This week's giveaway is in the Android forum.
We're giving away four copies of Android Security Essentials Live Lessons and have Godfrey Nolan on-line!
See this thread for details.
The moose likes Security and the fly likes CA how it's work? Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of Android Security Essentials Live Lessons this week in the Android forum!
JavaRanch » Java Forums » Engineering » Security
Bookmark "CA how it Watch "CA how it New topic
Author

CA how it's work?

moneer mohammed
Ranch Hand

Joined: Feb 18, 2005
Posts: 66
hi guys
Please I have some problem about the step I need to flow for understanding SSL how it's work
What I know have to give the CA my CSR but for creating CSR I have to use my private key
Then I will import this certificate I got from CA to my keyStore, now the peivate key that will be use for encryption is the private key I have in my keystore or CA will give me private key in the certificate I got from them and what about public key from where I will get it


Thanks in advance

java_just
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 41133
    
  45
Both keys go together; wherever you get one, you get the other. See http://en.wikipedia.org/wiki/Public_key_infrastructure, http://en.wikipedia.org/wiki/Certificate_signing_request and http://en.wikipedia.org/wiki/Key_pair.


Ping & DNS - my free Android networking tools app
greg stark
Ranch Hand

Joined: Aug 10, 2006
Posts: 220
In addition to Ulf's links, here is how the process should work in general. Please compare these steps against your understanding.

1. Create a new keypair using keytool -genkeypair -alias pickagoodalias <...other options...>
This create both a private key and an associated public key. At no point will the private key ever leave the keystore. You will need to remember the alias you used.

2. Create a CSR using keytool -certreq -alias pickagoodalias <...other options...>
This creates a CSR. The CSR contains only the public key in addition to identifying information.

3. Give the CSR to a certificate authority (CA).

4. Retrieve the signed X509 certificate from the CA. This contains the same public key you created in step 1 and gave to the CA in step 3.

5. Install the certificate into the same keystore as in step 1, using the same alias you used in step 1, with keytool -importcert -alias pickagoodalias <...other options...>
This step will also double check that the public key in the certificate your are importing is the same as the one you created in step 1.


Nice to meet you.
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: CA how it's work?
 
Similar Threads
Failed to Establish Chain from Reply
Basic Authenication with SSL?
SATSA jsr 177
SSL issues with cacerts (-trustcacerts option)
SSL Basic Concepts