Linux Tutorials and Command Line Guides - Page 12

Fix Java No subject alternative names present by adding DNS and IP SAN entries with keytool -ext SAN so the certificate matches the hostname or IP clients use.

Fix keytool Failed to establish chain from reply by importing missing intermediate and root CA certificates before the server reply, using the correct keystore alias, or importing a complete PKCS7 chain bundle.

Fix keytool Certificate not imported, alias already exists by listing aliases, deleting or renaming the old entry, and re-importing to the correct keystore with a unique alias.

Fix keytool Input not an X.509 certificate by importing valid PEM, DER, or supported certificate-chain input instead of HTML, private keys, PFX files, or malformed PEM.

Fix java.security.UnrecoverableKeyException: Cannot recover key by aligning keystore and private key passwords in Tomcat, Spring Boot, and KeyManagerFactory.

Fix keytool Keystore was tampered with, or password was incorrect by checking storepass, file path, JKS vs PKCS12, cacerts, import passwords, and corruption.

Enable Spring Boot HTTPS on port 8443 with a PKCS12 keystore from keytool, set server.ssl.key-store in application.properties, add an optional truststore for private CAs, and verify with Java HttpClient.

Enable Tomcat 10 HTTPS on port 8443 with a PKCS12 keystore from keytool: import the CA chain before the server certificate, set certificateKeystoreFile in server.xml, and verify the TLS handshake.

Fix javax.net.ssl.SSLHandshakeException PKIX path building failed by importing your private CA chain into a PKCS12 truststore with keytool, then point the JVM at it with javax.net.ssl.trustStore — without editing …

Generate a private key with keytool -genkeypair, build a CSR with -certreq, sign it with a local OpenSSL CA, and replace the self-signed entry using -importcert on the same alias.

Fix keytool error Public keys in reply and keystore do not match by importing the signed certificate into the same alias that generated the CSR. Verify public-key hashes and distinguish this error from missing CA chain …

Generate a PKCS12 keystore with keytool -genkeypair, add DNS and IP Subject Alternative Names for localhost and 127.0.0.1, verify with keytool -list -v, and see why CN alone fails modern HTTPS hostname checks.

Import a CA or TLS certificate into Java cacerts on Ubuntu, Debian, RHEL, and Rocky Linux with keytool -importcert: locate cacerts, use a copy for safe testing, default password changeit, and distro-specific system trust …

Import a TLS chain into a Java PKCS12 keystore with keytool: root CA and intermediate as trustedCertEntry, server reply on the PrivateKeyEntry alias, correct order, -trustcacerts, and chain verification with keytool …

Compare keytool and OpenSSL for CSR generation, remote certificate inspection with openssl s_client, PEM key handling, PKCS12 creation, Java keystore import, and TLS chain debugging — with a task-by-task table so you …

Rename keystore aliases with keytool -changealias, rotate the store password with -storepasswd, change per-key passwords on JKS (not PKCS12), and remove entries with -delete — with real PKCS12 and JKS output from Ubuntu.

Export a certificate from a Java keystore with keytool -exportcert: DER binary without -rfc, PEM text with -rfc, verify with keytool -printcert and file, and know when the private key is not included.

Use keytool -list and keytool -list -v to read keystore aliases, entry types, SHA-256 fingerprints, certificate expiry, and Subject Alternative Names on PKCS12 files, plus an awk one-liner to spot certificates nearing …

Convert Java JKS keystores to PKCS12 and PKCS12 back to JKS with keytool -importkeystore, understand the proprietary JKS warning, and learn why OpenJDK defaults to PKCS12 since Java 9 (JEP 229).

Import a PKCS12 or PFX bundle into a Java keystore with keytool -importkeystore, use PKCS12 directly as the store type on OpenJDK 9+, merge into an existing keystore, and verify PrivateKeyEntry after import.

keytool cannot import a PEM private key on its own. Learn why -importcert creates trustedCertEntry instead of PrivateKeyEntry, then wrap cert and key with openssl pkcs12 -export and use keytool -importkeystore for a …

A Java keystore holds your TLS identity (private key and certificate chain). A truststore holds CA certificates you trust when validating peers. Learn PrivateKeyEntry vs trustedCertEntry, cacerts vs custom truststore, …

Prefer a custom PKCS12 truststore over editing JDK cacerts: isolate private CA trust per app, survive package upgrades, and set javax.net.ssl.trustStore without touching the global Java CA bundle.

Fix keytool command not found on Ubuntu by installing OpenJDK (default-jdk or openjdk-21-jdk), set JAVA_HOME and PATH, verify with keytool -help, run a PKCS12 smoke test, update through apt, and uninstall cleanly.

Compare OpenSSL, LibreSSL, and BoringSSL for TLS and cryptography: intended audience, API stability, FIPS, how Linux distributions package each library, and when each is the right choice—with commands to verify what your …

Beginner-friendly PKI tutorial: public keys, X.509 certificates, Certificate Authorities, trust chains, SAN extensions, PEM and PFX formats, CRL vs OCSP revocation, TLS and mTLS handshakes—with diagrams and OpenSSL …

Create a PKCS12 (.p12) keystore from CRT and KEY with OpenSSL pkcs12 -export for Java keytool, Oracle JSSE, and IBM apps. Covers alias, chain, self-signed certs, -legacy for older Java, cert-only bundles, and …

Create a PFX or P12 file from CRT and KEY with OpenSSL pkcs12 -export: add intermediate chain with -certfile, set export password with -passout, and use -legacy for Windows IIS. Copy-paste examples with verification …

Use OpenSSL pkcs12 to extract a private key, certificate, and CA chain from a PFX or P12 file on Linux. Covers password-protected and empty-password PFX, unencrypted PEM for nginx, -legacy for old Windows exports, and …

Verify a certificate matches a private key with OpenSSL: compare RSA modulus MD5 hashes, use pkey -pubout for EC and ECDSA, check CSR alignment, and test encrypted keys. Covers nginx mismatch errors and copy-paste …