Java Keytool Introduction

RSA Certificate Signing Request (CSR) for a Certificate Authority (CA) w/ PKCS12 Keystore

Generate a Certificate Signing Request (CSR) - RSA with PKCS12 Keystore

The following example explains how to create a Certificate Signing Request (CSR) from a RSA PKCS12 Keystore. The CSR will be forwarded to an Internal Certificate Authority (CA) or External CA (Thawte, DigiCert, Sectigo and so on) for verification. Keytool command options are listed at the bottom of the page.

The following breaks down the options we will use:

Create the CSR: -v (Verbose)
Name and location of file: site.csr
Signature Algorithm (sigalg): SHA224withRSA / SHA256withRSA / SHA384withRSA / SHA512RSA
Signature Algorithm, Key Algorithm and is valid for 365 days (~1 years).
keytool -certreq -v -sigalg SHA512withRSA -keyalg RSA -validity 365

The password of the private key is "PWKey123" from the previous step. The key pair we created is stored in the keystore file this.keystore with format PKCS12.
-alias serverkey -keypass PWKey123

The keystore file name, the Keystore is of PKCS12 type and password of the keystore is "changeit".
-keystore that.keystore -storetype pkcs12 -storepass changeit

The first name is the Domain Name Service (DNS) will reference. The others listed maybe used for Subject Alternative Names

Creating a Certificate Signing Request (CSR) from an RSA PKCS12 keystore

Create the Certificate Signing Request (CSR)
 Copy keytool -certreq -v -file site.csr -sigalg SHA384withRSA -alias serverkey -keypass PWKey123 -keystore that.keystore -storetype pkcs12 -storepass changeit -ext,dns:server,ip:,ip:::1 
Check the keys and keystore creation
 Copy keytool -printcertreq -file site.csr 


RSA based options

-sigalg      SHA256withRSA or SHA384withRSA or SHA512withRSA - Default is MD5withRSA Please use SHA256withRSA or SHA384withRSA or SHA512withRSA
-keyalg    Keysize ranges from 512 bits to 16,384 bits - Default is 1024!Please use 2048 or preferred 4096 - Safari breaks with anything greater than 4096 and most browsers cannot handle greater than 8192