575

I have a bunch of .keystore files and need to find one with specific CN and alias. Is there a way to do it with keytool, jarsigner or some other tool? I found a way to check if specific keystore was used to sign a specific apk, but I also need to get the alias and certificate name in each of the files.

12 Answers 12

1056

You can run the following command to list the content of your keystore file (and alias name):

keytool -v -list -keystore .keystore

If you are looking for a specific alias, you can also specify it in the command:

keytool -list -keystore .keystore -alias foo

If the alias is not found, it will display an exception:

keytool error: java.lang.Exception: Alias does not exist

8
  • 1
    Hi can I display the key alias password If I know the key alias name and have keystore certificate and keystore password
    – Prateek
    Aug 22, 2013 at 7:22
  • 22
    @prateek You can't. There wouldn't be much point in having keystore or key passwords if you could just display then with a command-line tool.
    – user207421
    Apr 17, 2015 at 12:15
  • 3
    You can run the following command to list the content of your keystore file: keytool -list -keystore .keystore The above commond is not providing the name of alias Jan 12, 2018 at 7:52
  • 1
    @ManmohanSoni I have updated it to include -v argument which reveals the alias Mar 22, 2018 at 5:18
  • 44
    I think that /path/to/keystore instead of .keystore would be more clear to the reader. Anyway it is the correct answer!
    – Andrea
    Jul 11, 2018 at 14:09
308

In order to get all the details I had to add the -v option to romaintaz answer:

keytool -v -list -keystore <FileName>.keystore
3
78

You can run from Java code.

try {

        File file = new File(keystore location);
        InputStream is = new FileInputStream(file);
        KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        String password = "password";
        keystore.load(is, password.toCharArray());


        Enumeration<String> enumeration = keystore.aliases();
        while(enumeration.hasMoreElements()) {
            String alias = enumeration.nextElement();
            System.out.println("alias name: " + alias);
            Certificate certificate = keystore.getCertificate(alias);
            System.out.println(certificate.toString());

        }

    } catch (java.security.cert.CertificateException e) {
        e.printStackTrace();
    } catch (NoSuchAlgorithmException e) {
        e.printStackTrace();
    } catch (FileNotFoundException e) {
        e.printStackTrace();
    } catch (KeyStoreException e) {
        e.printStackTrace();
    } catch (IOException e) {
        e.printStackTrace();
    }finally {
        if(null != is)
            try {
                is.close();
            } catch (IOException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
    }

Certificate class holds all information about the keystore.

UPDATE- OBTAIN PRIVATE KEY

Key key = keyStore.getKey(alias, password.toCharArray());
String encodedKey = new Base64Encoder().encode(key.getEncoded());
System.out.println("key ? " + encodedKey);

@prateek Hope this is what you looking for!

7
  • import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; import java.io.IOException; import java.security.cert.Certificate; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.util.Enumeration; Aug 6, 2013 at 16:33
  • 1
    @Renjith hello This code displays everything except the password associated with alias, How can I display it . Please help me
    – Prateek
    Aug 22, 2013 at 8:52
  • @Renjith java.security.UnrecoverableKeyException this is the exception thrown when I try this code actualy I want to retrieve alias password
    – Prateek
    Aug 22, 2013 at 11:59
  • 2
    you should use the code snippet inside the aforementioned while loop
    – Renjith
    Aug 22, 2013 at 12:00
  • 1
    I didnt have Base64Encoder class. Can you please tell me which jar file does it have? or is it a .java file?
    – Jack
    Mar 16, 2016 at 6:35
64

KeyStore Explorer open source visual tool to manage keystores.

2
  • This is close to a link-only answer. The policy is that you should post some information on how to use the tool/library in the answer itself.
    – user202729
    Dec 10, 2020 at 15:04
  • dead link, this is why link only answer is terrible Nov 30, 2022 at 10:17
27

In a bash-like environment you can use:

keytool -list -v -keystore cacerts.jks | grep 'Alias name:' | grep -i foo

This command consist of 3 parts. As stated above, the 1st part will list all trusted certificates with all the details and that's why the 2nd part comes to filter only the alias information among those details. And finally in the 3rd part you can search for a specific alias (or part of it). The -i turns the case insensitive mode on. Thus the given command will yield all aliases containing the pattern 'foo', f.e. foo, 123_FOO, fooBar, etc. For more information man grep.

0
22

This will list all certificates:

keytool -list -keystore "$JAVA_HOME/jre/lib/security/cacerts"
2
10

cmd:

keytool -list -keystore 'keystoreName'

and then press 'Enter' the cmd will then prompt you to enter the keystore password

cmd doesn't show the password on the screen while typing so just type the correct passwd -and be careful- then press enter again.

Or You can use:

keytool -list -keystore 'keystoreName' -storepass 'type your keystore passwd'

and for Keys' full info, just add -v:

keytool -v -list -keystore 'keystoreName' -storepass 'type your keystore passwd'
6

On Windows:

keytool -v -list -keystore my_keystore | findstr my_string

Reference:

CMD Search a directory to Find a string inside a file

3

we can get the list of Certificates from Certs with simple command and search for your alias name in the resulted output.

keytool -list -keystore C:/swdtools/jdk1.7.0_67/jre/lib/security/cacerts
2

If you get a warning

Warning: use -cacerts option to access cacerts keystore

then you may use this command

.\keytool.exe -list -cacerts

1
  • 1
    Not sure why this was downvoted.but it was helpful. Jan 26, 2022 at 14:44
1

There are also console certificate manager written as a single-file shell script (open-source):

https://dev.to/sfkulyk/writing-panel-manager-for-certificate-keystore-in-linux-shell-187b

Can browse, copy, delete, rename and compare keystores.

1

keytool -v -list -cacerts -alias cert1

This works for me when I am checking for the certificate added to jdk-11 with alias name and check if it was added on windows machine

Not the answer you're looking for? Browse other questions tagged or ask your own question.