Commonly used arguments

Most of the manage-certificates subcommands require access to a Java KeyStore (JKS) or PKCS #12 key store. In such cases, you must specify path to that key store using the --keystore argument.

If the key store already exists, then the tool automatically detects whether it is a JKS or PKCS #12 key store. If the operation creates a new key store, then you can explicitly specify the type using the --keystore-type argument followed by a value of either JKS or PKCS12. If you do not specify the key store type, a default value of “JKS” is used.

In some cases, you might also be required to provide the password needed to access the key store. For a JKS key store, you might only need to provide a key store password for operations that involve creating a key store or accessing a private key, but you might need to provide the password for all operations involving a PKCS #12 key store. If you need to provide a key store password, there are three ways that you can do so:

Private keys can also be protected with a different password than the key store itself. If that is the case, then the private key password can be given in one of the following ways:

Several operations require you to specify which key store entry you want to target. In such cases, you can provide the --alias argument followed by the name of the alias for that entry.