Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've an appliance that uses SSL certs for different functions.

I generated a CSE using keytool using these commands:

keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/msw/data/keystore -storepass changeit

keytool -certreq -alias tomcat -keyalg RSA -keystore /opt/msw/data/keystore -storepass changeit -file /root/certreq.csr

Which generated the CSR that I used to download the cert, then I installed it using

"keytool -import -alias tomcat -trustcacerts -keystore /opt/msw/data/keystore -storepass changeit -file /root/server.cert"

So far, so good.

However, one component that uses SSL requires both the certificate and the private key, which of course I don't have - and I don't see an obvious way using keytool to export the private key from Tomcat, is there one please?

share|improve this question
This might be a silly question but how come 2 people have given me a "useful question" mark but nobody has given the guy that answered my question a "useful answer" mark - seems a little unfair :) – Hutch Sep 28 '10 at 19:59
up vote 3 down vote accepted

Believe it or not, this functionality is not supported in keytool. The best solution I have found so far is the software and instructions available for download on this Web site.

I usually generate the key using openssl and then use this method to import the key, as that is not supported by keytool either.

To generate a 2048 bit key:

openssl genrsa -out 2048

To create a keystore from this key:
openssl pkcs8 -topk8 -nocrypt -in $KEY.key -inform PEM -out key.der -outform DER
openssl x509 -in $KEY.crt -inform PEM -out cert.der -outform DER
java ImportKey key.der cert.der
share|improve this answer
Perfect, seems to have done the job just fine - thank you. – Hutch Sep 28 '10 at 18:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.