J
js
http://java.sun.com/j2se/1.5.0/docs/tooldocs/solaris/keytool.html
I have a client certificate issued by a non-standard CA ( that is, the CA is self-signed by an external entity and is not part of the cacerts file ).
This client certificate is in my keystore ( with entry type as keyEntry ).
Alias name: < .... ALIAS BLAH ... >
Creation date: 5/01/2004
Entry type: keyEntry
Certificate chain length: 2
Certificate[1]:
Owner: < ....BLAH .....>
Issuer: < ....ISSUER BLAH .....>
Serial number: 279d
Valid from: Thu Jan 02 21:00:00 EST 2003 until: Sun May 18 11:42:29 EST 2008
Certificate fingerprints:
MD5: 94
1:60:A9:07:A1:30:76:3D:10:5B:5B:07:6E4:1B
SHA1: F7:C3:4E:05:35:33:6F:83:FB:11:C7:8C:BD:6D3:7B:E5:79:AB:87
Certificate[2]:
Owner: < ....ISSUER BLAH .....>
Issuer: < ....ISSUER BLAH .....>
Serial number: 0
Valid from: Mon Jul 01 10:00:00 EST 1996 until: Sat Jul 01 10:00:00 EST 2006
Certificate fingerprints:
MD5: 1A:AB:4D:57:0A:3F8:76:AF:7B:76:CF:E7:FC:33:C5
SHA1: 86:54:C1:3E:0D:44:62:38:1F:A8:59:26:51C:B1:B9:F4:BD:C6:0F
Now the self-signed ( by an external entity ) CA certificate in that chain has expired as shown above, and a new self-signed ( by an external entity ) CA certificate was issued.
Owner: < ....ISSUER BLAH .....>
Issuer: < ....ISSUER BLAH .....>
Serial number: 0
Valid from: Mon Jul 01 10:00:00 EST 1996 until: Fri Jul 01 10:00:00 EST 2016
Certificate fingerprints:
MD5: A6:41:B9:09:43:F0:08:42:B1:80:795:A3:97:5B:5D
SHA1: 25:6E:C2:24:CB:24:CD:70:68:55:EA:98:1E:E4:9D:88:A1:F8:789
If I import the new self-signed ( by an external entity ) CA certificate into cacerts file, the SSL connection to the remote HTTPS host will eventually still use the expired CA instead of using the new CA cert.
So my question is, can you actually "remove" the expired-CA in the chain in the keyentry in the keystore ?
I tried exporting the keyEntry, which only exported the client certificate in the chain. So I guess I found the solution ( or so I thought ).
However, if I import it back, it is being imported as a "trustedCert" entry instead of a "keyEntry".
Thus, if I then delete the keyEntry that had the expired CA in its chain, the "trustedCert" entry is not used ... since JSSE uses entries of type "keyEntry".
I have a client certificate issued by a non-standard CA ( that is, the CA is self-signed by an external entity and is not part of the cacerts file ).
This client certificate is in my keystore ( with entry type as keyEntry ).
Alias name: < .... ALIAS BLAH ... >
Creation date: 5/01/2004
Entry type: keyEntry
Certificate chain length: 2
Certificate[1]:
Owner: < ....BLAH .....>
Issuer: < ....ISSUER BLAH .....>
Serial number: 279d
Valid from: Thu Jan 02 21:00:00 EST 2003 until: Sun May 18 11:42:29 EST 2008
Certificate fingerprints:
MD5: 94
1:60:A9:07:A1:30:76:3D:10:5B:5B:07:6E4:1BSHA1: F7:C3:4E:05:35:33:6F:83:FB:11:C7:8C:BD:6D
3:7B:E5:79:AB:87Certificate[2]:
Owner: < ....ISSUER BLAH .....>
Issuer: < ....ISSUER BLAH .....>
Serial number: 0
Valid from: Mon Jul 01 10:00:00 EST 1996 until: Sat Jul 01 10:00:00 EST 2006
Certificate fingerprints:
MD5: 1A:AB:4D:57:0A:3F
8:76:AF:7B:76:CF:E7:FC:33:C5SHA1: 86:54:C1:3E:0D:44:62:38:1F:A8:59:26:51
C:B1:B9:F4:BD:C6:0FNow the self-signed ( by an external entity ) CA certificate in that chain has expired as shown above, and a new self-signed ( by an external entity ) CA certificate was issued.
Owner: < ....ISSUER BLAH .....>
Issuer: < ....ISSUER BLAH .....>
Serial number: 0
Valid from: Mon Jul 01 10:00:00 EST 1996 until: Fri Jul 01 10:00:00 EST 2016
Certificate fingerprints:
MD5: A6:41:B9:09:43:F0:08:42:B1:80:79
5:A3:97:5B:5DSHA1: 25:6E:C2:24:CB:24:CD:70:68:55:EA:98:1E:E4:9D:88:A1:F8:78
9If I import the new self-signed ( by an external entity ) CA certificate into cacerts file, the SSL connection to the remote HTTPS host will eventually still use the expired CA instead of using the new CA cert.
So my question is, can you actually "remove" the expired-CA in the chain in the keyentry in the keystore ?
I tried exporting the keyEntry, which only exported the client certificate in the chain. So I guess I found the solution ( or so I thought ).
However, if I import it back, it is being imported as a "trustedCert" entry instead of a "keyEntry".
Thus, if I then delete the keyEntry that had the expired CA in its chain, the "trustedCert" entry is not used ... since JSSE uses entries of type "keyEntry".