keytool

A key and certificate management utility that lets users administer their own public/private key pairs and associated certificates.

Runs as keytool|macOS, Linux, Windows|docs.oracle.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

keytool in your home directory Every rule on this page, by file

· ~/.keystore Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/keytool/otty.tomlThe file this page is generated from

id = "keytool"

name = "keytool"

homepage = "https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html"

description = "A key and certificate management utility that lets users administer their own public/private key pairs and associated certificates."

executables = ["keytool"]

[dotfiles]

# keytool has no configuration file of its own: every option is a command line

# argument, and the only thing it leaves in the user's home directory is the

# keystore it manages.

paths = []

exclude = []

# The default keystore. Oracle's keytool(1) says so twice: the option value

# summary lists `-keystore <the file named .keystore in the user's home

# directory>`, and the `-keystore` description says "the default keystore file

# named .keystore is created in the user's home directory if it doesn't already

# exist".

# https://docs.oracle.com/en/java/javase/21/docs/specs/man/keytool.html

# OpenJDK's implementation agrees — sun/security/tools/keytool/Main.java:

# if (ksfname == null) {

# ksfname = System.getProperty("user.home") + File.separator + ".keystore";

# }

# `user.home` is %USERPROFILE% on Windows, which resolves to the same `~/` this

# path already names, so there is no second Windows spelling.

# The file is a binary JKS/PKCS#12 keystore holding private keys. It is a

# credential end to end, and it is portable: the keystore is protected by its

# own password rather than bound to the machine that created it.

secret = ["~/.keystore"]

[commands]

format = 1

label = "keytool"

description = "List keystore entries and generate key pairs. Passwords are deliberately not fields; keytool prompts for them. Other commands are left out."

quality = "ai-draft"

base = "fig:keytool"

parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/keytool.ts"

license = "MIT"

[[commands.subcommand]]

path = ["-list"]

label = "List keystore entries"

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/keytool.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "keystore"

label = "Keystore"

type = "path"

option = ["-keystore"]

path = { kind = "file", role = "input" }

sources = ["fig"]

[[commands.subcommand.field]]

id = "alias"

label = "Alias"

type = "string"

option = ["-alias"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "cacerts"

label = "Use cacerts"

type = "boolean"

option = ["-cacerts"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "verbose"

label = "Verbose"

type = "boolean"

option = ["-v"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "rfc"

label = "RFC style output"

type = "boolean"

option = ["-rfc"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "list"

label = "List a keystore"

fields = ["keystore", "verbose"]

required = ["keystore"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["keystore", "alias", "cacerts", "verbose", "rfc"]

[[commands.subcommand]]

path = ["-genkeypair"]

label = "Generate a key pair"

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/keytool.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "alias"

label = "Alias"

type = "string"

option = ["-alias"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "keystore"

label = "Keystore"

type = "path"

option = ["-keystore"]

path = { kind = "file", role = "output", must_exist = false }

effect = "overwrite"

sources = ["fig"]

[[commands.subcommand.field]]

id = "keyalg"

label = "Key algorithm"

type = "string"

option = ["-keyalg"]

suggestions = [{ value = "RSA", label = "RSA" }, { value = "EC", label = "EC" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "keysize"

label = "Key size (bits)"

type = "integer"

option = ["-keysize"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "validity"

label = "Validity (days)"

type = "integer"

option = ["-validity"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "dname"

label = "Distinguished name"

description = "For example CN=Example, O=Org, C=US."

type = "string"

option = ["-dname"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "rsa"

label = "RSA 2048 key pair, one year"

set = { keyalg = ["RSA"], keysize = [2048], validity = [365] }

fields = ["alias", "keystore", "keyalg", "keysize", "validity", "dname"]

required = ["alias", "keystore"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["alias", "keystore", "keyalg", "keysize", "validity", "dname"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/keytool. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.