I have a bunch of .keystore files and need to find one with specific CN and alias. Is there a way to do it with keytool, jarsigner or some other tool? I found a way to check if specific keystore was used to sign a specific apk, but I also need to get the alias and certificate name in each of the files.
12 Answers
You can run the following command to list the content of your keystore file (and alias name):
keytool -v -list -keystore .keystore
If you are looking for a specific alias, you can also specify it in the command:
keytool -list -keystore .keystore -alias foo
If the alias is not found, it will display an exception:
keytool error: java.lang.Exception: Alias does not exist
-
1Hi can I display the key alias password If I know the key alias name and have keystore certificate and keystore password– PrateekAug 22, 2013 at 7:22
-
22@prateek You can't. There wouldn't be much point in having keystore or key passwords if you could just display then with a command-line tool. Apr 17, 2015 at 12:15
-
3You can run the following command to list the content of your keystore file: keytool -list -keystore .keystore The above commond is not providing the name of alias Jan 12, 2018 at 7:52
-
1@ManmohanSoni I have updated it to include -v argument which reveals the alias Mar 22, 2018 at 5:18
-
44I think that
/path/to/keystore
instead of.keystore
would be more clear to the reader. Anyway it is the correct answer!– AndreaJul 11, 2018 at 14:09
In order to get all the details I had to add the -v option to romaintaz answer:
keytool -v -list -keystore <FileName>.keystore
-
10
-
1
-
2"If the
-v
option is specified, then the certificate is printed in human-readable format, with additional information such as the owner, issuer, serial number, and any extensions." (see: Java SE Tools Reference, Display Data command, -list option)– Eido95Aug 24, 2017 at 12:46
You can run from Java code.
try {
File file = new File(keystore location);
InputStream is = new FileInputStream(file);
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
String password = "password";
keystore.load(is, password.toCharArray());
Enumeration<String> enumeration = keystore.aliases();
while(enumeration.hasMoreElements()) {
String alias = enumeration.nextElement();
System.out.println("alias name: " + alias);
Certificate certificate = keystore.getCertificate(alias);
System.out.println(certificate.toString());
}
} catch (java.security.cert.CertificateException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (FileNotFoundException e) {
e.printStackTrace();
} catch (KeyStoreException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}finally {
if(null != is)
try {
is.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
Certificate class holds all information about the keystore.
UPDATE- OBTAIN PRIVATE KEY
Key key = keyStore.getKey(alias, password.toCharArray());
String encodedKey = new Base64Encoder().encode(key.getEncoded());
System.out.println("key ? " + encodedKey);
@prateek Hope this is what you looking for!
-
import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; import java.io.IOException; import java.security.cert.Certificate; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.util.Enumeration; Aug 6, 2013 at 16:33
-
1@Renjith hello This code displays everything except the password associated with alias, How can I display it . Please help me– PrateekAug 22, 2013 at 8:52
-
@Renjith
java.security.UnrecoverableKeyException
this is the exception thrown when I try this code actualy I want to retrieve alias password– PrateekAug 22, 2013 at 11:59 -
2you should use the code snippet inside the aforementioned while loop– RenjithAug 22, 2013 at 12:00
-
1I didnt have Base64Encoder class. Can you please tell me which jar file does it have? or is it a .java file?– JackMar 16, 2016 at 6:35
KeyStore Explorer open source visual tool to manage keystores.
-
This is close to a link-only answer. The policy is that you should post some information on how to use the tool/library in the answer itself. Dec 10, 2020 at 15:04
-
In a bash-like environment you can use:
keytool -list -v -keystore cacerts.jks | grep 'Alias name:' | grep -i foo
This command consist of 3 parts. As stated above, the 1st part will list all trusted certificates with all the details and that's why the 2nd part comes to filter only the alias information among those details. And finally in the 3rd part you can search for a specific alias (or part of it). The -i turns the case insensitive mode on. Thus the given command will yield all aliases containing the pattern 'foo', f.e. foo, 123_FOO, fooBar, etc. For more information man grep
.
This will list all certificates:
keytool -list -keystore "$JAVA_HOME/jre/lib/security/cacerts"
-
This will only list certificates stored in the JDK's trust store which is similar but for a different purpose to a keystore (which was asked about). There is a good differentiation here: http://stackoverflow.com/questions/17935619/what-is-difference-between-cacerts-and-keystore. Mar 19, 2017 at 16:42
-
1
cmd:
keytool -list -keystore 'keystoreName'
and then press 'Enter' the cmd will then prompt you to enter the keystore password
cmd doesn't show the password on the screen while typing so just type the correct passwd -and be careful- then press enter again.
Or You can use:
keytool -list -keystore 'keystoreName' -storepass 'type your keystore passwd'
and for Keys' full info, just add -v:
keytool -v -list -keystore 'keystoreName' -storepass 'type your keystore passwd'
On Windows:
keytool -v -list -keystore my_keystore | findstr my_string
Reference:
we can get the list of Certificates from Certs with simple command and search for your alias name in the resulted output.
keytool -list -keystore C:/swdtools/jdk1.7.0_67/jre/lib/security/cacerts
If you get a warning
Warning: use -cacerts option to access cacerts keystore
then you may use this command
.\keytool.exe -list -cacerts
-
1
There are also console certificate manager written as a single-file shell script (open-source):
https://dev.to/sfkulyk/writing-panel-manager-for-certificate-keystore-in-linux-shell-187b
Can browse, copy, delete, rename and compare keystores.
keytool -v -list -cacerts -alias cert1
This works for me when I am checking for the certificate added to jdk-11 with alias name and check if it was added on windows machine