Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Keytool's -storepass vs. -keypass -- Why 2 passwords?

I understand that the -keypass option is for "the password for the key" and that the -storepass option is for "a password for the keystore".

I don't understand, however, why two passwords are needed.

What scenarios are there for requiring 2 passwords: One for the store (file, in my case) and one for the key.

like image 730
ef2011 Avatar asked May 10 '11 18:05

ef2011


People also ask

What is the difference between keystore password and key password?

Keystore is a binary file that contains a set of private keys. Private key represents the entity to be identified with the app, such as a person or a company. So Keystore password is used to open a keystore and simple password is password of private entity stored in keystore file..!!

Why does keystore need a password?

You can set a password to protect keystores and private keys that are stored on the Management and Security Server. The password set here protects the keystores in the MSSData/trustedcerts folder, which includes: the Management and Security Server certificate and private key. the client certificate and private key.

What is difference between keystore and Trustore?

Keystore is used to store private key and identity certificates that a specific program should present to both parties (server or client) for verification. Truststore is used to store certificates from Certified Authorities (CA) that verify the certificate presented by the server in SSL connection.

What is the password for Keytool?

The default server password is changeit . The keytool application is included in the Java developer kit and is not part of IBM® UrbanCode Deploy. The default server alias is server .


1 Answers

This is due to how Java handles keystores so it's not an Android specific issue. The reason though is because access to a store such as adding/viewing trust relationships is a separate task from creating and signing keys/certs.

In short, you may trust someone to view/update your keystore but not sign things with a key you store in the keystore. Plus, keys could be stored in multiple keystores and you want your keys locked down individually.

like image 94
Andrew White Avatar answered Sep 21 '22 16:09

Andrew White