Keytool keeps giving SHA256 sigalg instead of requested alg

tomcat ssl keytool csr
Moylin picture Moylin · Jan 4, 2013 · Viewed 39.8k times · Source

I am using Keytool in java to generate a keystore/CSR to submit to a certificate Authority.

My CA only supports MD5withRSA and SHA1withRSA

Everytime I use keytool to create the keystore and export the CSR I am getting a SHA256withRSA signature Algorithm.

I've tried manually setting the -sigalg but it keeps going to sha256 everytime whether i try to set it to md5 or sha1

Can someone advise me on what I'm doing wrong

keytool -genkey -alias server -keyalg RSA -sigalg SHA1withRSA -keysize 2048 -keystore www_mydomain_com.jks -dname "CN=www.mydomain.com,OU=it, O=mycompany, L=thecity, ST=thestate, C=US" && keytool -certreq -alias server -file www_mydomain_com.csr -keystore www_mydomain_com.jks

keytool -genkey -alias server -keyalg RSA -sigalg MD5withRSA -keysize 2048 -keystore www_mydomain_com.jks -dname "CN=www.mydomain.com,OU=it, O=mycompany, L=thecity, ST=thestate, C=US" && keytool -certreq -alias server -file www_mydomain_com.csr -keystore www_mydomain_com.jks

Both commands create a csr that shows SHA256withRSA

Answer

Nickolay Olshevsky picture Nickolay Olshevsky · Jan 4, 2013

You should add -sigalg SHA1WithRSA parameter to the second keytool call, where CSR is actually generated.

Related questions

keytool error bash: keytool: command not found

I have tried to execute keytool from Java bin directory but I get an error with warning bash: keytool: command not found. root@xxxxxx]# keytool -genkey -alias mypassword -keyalg RSA bash: keytools: command not found

Read More
TOMCAT SSL Error: Alias name does not identify a key entry

I am trying to configure Tomcat 6 using SSL with a certificate provided to us (by someone). My SSL experience only spans a few days, but I still have to configure the darn thing. I was provided a certificate (downloaded from …

Read More
Tomcat Server/Client Self-Signed SSL Certificate

I have an Apache Tomcat 6.x server running with a self-signed SSL certificate. I want the client to present their own certificate to the server so I can authenticate them based on a database of users. I have it all …

Read More