Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> Security >> Cryptography

Any way to recover from keystore/keypass loss between -certreq & -import ?

Hi Folks,

I'd be grateful for any suggestions/prcedures for recovering from this mess:

1. Used keytool -certreq to create a certificate request;

2. Keystore got damaged so data added by -certreq function is now gone;

3. Got expensive CA certificate, but can't figure out how to import it. (The self-signed certificate used to create the request is gone.)

I have:

Certificate request csr file; and

CA's certificate file.

I do not have:

keypass value entered at the time the csr was created.

I've tried creating another self-signed certificate using keytool, but either I'm doing something wrong or it just won't work to import it into an existing alias. I can't import it as a trusted certificate because there'll be no associated private key or alias password, right?

Any way to get the CA certificate into the keystore and still have it work as intended?

Is there some way to use the data in the csr file to create the alias entry I need in the keystore?

Thanks for any suggestions.

John

Message was edited by:

JMCraig

[1132 byte] By [JMCraiga] at [2007-10-3 10:35:11]
«« Weblogic GC Problem - Please assist
»» need some help starting this program
# 1
Not unless you can recover the keystore. It contained the private key corresponding to the public key embedded in the signed cert. If you can't get the private key back the signed cert is useless.
ejpa at 2007-7-15 5:58:33 > top of Java-index,Security,Cryptography...
# 2

Seeing this line in the keytool docs:

Which type of import is intended is indicated by the value of the -alias option:

* If the alias points to a key entry, then keytool assumes you are importing a certificate reply. keytool checks whether the public key in the certificate reply matches the public key stored with the alias, and exits if they are different.

I'm wondering if this might work:

Use CertificateFactory to read in the csr as a certificate (this may not work anyway, but if it did...);

Use Keystore.setCertificateEntry() to save that into the keystore with an appropriate alias.

Then use keytool -import to load the signed certificate.

Any hope for that?

John

JMCraiga at 2007-7-15 5:58:33 > top of Java-index,Security,Cryptography...
# 3
No surprise. The certificate request won't read in as a certificate.Simply out of luck, I guess. Time to check the backups one last time.John
JMCraiga at 2007-7-15 5:58:33 > top of Java-index,Security,Cryptography...
Security
Cryptography

Security New Topic

Security Hot Topic

Security

All Classified