Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

15.2. Generate encryption keys and certificate

15.2.1. Generate a self-signed certificate with keytool
リンクのコピー

15.2.1.1. Generate a key pair
リンクのコピー

The keytool command, part of the JDK, is used to generate a new key pair. Keytool can either add the new key pair to an existing key store, or create a new key store at the same time as the key pair.
This key pair will be used to negotiate SSL encryption between the server and remote clients. The following procedure generates a key pair and stores it in a key store called localhost.keystore . You will need to make this key store available to the EJB3 invoker on the server. The key pair in our example will be saved in the key store under the alias 'ejb-ssl'. We will need this key alias, and the key pair password you supply (if any), when configuring the EJB3 Remoting connector in Create a secure remoting connector for RMI .

Procedure 15.1.  Generate a new key pair and add it to the key store "localhost.keystore" in the JBoss server conf directory.

This procedure generates a new key pair for SSL encryption.
  • The following command will create a key pair for use with SSL encryption: 
    keytool -genkey -alias ejb-ssl -keystore localhost.keystore -storepass KEYSTORE_PASSWORD
  -keypass EJB-SSL_KEYPAIR_PASSWORD
  -dname "CN=SERVER_NAME,OU=QE,O=example.com,L=Brno,C=CZ"
    Copy to Clipboard Toggle word wrap
    Result:

    A key pair will be added to the key store localhost.keystore under the alias ejb-ssl .

    The parameters for this command are explained in keytool parameters

keytool parameters

alias
An alphanumeric token used to identify the key pair within the key store. A key store can contain multiple keys. The alias provides a means to uniquely identify a key pair within a key store. The alias for a key pair must by unique within a key store.
keystore
The key store that will be used to store the key pair. This can be a relative or absolute file path.
storepass
The password for key store. If the key store already exists, this must be the existing password for the key store. If the key store specified does not already exist, it will be created and this password will be the new password. This password is needed to access the key store to retrieve or store keys and certificates.
keypass
The password for the new key pair. This password must be supplied to use the key pair in the future.
dname
The identifying details of the certificate.
CN
Common Name: the name of the server. This must match the server name as returned to clients in a JNDI lookup. If a client attempts to make an SSL connection to the server using one name from JNDI, and receives a certificate with a different name, the connection will fail.
OU
Organizational Unit: the name of the organizational unit that is responsible for the server.
O
Organization: The name of the organization, sometimes expressed as a URL.
L
Location: the location of the server.
C
Country: two letter country code

Note

For best security practice, store key store files on a secure file system, readable only by the owner of the JBoss Application Server process.
Note that if no key store is specified on the command line, keytool adds the key pair to a new key store called keystore in the current user's home directory. This key store file is a hidden file.

15.2.1.2. Export a self-signed certificate
リンクのコピー

Once a key pair has been generated for the server to use, a certificate must be created. Procedure 15.2, “Export a certificate” details the steps to export the ejb-ssl key from the key store named localhost.keystore .

Procedure 15.2. Export a certificate

This procedure exports a certificate from a key store into a file.
  1. Issue the following command: 
    keytool -export -alias ejb-ssl -file mycert.cer -keystore localhost.keystore
    Copy to Clipboard Toggle word wrap
  2. Enter the key store password
    Result:

    A certificate is exported to the file mycert.cer .

トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat