 13, 2014 · Viewed 16.2k times · Source

Using keytool, I am trying to extend the expiration date of a trustedCertEntry within a keystore that I have. The keystore has the contents below

$ keytool -list -keystore certs/authTruststore.jks
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 3 entries

sts, Nov 11, 2013, trustedCertEntry,
Certificate fingerprint (SHA1): 8D:33:B7:69:DE:75:8F:22:E2:95:2C:EB:93:65:41:31:42:A6:E3:A7
__
localhost, Nov 11, 2013, PrivateKeyEntry,
Certificate fingerprint (SHA1): F4:A9:84:1E:7F:BF:5D:71:58:74:E4:C6:00:49:37:49:38:3E:31:BE
__    
security_localhost, Nov 11, 2013, trustedCertEntry,
Certificate fingerprint (SHA1): 6B:F8:E1:36:EB:36:D4:A5:6E:A0:5C:7A:E4:B9:A4:5B:63:BF:97:5D

I can successfully modify the expiration date of the second entry, localhost of type PrivateKeyEntry but when attempting to modify the expirations of the other two with the same command I get the following error:

$ keytool -selfcert -v -alias security_localhost -validity 3650 -keystore certs/authTruststore.jks -storepass ****

keytool error: java.lang.Exception: Alias <localhost> has no key
java.lang.Exception: Alias <localhost> has no key
    at sun.security.tools.KeyTool.recoverKey(KeyTool.java:3095)
    at sun.security.tools.KeyTool.doSelfCert(KeyTool.java:2442)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:1071)
    at sun.security.tools.KeyTool.run(KeyTool.java:340)
    at sun.security.tools.KeyTool.main(KeyTool.java:333)

How can I go about extending these expiration dates?

Answer

always_a_rookie picture always_a_rookie · Nov 13, 2014

Take a look at this link. It says,

Generates an X.509 v1 self-signed certificate, using keystore information including
the private key and public key associated with alias

So you can update a certificate using -selfcert that are associated with a key. Your first and third are trusted certificate entries, where as your second entry is a PrivateKeyEntry. The certificate for this entry is associated with its PrivateKey. Where as the other 2 are not.

If those 2 certificates are expired you can only update them with the latest in the same way you added them to the keystore in the first place. By doing -importcert.

Note: -selfcert is now obsolete. You can read more about it here.

Related questions

How to import a .cer certificate into a java keystore?

During the development of a Java webservice client I ran into a problem. Authentication for the webservice is using a client certificate, a username and a password. The client certificate I received from the company behind the webservice is in .…

Read More
How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?

I do want to import a self signed certificate into Java so any Java application that will try to establish a SSL connection will trust this certificate. So far, I managed to import it in keytool -import -trustcacerts -noprompt -storepass …

Read More
How to add certificate chain to keystore?

I have file with chain of certificates - certificate.cer: subject=/C... issuer=/C=US/O=VeriSign, Inc... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- subject=/C=US/O=VeriSign, Inc... issuer=/C=US/O=VeriSign, Inc... -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- subject=/C=…

Read More