Page Comparison

Generate a key pair for the server/service. 

$ keytool -genkey -alias server -keyalg RSA -keystore ./Server.jks -storetype PKCS12 

alias = name of the key, for example, server 
keystore = name of the keystore, for example, server.jks
When prompted for first and last name the hostname where the certificate is valid should be entered, e.g. localhost. Other values can be anything.


Generate a Certificate Signing Request (CSR) so that we can get server's certificate get signed by a CA.

$ keytool -certreq -alias server -keystore Server.jks -file Server.csr

Get the certificate signed by our the CA, Test CA in these example. See this page on how to set up a CA.

$ openssl x509 -CA caroot.cer -CAkey cakey.pem -CAserial serial.txt -req -in Server.csr -out Server.cer -days 365

CA, CAkey and CAserial are files generated when setting up the CA.

Import the Test CA's root self signed certificate in server key store as a trusted certificate.

$ keytool -import -alias TestCA -file caroot.cer -keystore Server.jks

...