keytool , JKS and orapki

This post will cover keytool, JKS and orapki

1) What is keytool
The Java Keytool is a command line tool that can work with Java KeyStore files. The Keytool can generate key pairs into a KeyStore file, export certificates from, and import certificates into a KeyStore and several other functions.
keytool utility is available when you install Java sdk. Here are a few commonly used keytool commands.
See below keytool under java 1.8 version. Default location is where you installed JDK, e.g. C:\Program Files\Java\jdk1.8.0_45\bin>

Keytool command

---------------------------------------------------------------------------------
2) What is Java Keystore (JKS)
JKS is a container that stores the signature and encryption keys required by the X.509 token on the client. JKS is a proprietary keystore format defined by Sun Microsystems/now Oracle Java. Trusted certificates and public and private keys are stored in the keystore. JKS protects private keys with a password for security. To create and manage the keys and certificates in the JKS, use the keytool utility. Keys are used for a variety of purposes, including authentication and data integrity.

Following are steps to creating a Java keystore.
1. create a new .jks file that contains only the private key. You will need to provide a password to protect this private key
2. create a Certificate Request or CSR. CSR is required so that you can send this initial certificate request to your Certificate Authority (CA), who in turn will sign the request and provide a Certificate.
3. Next, you import this Certificate to the keystore. Also import the root certificates from the CA.
Now your JKS contains the private and public key.
---------------------------------------------------------------------------------

3) What is orapki - read here
orapki is a utility for
Create, View signed certs
Manage Oracle wallets
create and display Oracle wallets
add/remove certificates
Manage CRLs
--------------------------------------------------------------------------------
References
(1) Good overview of SSL and its implementation in Oracle Fusion Middleware
(2) oraki utility
(3) Create self-signed certificate using keytool
----------------------------------------------

How to create certificate.pem certificate and key.pem key?

Use openssl toolkit

Add these two files to the keystore
The above .pem files need to be converted to .der files, cerficate.der and key.der. Next you import these .der file to the keystore (.jks)
----------------------------------------------
Use keystore (.jks) to signed SAML responses

Create a keystore (*.jks) for SAML in order to make it signed.
Use openssl toolkit to create a certificate.pem certificate and key.pem key. Convert both these to certificate.der and key.der in order to add in keystore(*.jks). Import these to the keystore using a JAVA class given here. It will create a keystore(*.jks) to be used to make signed SAML response.
----------------------------------------------