keytool problem

[Wesley Baker]

I am trying to renew an SSL certificate with Verisign, and they recently upgraded their requirements to a minimum 2048 CSR keysize, so I can't use the old CSR I had originally.

When trying to generate a new CSR off of the original key pair, I am using:

keytool -certreq -keysize 2048 -keyalg RSA -alias server -file 20100422.csr -keystore keystore.jks

and it creates the file just fine. However, when i try to submit it, Verisign says its a weak key and is not 2048 or above. So I tried the same command without the keysize option:

keytool -certreq -keyalg RSA -alias server -file 20100422.csr -keystore keystore.jks

and it creates the exact same file. According to the documentation, it defaults to 1024.

So my question is, why is keytool not recognizing the keysize option?

[greg stark]

So my question is, why is keytool not recognizing the keysize option?

Well, what it should do is report an error because -keysize does not make any sense in the -certreq subcommand. Instead, it just silently ignores it. You probably are just recreating a CSR from your original old server key.

If you want to generate a new certificate request you must do it in two steps:

1) Generate a new keypair using the -genkeypair subcommand. With this subcommand you may specify a key size (-keysize) and an alias (-alias), and you must also specify the distinguished name that will appear in the CSR.

2) Generate the CSR with the -certreq subcommand and the same alias specified in 1.