https - 自建 https 证书 

Page / - 最后修改者 Qiongpan Ke 打开 2023-07-07 

自建 https 证书 
最后修改者 Qiongpan Ke
打开 2023-07-07

内容列表
1. 生成一个 RSA 私钥
2. 创建免密的 RSA 私钥
3. 导出 RSA 私钥对应的公钥
4. 生成一个 CA 根证书签名请求
5. 使用 RSA 私钥对 CA 根证书签名请求进行自签
6. 生成 https 服务器的 RSA 密钥
7. 创建免密的 RSA 私钥
8. 导出 RSA 私钥对应的公钥
9. 生成一个 https 证书签名请求
10. 使用 CA 根证书对 https 证书签名请求进行签发
11. 将私钥和证书打包成 p12 文件
12. 将 p12 文件转换为 jks 文件
13. 查看 https 证书内容

Contents
•	1. 生成一个 RSA 私钥
•	2. 创建免密的 RSA 私钥
•	3. 导出 RSA 私钥对应的公钥
•	4. 生成一个 CA 根证书签名请求
•	5. 使用 RSA 私钥对 CA 根证书签名请求进行自签
•	6. 生成 https 服务器的 RSA 密钥
•	7. 创建免密的 RSA 私钥
•	8. 导出 RSA 私钥对应的公钥
•	9. 生成一个 https 证书签名请求
•	10. 使用 CA 根证书对 https 证书签名请求进行签发
•	11. 将私钥和证书打包成 p12 文件
•	12. 将 p12 文件转换为 jks 文件
•	13. 查看 https 证书内容
参考文章：《Nginx自建SSL证书部署HTTPS网站》
1. 生成一个 RSA 私钥
openssl genrsa -aes256 -out ca_rsa_private.key 4096
执行结果如下：
$ openssl genrsa -aes256 -out ca_rsa_private.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
.........++++
....................................................................................................................................................................................................................................++++
e is 65537 (0x010001)
Enter pass phrase for ca_rsa_private.key:
Verifying - Enter pass phrase for ca_rsa_private.key:
$ ls -ltr
total 4
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
2. 创建免密的 RSA 私钥
相比需要输入密码的 RSA 密钥，使用免密的 RSA 密钥，配置在 web 容器中，不需要在每次启动或重新加载配置时手动输入密码（部份 web 容器则直接在配置文件中配置 RSA 密钥的密码）。
openssl rsa -in ca_rsa_private.key -out ca_rsa_private_nopass.key
执行结果如下：
$ openssl rsa -in ca_rsa_private.key -out ca_rsa_private_nopass.key
Enter pass phrase for ca_rsa_private.key:
writing RSA key
$ ls -ltr
total 8
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
3. 导出 RSA 私钥对应的公钥
openssl rsa -in ca_rsa_private_nopass.key -pubout -out ca_rsa_public.key
执行结果如下：
$ openssl rsa -in ca_rsa_private_nopass.key -pubout -out ca_rsa_public.key
writing RSA key
$ ls -ltr
total 12
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
4. 生成一个 CA 根证书签名请求
openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=Example.com's Root CA/emailAddress=iana@iana.org" -key ca_rsa_private_nopass.key -out ca.csr
执行结果如下：
$ openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=Example.com's Root CA/emailAddress=iana@iana.org" -key ca_rsa_private_nopass.key -out ca.csr
$ ls -ltr
total 16
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
5. 使用 RSA 私钥对 CA 根证书签名请求进行自签
# openssl x509 -req -days $((365 * 100)) -sha256 -extensions v3_ca -in ca.csr -signkey ca_rsa_private_nopass.key -out ca.crt

#mkdir -p ./demoCA
#touch ./demoCA/index.txt
#openssl ca -days $((365 * 100)) -md sha256 -extensions v3_ca -selfsign -in ca.csr -keyfile ca_rsa_private_nopass.key -out ca.crt -outdir . -create_serial

openssl req -x509 -days $((365 * 100)) -sha256 -nodes -in ca.csr -key ca_rsa_private_nopass.key -out ca.crt
执行结果如下：
$ openssl req -x509 -days $((365 * 100)) -sha256 -nodes -in ca.csr -key ca_rsa_private_nopass.key -out ca.crt
$ ls -ltr
total 20
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
6. 生成 https 服务器的 RSA 密钥
openssl genrsa -aes256 -out https_rsa_private.key 4096
执行结果如下：
$ openssl genrsa -aes256 -out https_rsa_private.key 4096
Generating RSA private key, 4096 bit long modulus (2 primes)
......................................++++
.............................++++
e is 65537 (0x010001)
Enter pass phrase for https_rsa_private.key:
Verifying - Enter pass phrase for https_rsa_private.key:
$ ls -ltr
total 24
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
7. 创建免密的 RSA 私钥
相比需要输入密码的 RSA 密钥，使用免密的 RSA 密钥，配置在 web 容器中，不需要在每次启动或重新加载配置时手动输入密码（部份 web 容器则直接在配置文件中配置 RSA 密钥的密码）。
openssl rsa -in https_rsa_private.key -out https_rsa_private_nopass.key
执行结果如下：
$ openssl rsa -in https_rsa_private.key -out https_rsa_private_nopass.key
Enter pass phrase for https_rsa_private.key:
writing RSA key
$ ls -ltr
total 28
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul  7 05:15 https_rsa_private_nopass.key
8. 导出 RSA 私钥对应的公钥
openssl rsa -in https_rsa_private_nopass.key -pubout -out https_rsa_public.key
执行结果如下：
$ openssl rsa -in https_rsa_private_nopass.key -pubout -out https_rsa_public.key
writing RSA key
$ ls -ltr
total 32
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul  7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:16 https_rsa_public.key
9. 生成一个 https 证书签名请求
openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=*.example.com/emailAddress=iana@iana.org" -key https_rsa_private_nopass.key -out https.csr
执行结果如下：
$ openssl req -new -subj "/C=US/ST=California/L=Los Angeles/O=example.com/OU=IANA/CN=*.example.com/emailAddress=iana@iana.org" -key https_rsa_private_nopass.key -out https.csr
$ ls -ltr
total 36
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul  7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul  7 05:16 https.csr
10. 使用 CA 根证书对 https 证书签名请求进行签发
创建的过期时间不要太长，建议不超过2年，否则部份浏览器不会信任该证书，如: iPhone 上的 Safari、Chrome 等。
另外，在 Chrome 58 之后，不再只校验 CommonName 项是否与访问域名或IP匹配，还需要配置 subjectAltName 项。
# 首次使用 CA 根证书签发 https 证书的同时创建 ca.srl 序列号参考文件
# 第二次以后使用 CA 根证书签发 https 证书时直接引用之前创建的 ca.srl 序列号参考文件，并递增其序列号。
openssl x509 -req -days $((356 * 2)) -sha256 -extfile <(cat /etc/ssl/openssl.cnf <(
cat <<EOF
[v3_san]
subjectAltName = @alt_names

[alt_names]
DNS.1 = example.com
DNS.2 = *.example.com
EOF
)) -extensions v3_san -CA ca.crt -CAkey ca_rsa_private_nopass.key -$(if [ -f ca.srl ]; then echo CAserial ca.srl; else echo CAcreateserial; fi) -in https.csr -out https.crt
执行结果如下：
$ openssl x509 -req -days $((356 * 2)) -sha256 -extfile <(cat /etc/ssl/openssl.cnf <(
t <<E> cat <<EOF
> [v3_san]
> subjectAltName = @alt_names
>
> [alt_names]
> DNS.1 = example.com
> DNS.2 = *.example.com
> EOF
> )) -extensions v3_san -CA ca.crt -CAkey ca_rsa_private_nopass.key -$(if [ -f ca.srl ]; then echo CAserial ca.srl; else echo CAcreateserial; fi) -in https.csr -out https.crt
Signature ok
subject=C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = *.example.com, emailAddress = iana@iana.org
Getting CA Private Key
$ ls -ltr
total 40
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul  7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul  7 05:16 https.csr
-rwxrwxrwx 1 stduser stduser   41 Jul  7 05:17 ca.srl
-rwxrwxrwx 1 stduser stduser 2106 Jul  7 05:17 https.crt
11. 将私钥和证书打包成 p12 文件
openssl pkcs12 -export -inkey https_rsa_private_nopass.key -in https.crt -out https.keystore.p12 -name https
执行结果如下：
$ openssl pkcs12 -export -inkey https_rsa_private_nopass.key -in https.crt -out https.keystore.p12 -name https
Enter Export Password:
Verifying - Enter Export Password:
$ ls -ltr
total 48
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul  7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul  7 05:16 https.csr
-rwxrwxrwx 1 stduser stduser   41 Jul  7 05:17 ca.srl
-rwxrwxrwx 1 stduser stduser 2106 Jul  7 05:17 https.crt
-rwxrwxrwx 1 stduser stduser 4328 Jul  7 05:18 https.keystore.p12
12. 将 p12 文件转换为 jks 文件
keytool -importkeystore -srckeystore https.keystore.p12 -srcstoretype pkcs12  -destkeystore https.keystore.jks -deststoretype jks -v
执行结果如下：
$ keytool -importkeystore -srckeystore https.keystore.p12 -srcstoretype pkcs12  -destkeystore https.keystore.jks -deststoretype jks -v
Importing keystore https.keystore.p12 to https.keystore.jks...
Enter destination keystore password:
Re-enter new password:
Enter source keystore password:
Entry for alias https successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled
[Storing https.keystore.jks]

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore https.keystore.jks -destkeystore https.keystore.jks -deststoretype pkcs12".
$ ls -ltr
total 52
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:05 ca_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3243 Jul  7 05:06 ca_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:07 ca_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1769 Jul  7 05:13 ca.csr
-rwxrwxrwx 1 stduser stduser 2179 Jul  7 05:14 ca.crt
-rwxrwxrwx 1 stduser stduser 3326 Jul  7 05:15 https_rsa_private.key
-rwxrwxrwx 1 stduser stduser 3247 Jul  7 05:15 https_rsa_private_nopass.key
-rwxrwxrwx 1 stduser stduser  800 Jul  7 05:16 https_rsa_public.key
-rwxrwxrwx 1 stduser stduser 1756 Jul  7 05:16 https.csr
-rwxrwxrwx 1 stduser stduser   41 Jul  7 05:17 ca.srl
-rwxrwxrwx 1 stduser stduser 2106 Jul  7 05:17 https.crt
-rwxrwxrwx 1 stduser stduser 4328 Jul  7 05:18 https.keystore.p12
-rwxrwxrwx 1 stduser stduser 4026 Jul  7 05:18 https.keystore.jks
13. 查看 https 证书内容
openssl x509 -in ca.crt -noout -text
openssl x509 -in https.crt -noout -text
keytool -list -v -keystore https.keystore.p12
keytool -list -v -keystore https.keystore.jks
执行结果如下：
$ openssl x509 -in ca.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            13:33:c1:cb:4a:05:23:9b:c4:9a:95:68:fc:88:9e:40:12:68:e4:af
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
        Validity
            Not Before: Jul  6 21:14:41 2023 GMT
            Not After : Jun 12 21:14:41 2123 GMT
        Subject: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:aa:d9:c7:6d:ec:ba:79:67:c9:69:41:b4:12:30:
                    eb:05:83:b2:cc:38:a9:76:c6:40:b3:61:28:40:00:
                    e7:81:18:fb:81:ec:7e:bb:4c:03:95:b4:16:1b:47:
                    eb:39:66:50:60:fa:d1:ab:25:b4:92:23:36:85:86:
                    6c:df:9b:ed:d1:fb:5a:4b:3f:79:b7:66:2e:4e:47:
                    d0:c8:16:1a:2b:d7:db:2a:db:80:55:7a:88:5f:f9:
                    45:91:87:29:3b:2a:e6:9b:90:d0:c6:58:b9:35:14:
                    10:2f:5b:42:c6:7b:2e:54:6d:53:7d:97:b8:7e:fb:
                    48:08:49:2f:e3:67:31:b8:fb:92:0f:63:88:4b:b3:
                    a4:3a:c5:0f:09:68:a9:bf:96:8c:64:b7:82:5e:88:
                    2d:4b:08:af:70:92:ec:e4:6b:0a:bb:36:29:6e:13:
                    55:0d:61:a7:bc:e1:0b:68:91:5e:52:71:b4:a6:b0:
                    d2:9d:a6:21:8e:b1:49:70:40:ac:32:ec:97:14:35:
                    a2:1b:43:e6:9c:cb:fa:0e:99:09:da:91:2a:96:9b:
                    fc:ad:69:f9:46:70:1e:23:74:07:ec:17:b9:09:dc:
                    55:f3:c0:1b:0e:bf:7c:c9:6b:10:b9:79:89:23:98:
                    26:63:35:14:09:dd:35:6e:84:a8:db:50:7d:f7:ad:
                    13:f4:a2:8f:7a:79:d7:e1:62:86:3e:bd:fb:68:d1:
                    c5:b2:bc:00:80:1b:7a:e9:c5:f8:75:d5:6a:e4:e2:
                    29:38:f1:7f:42:f6:4e:dd:44:df:04:ec:28:e6:40:
                    70:ee:85:6d:33:9a:8d:2f:fa:15:d2:21:88:89:86:
                    45:08:bb:fd:1e:37:6a:d5:07:b0:38:12:df:50:02:
                    50:53:ea:cc:76:e0:56:22:b8:e8:80:27:23:85:ea:
                    5d:57:e4:44:22:ed:86:5e:08:8a:6e:d2:55:ea:06:
                    f2:b5:84:26:de:b9:55:26:1d:15:58:84:5f:41:00:
                    60:43:3b:56:e2:2c:e0:31:cf:54:f2:dd:44:0c:c8:
                    62:49:4a:f3:e1:8e:c7:56:8b:cd:da:9e:b8:d7:ef:
                    1e:63:50:47:c5:59:93:71:76:d0:bc:c3:93:fe:fb:
                    39:3d:0c:bb:03:6c:2f:4c:0b:7a:ef:32:c8:18:c2:
                    c9:ad:10:a4:8b:5f:a4:23:ab:80:2f:66:fb:a1:41:
                    12:bc:15:2d:15:3d:1b:b7:9c:f9:22:cc:a6:11:06:
                    8b:43:f9:23:05:c7:c8:a6:79:12:c3:10:7f:9e:72:
                    ef:aa:99:67:7e:fc:e7:06:0d:38:0c:2c:f2:37:45:
                    1a:5b:e1:cb:7a:87:27:46:c7:44:b1:01:c7:51:8f:
                    4f:08:67
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                46:8E:37:91:A4:56:D5:63:C8:25:43:A0:E8:E1:16:66:3C:F0:22:E6
            X509v3 Authority Key Identifier:
                keyid:46:8E:37:91:A4:56:D5:63:C8:25:43:A0:E8:E1:16:66:3C:F0:22:E6

            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         97:e7:45:3f:b7:59:34:e7:c6:22:fc:ba:4c:82:60:0e:8c:73:
         b2:c9:31:bf:ea:ad:cc:70:79:eb:3b:31:bb:aa:73:f8:12:e8:
         d8:37:8a:d3:b2:77:42:03:47:3f:23:8c:82:74:69:f8:ad:45:
         08:60:cf:c3:90:67:9f:55:1f:b5:7a:aa:73:12:d6:73:97:65:
         72:45:74:63:e3:23:5f:47:c9:b8:48:e2:d2:58:c7:f8:af:0e:
         79:eb:ab:82:7a:17:f7:3b:62:60:82:7a:f9:32:23:f8:3f:1d:
         24:80:92:47:80:a7:2f:ef:d2:eb:0b:7f:16:da:d1:7d:0e:6a:
         be:28:7c:d2:85:48:83:f6:d8:87:35:3d:72:7c:36:ea:3e:31:
         04:81:ae:3a:97:56:c9:95:d6:b6:8f:16:3e:fb:94:35:ee:dc:
         7a:c6:85:ef:67:0b:31:bc:c3:e0:d8:2f:d2:93:93:0d:b1:61:
         c4:92:0a:c1:f4:13:df:8b:b4:70:e0:74:7c:c5:56:cc:82:1d:
         db:02:0c:2b:ca:61:af:3a:51:b1:be:a9:0c:b8:44:22:6d:69:
         97:82:01:c9:0f:d8:90:8f:aa:1d:f4:cc:a8:72:0f:03:8d:d7:
         e3:32:22:1b:60:99:84:25:b3:10:7a:a8:99:5c:c7:c4:f5:4a:
         94:47:37:21:bb:39:f2:ff:f1:f8:c2:59:92:44:58:e4:d5:2e:
         df:d4:13:2f:58:9e:87:d5:4f:92:a8:bd:de:11:c1:97:97:0b:
         08:04:b2:9d:83:77:19:6f:ee:6a:c2:e3:59:92:d4:3a:c1:f0:
         46:06:14:45:e8:eb:de:47:26:4a:e3:54:aa:12:ca:34:63:d2:
         ab:ab:3f:b4:c8:84:b9:47:d4:b1:e7:c5:83:37:0f:97:18:42:
         29:a6:db:df:97:da:02:8e:01:f1:43:1a:c5:a5:41:b4:4e:a0:
         15:ae:08:d7:07:e6:cb:6c:43:a6:9c:0f:9c:0f:f8:ff:07:e3:
         15:5e:cf:92:04:f9:9c:cc:9d:c3:ff:62:f2:31:ae:fb:2a:10:
         41:70:d7:74:1c:d0:5e:08:5e:12:e8:82:2a:8e:78:51:61:e6:
         e7:76:de:37:2a:89:fc:6f:a2:91:13:47:ee:bc:52:7f:2e:e5:
         b0:c1:99:4d:52:47:7d:19:74:de:b9:6b:8e:4e:7a:c1:80:e7:
         90:0a:d5:fc:e7:2d:fd:d7:76:83:66:0a:d3:a2:08:c5:33:87:
         8f:91:ef:cf:70:06:4c:c0:90:b5:9f:84:00:ee:02:c0:06:da:
         ff:16:59:d8:0d:cd:fb:8d:6f:41:74:29:02:81:4e:65:86:1e:
         64:23:c5:07:84:ee:f1:dd
$ openssl x509 -in https.crt -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:7b:a6:5b:70:e6:ab:18:82:fb:20:5c:50:63:43:e7:dc:fd:b5:ee
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = Example.com's Root CA, emailAddress = iana@iana.org
        Validity
            Not Before: Jul  6 21:17:44 2023 GMT
            Not After : Jun 17 21:17:44 2025 GMT
        Subject: C = US, ST = California, L = Los Angeles, O = example.com, OU = IANA, CN = *.example.com, emailAddress = iana@iana.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:d3:86:0e:43:53:f0:af:db:7b:a6:51:b9:13:0d:
                    49:ec:b9:a7:da:10:8b:81:38:76:c0:a4:b2:8e:1d:
                    3e:71:45:8b:97:45:d5:20:40:d6:39:47:2b:14:cc:
                    f4:d0:c1:82:ea:27:b9:cb:b9:4e:3d:8e:52:74:74:
                    e1:2b:72:87:1f:a7:7f:ad:37:84:ed:63:8f:31:9d:
                    19:6a:a9:f4:88:b2:64:d8:39:6e:31:b6:d1:12:fe:
                    84:95:15:ac:f1:66:11:50:42:9b:fc:c4:fe:10:7c:
                    b9:c8:a2:80:23:7b:8a:81:8a:65:c2:cd:cf:e1:fe:
                    e6:84:4f:92:0a:45:65:81:f4:c1:c4:37:29:aa:76:
                    30:9f:af:38:04:57:95:ca:38:e4:ba:3e:10:c3:e7:
                    26:63:f7:25:fb:f1:8d:17:4d:80:63:46:b0:bb:da:
                    e4:ec:3a:70:4d:fe:da:62:27:24:36:bf:9d:19:d7:
                    cf:85:61:ac:e2:2e:c5:14:36:22:89:06:a5:96:d2:
                    3b:7c:a4:d2:76:fb:bb:40:09:d5:43:95:1a:1f:58:
                    63:a1:3a:d7:13:de:80:71:ff:ae:a3:45:fe:76:74:
                    5a:67:95:c3:ce:20:a5:46:eb:cc:0f:ab:14:54:3e:
                    16:4f:b1:ea:a3:72:b3:80:9a:da:bf:47:f3:30:a7:
                    2d:66:40:6f:9a:cd:3a:0b:59:2d:c0:40:8f:1c:f3:
                    b5:45:63:02:c5:6f:b0:d9:0f:ee:97:a0:ca:60:3b:
                    de:75:0b:03:91:f3:79:77:57:30:07:d7:de:d6:52:
                    8e:d5:20:17:00:79:0c:16:37:24:2c:0a:17:5e:b4:
                    a7:0a:67:7a:82:3e:07:76:0a:30:91:cf:cf:2e:be:
                    59:cf:a5:85:8e:2a:d2:46:ef:62:97:f2:08:b9:c8:
                    2a:ce:62:2f:39:67:24:65:6e:fa:9f:3c:4b:76:34:
                    53:15:87:c4:f0:51:ce:3f:de:47:e2:60:48:17:62:
                    0f:0e:77:bf:ec:77:c7:e2:26:ae:1e:bc:b1:79:44:
                    4c:50:81:98:43:9e:18:09:af:5c:41:a3:03:28:f8:
                    7c:41:82:72:d0:c8:08:2e:29:81:06:10:fd:7c:67:
                    8d:fa:c1:ce:f8:95:90:32:45:11:32:91:45:66:75:
                    4e:97:09:6e:fd:82:bc:a9:03:90:ab:12:44:4d:46:
                    37:61:89:0e:b7:56:4a:f2:91:01:e2:3a:1b:41:48:
                    07:29:95:e1:4f:d8:0b:57:69:bc:7f:1a:f9:5e:51:
                    28:83:1e:c3:86:96:69:b1:1b:b3:e9:27:09:fd:46:
                    ef:5b:32:21:55:0b:c1:49:76:a9:65:02:bd:4a:26:
                    89:5f:f9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name:
                DNS:example.com, DNS:*.example.com
    Signature Algorithm: sha256WithRSAEncryption
         7c:27:ba:df:25:e0:cf:96:ea:ae:e1:03:d7:f5:19:c2:96:11:
         51:c9:ee:df:c9:65:2f:27:22:fd:0c:84:87:ba:a4:f3:32:ac:
         29:87:2e:a8:8c:a9:ac:46:a5:2c:fb:60:54:51:b6:b8:8e:9a:
         b5:00:b5:7d:ef:86:30:2d:f6:f6:df:50:b4:16:f6:bf:ed:dc:
         51:c4:20:80:1f:27:2e:83:72:0b:a6:df:0b:52:7a:62:6e:64:
         d1:a0:aa:80:93:ab:4f:ab:06:ed:9a:a4:3f:29:dc:a3:6f:d1:
         81:0d:77:81:9d:8f:a3:0b:0f:d0:1b:41:23:e9:fe:64:15:6d:
         20:70:5a:50:b8:16:cd:06:e9:ee:c3:9a:9d:ea:77:86:09:e3:
         4a:29:2b:42:c6:a8:32:82:1d:80:5e:7f:3d:68:c1:a8:c7:e2:
         d5:ab:2d:c9:4c:0a:63:fd:28:31:b8:cb:88:02:37:b7:45:20:
         f3:ac:24:15:65:fb:17:6e:82:ce:8b:bc:d9:ef:40:eb:70:fa:
         5a:b4:35:e1:8a:6c:7e:33:0b:c1:23:2c:da:be:68:72:b1:a1:
         44:43:6c:86:56:d0:9f:a6:cc:7f:d0:0e:b5:69:87:9e:d4:b4:
         6a:ac:8a:0a:01:a3:93:17:e4:da:88:7d:0f:e4:b3:5f:2a:fa:
         b6:f4:42:94:85:11:49:63:89:90:e8:eb:6a:e1:fa:fd:0d:02:
         32:76:03:56:28:b3:b6:12:a5:e3:16:65:bb:56:fe:62:ea:c9:
         3c:57:df:a3:c7:a6:bf:34:fb:d1:dd:a2:01:97:8b:ab:bd:eb:
         fe:e6:50:cd:6e:14:f6:c8:1c:a0:d4:ba:ae:77:a6:2d:14:af:
         53:94:4f:45:9a:23:9c:5e:45:3c:1c:b1:1a:18:9d:45:b5:dc:
         31:e2:f8:4b:94:e7:05:cf:9d:d4:50:52:74:bc:96:6c:43:03:
         be:d1:77:87:cd:d4:76:fe:0b:bd:a1:33:ed:39:0d:6b:96:2e:
         a2:5a:58:36:b4:bf:5a:8b:3f:27:cf:0d:74:69:1a:eb:3b:c9:
         63:ea:0a:7a:00:e1:4d:f7:e6:33:9e:f9:88:e1:3b:66:35:54:
         c3:39:12:c8:ba:65:97:cc:83:a8:03:c8:1c:24:a3:29:5e:9d:
         dd:dc:8d:bf:b1:f8:a2:1a:02:2c:51:b1:64:cb:c9:57:9e:de:
         ae:34:bc:2e:ae:86:14:5d:0d:75:f5:04:38:d4:dd:b8:75:7b:
         8f:2f:1d:46:11:2a:62:77:d3:d8:d0:0b:d4:2b:6c:10:10:97:
         93:a0:da:53:5c:9a:b0:77:b8:a9:ca:7e:ce:6d:a2:72:5e:ee:
         39:fc:e2:f7:dd:a1:dc:12
$ keytool -list -v -keystore https.keystore.p12
Enter keystore password:
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: https
Creation date: Jul 7, 2023
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: EMAILADDRESS=iana@iana.org, CN=*.example.com, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Issuer: EMAILADDRESS=iana@iana.org, CN=Example.com's Root CA, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Serial number: c7ba65b70e6ab1882fb205c506343e7dcfdb5ee
Valid from: Fri Jul 07 05:17:44 CST 2023 until: Wed Jun 18 05:17:44 CST 2025
Certificate fingerprints:
         SHA1: FA:10:E7:11:4F:47:5E:1A:93:E1:DC:EE:AE:53:DF:4D:91:C4:3B:34
         SHA256: 19:41:78:84:25:D3:25:EE:D1:0F:BA:11:34:6A:70:EA:70:A9:CC:1B:CD:A0:96:0C:F0:71:8D:BA:13:3E:59:C6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3

Extensions:

#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: example.com
  DNSName: *.example.com
]

*******************************************
*******************************************

$ keytool -list -v -keystore https.keystore.jks
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

Alias name: https
Creation date: Jul 7, 2023
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: EMAILADDRESS=iana@iana.org, CN=*.example.com, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Issuer: EMAILADDRESS=iana@iana.org, CN=Example.com's Root CA, OU=IANA, O=example.com, L=Los Angeles, ST=California, C=US
Serial number: c7ba65b70e6ab1882fb205c506343e7dcfdb5ee
Valid from: Fri Jul 07 05:17:44 CST 2023 until: Wed Jun 18 05:17:44 CST 2025
Certificate fingerprints:
         SHA1: FA:10:E7:11:4F:47:5E:1A:93:E1:DC:EE:AE:53:DF:4D:91:C4:3B:34
         SHA256: 19:41:78:84:25:D3:25:EE:D1:0F:BA:11:34:6A:70:EA:70:A9:CC:1B:CD:A0:96:0C:F0:71:8D:BA:13:3E:59:C6
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 4096-bit RSA key
Version: 3

Extensions:

#1: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: example.com
  DNSName: *.example.com
]

*******************************************
*******************************************

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore https.keystore.jks -destkeystore https.keystore.jks -deststoretype pkcs12".