7.3. Create a Java Keystore to Store Sensitive Strings

Procedure 7.2. Set up a Java Keystore

1. Create a directory to store your keystore and other encrypted information.

   Create a directory to store your keystore and other important information. The rest of this procedure assumes that the directory is EAP_HOME/vault/. Since this directory will contain sensitive information it should be accessible to only limited users. At a minimum the user account under which JBoss EAP is running requires read-write access.

2. Determine the parameters to use with keytool utility.

   Decide on values for the following parameters:

   alias

   The alias is a unique identifier for the vault or other data stored in the keystore. Aliases are case-insensitive.

   storetype

   The storetype specifies the keystore type. The value jceks is recommended.

   keyalg

   The algorithm to use for encryption. Use the documentation for your JRE and operating system to see which other choices may be available to you.

   keysize

   The size of an encryption key impacts how difficult it is to decrypt through brute force. For information on appropriate values, see the documentation distributed with the keytool utility.

   storepass

   The value of storepass is the password is used to authenticate to the keystore so that the key can be read. The password must be at least 6 characters long and must be provided when the keystore is accessed. If you omit this parameter, you will be prompted to enter it when you execute the command.

   keypass

   The value of keypass is the password used to access the specific key and must match the value of the storepass parameter.

   validity

   The value of validity is the period (in days) for which the key will be valid.

   keystore

   The value of keystore is the filepath and filename in which the keystore's values are to be stored. The keystore file is created when data is first added to it.

   Ensure you use the correct file path separator: / (forward slash) for Red Hat Enterprise Linux and similar operating systems, \ (backslash) for Microsoft Windows Server.

   The keytool utility has many other options. See the documentation for your JRE or your operating system for more details.

3. Run the keytool command

   Launch your operating system's command line interface and run the keytool utility, supplying the information that you gathered.