Importing a Certificate Reply
When importing a certificate reply, the certificate reply is validated using trusted certificates from the keystore, and optionally using the certificates configured in the "cacerts" keystore file (if the -trustcacerts option was specified).
The methods of determining whether the certificate reply is trusted
are described in the following:
- If the reply is a single X.509 certificate, keytool attempts to establish a trust chain, starting at the certificate reply and ending at a self-signed certificate (belonging to a root CA). The certificate reply and the hierarchy of certificates used to authenticate the certificate reply form the new certificate chain of alias. If a trust chain cannot be established, the certificate reply is not imported. In this case, keytool does not print out the certificate and prompt the user to verify it, because it is very hard (if not impossible) for a user to determine the authenticity of the certificate reply.
- If the reply is a PKCS#7 formatted certificate chain, the chain
is first ordered (with the user certificate first and the self-signed
root CA certificate last), before keytool attempts to match the root
CA certificate provided in the reply with any of the trusted certificates
in the keystore or the "cacerts" keystore file (if the -trustcacerts option
was specified). If no match can be found, the information of the root
CA certificate is printed out, and the user is prompted to verify
it, e.g., by comparing the displayed certificate fingerprints with
the fingerprints obtained from some other (trusted) source of information,
which might be the root CA itself. The user then has the option of
aborting the import operation. If the
-nopromptoption is given, however, there will be no interaction with the user.
If the public key in the certificate reply matches the user's public key already stored with under alias, the old certificate chain is replaced with the new certificate chain in the reply. The old chain can only be replaced if a valid keypass, the password used to protect the private key of the entry, is supplied. If no password is provided, and the private key password is different from the keystore password, the user is prompted for it.