Take the 2-minute tour ×

I created Java keystore programmatically of type jks (i.e. default type).
It is initially empty so I created a DSA certificate.

keytool -genkey -alias myCert -v -keystore trivial.keystore

How can I see the public and private keys?
I.e. is there a command that prints the private key of my certificate?
I could only find keytool -certreq which in my understanding prints the certificate as a whole:


I assume this is the whole certificate. How can I see private (or public key) via keytool?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

You created a private (and associated public) key in your keystore. For it to be really usable, you can get it signed by a certification agency (CA) - for this is the -certreq command (you send the output to this certification agency, along with some other information and a bit of money, and they send back a certificate, which you can then import in your keystore.)

Viewing the private key is not intended ... you usually don't need this, since you use the keystore in your Java program, and this knows how to use it.

Edit: Since you want to look at your keystore, here a quick Java program which does this:

import java.io.*;
import java.security.*;
import java.security.cert.Certificate;

public class KeyPrinter {

     * to be invoked with these parameters:
     * [0]:  keystore-password
     * [1]:  filename
     * [2]:  alias
     * [3]:  entry-Password (if necessary)
    public static void main(String[] params)
        throws IOException, GeneralSecurityException
        char[] storePass = params[0].toCharArray();
        String fileName = params[1];
        String alias = params[2];
        KeyStore.ProtectionParameter entryPass;
        if(params.length > 3) {
        entryPass=new KeyStore.PasswordProtection(params[3].toCharArray());
        } else {
            entryPass = null;
        KeyStore.ProtectionParameter entryPass =

        KeyStore store = KeyStore.getInstance("JKS");
        InputStream input = new FileInputStream(params[1]);
        store.load(input, storePass);

        KeyStore.Entry entry = store.getEntry(alias, entryPass);


First call keystore -list -keystore myStore to know which alias to look for, then call this program with the passwords and parameters. In case of a private key entry, it shows the key itself and additionally a self-signed certificate which contains the public key, in a readable form. In case of a "trusted certificate", it shows only the public key.

share|improve this answer
Ok, so viewing private key is not intented.What about public key?Is there a command to display public key? –  Cratylus Feb 5 '11 at 17:17
I just added a simple java class for viewing the keystore. (It was quite a bit more complicated, I even tried to format the key myself ... until I had the idea to try the toString() method.) –  Paŭlo Ebermann Feb 5 '11 at 23:21

No, you cannot.
You can access the private key from code, but you cannot export it using the keytool.
Use OpenSSL if you need to export private key.

Another option: you can generate keystore in PKCS12 format. Then you can import it to a browser and then to export the private key.

share|improve this answer

(Portecle) is a very convenient GUI tool for managing keystores. And among other things it have an option to export private key and its associated certificate.

The common way to share your public key is to share a certificate for your keypair (it contains your public key inside)

share|improve this answer

Your Answer


