最新消息:雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客

ssl - Java Keystore Private Key validity date requirement - Stack Overflow

programmeradmin1浏览0评论

I am a little confused when dealing with java keystores.

When I create an empty keystore like this:

keytool.exe -genkeypair -keysize 4096 -alias tomcat -keyalg RSA -sigalg SHA256withRSA

a validity of 3 month is shown when observing with keytool -list -keystore .keystore

Enter keystore password:
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: tomcat
Creation date: 22.01.2020
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: <redacted>
Issuer: <redacted>
Serial number: 6d4454f0
Valid from: Wed Jan 22 11:55:28 CET 2020 until: Tue Apr 21 12:55:28 CEST 2020
Certificate fingerprints:
         SHA1: <redacted>
         SHA256: <redacted>
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3

<redacted>

Then I converted the private key into PKCS12, created the CSR, imported the root, sub and intermediate certificates using alias tomcat. The certificate is shown properly after these steps using keytool -list -v

keytool -list -keystore .keystore -v
Enter keystore password:
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: tomcat
Creation date: 22.01.2020
Entry type: PrivateKeyEntry
Certificate chain length: 3
Certificate[1]:
Owner: <redacted>
Issuer: <redacted>
Serial number: <redacted>
Valid from: Wed Jan 22 13:28:32 CET 2020 until: Mon Jan 20 13:28:32 CET 2025
Certificate fingerprints:
         SHA1: <redacted>
         SHA256: <redacted>
Signature algorithm name: SHA384withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3

Extensions:
<further Object Id entries redacted>

Now the validity time range of the keystore entry (tomcat) has expanded to the date of the intermediate certificate.

The question I have is: Has the (in this example already outdated) validity date of the private key any influence to the added keystore entries and the included certificate chain? (obviously not, but confuses me anyway)

发布评论

评论列表(0)

  1. 暂无评论