I'm trying to create a password vault for JBoss 6.1.1
First, I do:
keytool -genkey -alias vault -keystore passwords.keystore -keyalg RSA -keysize 1024 -storepass password -keypass password -dname "CN=DSA vault,OU=RIS,O=Company,L=City,ST=State,C=DE"
Then I call vault.sh in jboss/bin, enter all the values as requested and the output is this:
Secured attribute value has been stored in vault.
Please make note of the following:
********************************************
Vault Block:test
Attribute Name:encrypted
Configuration should be done as follows:
VAULT::test::encrypted::1
********************************************
when it should be somethin like this:
Please make note of the following:
********************************************
Vault Block:test
Attribute Name:encrypted
Shared Key:ZDc1Y2Q5Y2EtZGRjNC01YTU1LWJiOTgtYzcwODYyNTIzYjJkTElORV9CUkVBS2RzYXZhdWx0
Configuration should be done as follows:
VAULT::test::encrypted::ZDc1Y2Q5Y2EtZGRjNC01YTU1LWJiOTgtYzcwODYyNTIzYjJkTElORV9CUkVBS2RzYXZhdWx0
********************************************
So it doesnt generate a hash. I'm kinda stuck, have googled it, but found nothing. Cane someone point me in the right direction? Thx!!
Got it myself:
The mechanism for the vault changed between the versions. The missing hash is expected behavior, there just needs to be the "1" as a placeholder.
Related
I have a customer who wants to implement SAML2 SSO, the customer will be the Identity Provider (IDP) and my web application will effectively be the Service Provider (SP).
But my customer only give me the certificate file (.crt) and metadata xml file, and i checked the openSAML code which need SPKeystore.jks to initialize KeyStore Object.
So how to implements the service provider without the .jks file?
Is the jks file necessary ?
who know it, thanks a lot!
you create the keystore (jks) yourself and add the certificate to it. In a java environment, you use the keytool for doing so.
You can use keytool import certificate file into SPKeystore.jks
keytool -import -alias <alias> -trustcacerts -file <xx.crt> -keystore SPKeystore.jks -storepass <SPKeystorePassPhrase>
Using ionic app I have released my first version. So its crossed ore than 10,000 downloads and user are using my app. Now I want to release some update with my app. So I release the unsigned apk, but when I do this step :
jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore HelloWorld-release-unsigned.apk alias_name
it was asking the password for my-release-key.keystore but I forgot the password. Please give me some solution.
I tried to create new
keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
But when I release the update and upload in app store, I am getting the error last update certificate is not match with this build. When I Google it, it's because of the newly generated my-release-key.keystore.
According to this SO questions accepted answer there is no way to retrieve a lost keystore password.
But in some of the more recent non-accepted answers people claim to have found solutions to retrieve lost keystore passwords. Maybe you want to check those out?
If you don't get a hold of the lost password the only thing you can do is to re-submit (unpublish current app and publish a new one with the same title and description) your app with a newly created keystore. If that is the case, be sure to store your password in a secure location :)
Sometimes you can find the password in the following temp Gradle file:
<YourProjectRoot>\platforms\Android\.gradle\<version>\taskArtifacts\taskArtifacts.bin
Open that file with a plain text editor and search for "password". You should see it there in plain text. Please note it may have some special characters around it, but you will probably recognize the characters you used for the password originally.
I hope this helps!
I'm currently creating an Android app, which is supposed to send a POST request to a server. Unfortunately, the server is using self-signed certificate. So I have to create a PKCS12 keystore, which will include the CA Certificate, and make my App use that keystore.
To create such a keystore, I'm currently using the command below:
keytool -import -trustcacerts -alias my-alias -file cacert.pem
-keystore mykeystorefile -storetype PKCS12
Unfortunately the keystore doesn't work. (Request fails on SSL handshake.)
When I inspected the keystore using this command:
keytool -list -v -keystore mykeystorefile
I noticed a strange line at the very end of this list.
#8: ObjectId: 2.5.29.18 Criticality=false
Unparseable IssuerAlternativeName extension due to
java.io.IOException: No data available in passed DER encoded value.
0000: 30 00 0.
*******************************************
*******************************************
Keytool failed to parse an extension, which is part of the CA certificate.
I tried the same for LetsEncrypt's CA certificates and it worked just fine.
I'd be glad for any pointers on how to approach and solve this problem.
Thanks.
Edit: Keytool I'm currently using is part of java-8-openjdk.
Edit2: So after inspecting the ca certificate, Issuer Alternative Name extension doesn't have any value. Wondering if there is a way how to skip that extensions?
There is no way to skip anything that's on a certificate.
If the Issuer Alternative Name is blank, whoever generated that certificate has generated it wrong. If it is a self-signed certificate, the Issuer Alternative Name and the Subject Alternative Name are the same value. If it is signed by any CA, the CA's Subject Alternative Name is put in the end user's Issuer Alternative Name.
You might need to ask them for the right CA certificate.
I don't have much knowledge in this area, but i have still tried to do things by googling. Here is the problem i am facing.
Case 1(Works):
I have a CA signed certificate and i would like to use it in my Web Application. I first created a keystore. I see that it creates an entry type "keyEntry" in the keystore. Then i import the CA signed certificate to the keystore created.
Here are the steps:
keytool -genkeypair -keystore keystore.jks
I see an entry in the keystore of type "keyEntry" of alias "mykey"
Now i import the certificate:
keytool -importcert -alias abc -file cert.crt -keystore keystore.jks
Now i see another entry of trype "trustedcertEntry".
With this keystore i am able to access my web application when i uploaded it.
Case 2 (doesn't work):
I create a keystore on the fly while importing the certificate.
keytool -importcert -alias abc -file cert.crt -keystore keystore2.jks
Here i see only one entry type which is "trustedcertEntry"
With this keystore i am not able to access my web application.
Question:
What is key entry type "keyEntry" and "trustedcertEntry" and why does my keystore works only when i have the entry type "keyEntry"
My understanding of keytool is tenuous at best but I think the trick is that with Case 2, by omitting the -genkeypair, you're not generating the necessary private key.
In Case 1, the steps you're using are: create a private key pair (public key and private key), and then import a certificate into the trusted certificates for the keystore. Presumably you have another certificate in the keystore that's joining with the private key though it's possible the trusted cert is acting as the cert or your application isn't using a joined keypair/cert in the same file.
I can say that a 'trustedCertEntry' is a certificate which is trusted by the keystore. This is essential for allowing certificate chains (ex: Root-CA signs Intermediate-CA1 which signs End-Cert1. Without having both Root-CA and Intermediate-CA1 as trustedCertEntry, the keystore doesn't trust the end cert). TrustedCertEntry do not have private keys associated with them, only the public key the certificate contains.
A keyEntry (I think!) is a public/private key pair without the certificate.
A privateKeyEntry is a public/private key pair with an associated CA-signed or self-signed certificate.
Im sitting with a bit of a problem. Im busy creating a php/html website (intranet) for our support team to make life a bit easier when support linux machines.
I have a .jar app called mindterm (the free version) and want to run it as an applet in the site.
However according to their site you have to have the .jar file signed before loading it as an applet otherwise it cant open tcp connections.
So i did as much research as i could in the time i had and came up with the jarsigner.exe and keytool.exe files provided in the JDK installation.
However i do not have a clue how to go about signing this app so that i can actually use it.
Any help?
Thanks
First create a key-pair using keytool.
keytool -genkey -alias somekeyname
Then use jarsigner to sign it with the key you just created.
jarsigner /path/to/jar somekeyname
Note, you need to use the same alias (somekeyname here) as the one you create the key with.
Now, since the certificate is self-signed, the user of your applet will be prompted to approve the certificate. Once they do so, your tcp connections should work.
Since I assume you're only using the applet internally in your organization, self-signed certs should be fine. Otherwise you will have to pay for a certificate. In that case, your users will not need to accept the certificates after the first time (if they choose Always Allow").
You can sign jars using :
Install this Eclipse plugin
Eclipse Webstart Plugin.
You will just need to export as "Webstart". It will prompt you to sign the jars.
DEMO
Combined the top answer with some useful hints to get completely unattanded script:
keytool -genkey -noprompt -alias Alias -dname "CN=Hostname, OU=OrganizationalUnit, O=Organization, L=City, S=State, C=Country" -keystore path.to.keystore -storepass password -keypass password -validity 3650
jarsigner -keystore path.to.keystore -storepass password -keypass password -signedjar signed.jar unsigned.jar Alias
This is a somewhat complex area, and you essentially need to know what you are doing, and you may have to pay real money for a signing certificate.
The Sun Java Tutorial cover the topic well: http://docs.oracle.com/javase/tutorial/deployment/jar/signing.html
If the intent is to give the support people a ssh client, there might be better solutions.