This is a multi-stage test. Click on "done" when you have completed reading these instructions. For each instruction, make sure the output from keytool is correct (you can read everything in english fine).
  1. rm ~/.keystore If you are on a Windows platform, delete the .keystore file in your home directory.
  2. keytool -help
  3. keytool -genkey -v -keysize 512 Enter "a" for the keystore password. Check error (password too short). Enter "password" for the keystore password. Re-enter "password" to confirm. Hit 'return' for "first and last name", "organizational unit", "organization", "City", "State", and "Country Code". Type "yes" when they ask you if everything is correct. Type 'return' for new key password.
  4. keytool -list -v -storepass password
  5. keytool -list -v Type "a" for the keystore password. Check error (wrong keystore password).
  6. keytool -genkey -v -keysize 512 Enter "password" as the password. Check error (alias 'mykey' already exists).
  7. keytool -genkey -v -keysize 512 -alias mykey2 -storepass password Hit 'return' for "first and last name", "organizational unit", "organization", "City", "State", and "Country Code". Type "yes" when they ask you if everything is correct. Type 'return' for new key password.
  8. keytool -list -v Type 'password' for the store password.
  9. keytool -keypasswd -v -alias mykey2 -storepass password Type "a" for the new key password. Type "aaaaaa" for the new key password. Type "bbbbbb" when re-entering the new key password. Type "a" for the new key password. Check Error (too many failures).
  10. keytool -keypasswd -v -alias mykey2 -storepass password Type "aaaaaa" for the new key password. Type "aaaaaa" when re-entering the new key password.
  11. keytool -selfcert -v -alias mykey -storepass password
  12. keytool -list -v -storepass password
  13. keytool -export -v -alias mykey -file /tmp/cert -storepass password
  14. keytool -import -v -file /tmp/cert -storepass password Check error (Certificate reply and cert are the same)
  15. keytool -printcert -file /tmp/cert
  16. keytool -list -storepass password -provider sun.security.provider.Sun
Error tests
  1. keytool -storepasswd -storepass password -new abc Check error (password too short)
  2. keytool -storepasswd -storetype PKCS11 -keystore NONE Check error (unsupported operation)
  3. keytool -keypasswd -storetype PKCS11 -keystore NONE Check error (unsupported operation)
  4. keytool -list -protected -storepass password Check error (password can not be specified with -protected)
  5. keytool -keypasswd -protected -keypass password Check error (password can not be specified with -protected)
  6. keytool -keypasswd -protected -new password Check error (password can not be specified with -protected)
MSCAPI tests (Only run on Windows)
  1. keytool -storetype Windows-MY -list should list entries (may be 0) without asking for password should not show ****** WARNING WARNING WARNING ****** lines
  2. keytool -storetype Windows-MY -list -keystore NONE should list entries without asking for password
  3. keytool -storetype Windows-MY -list -keystore other Error: storetype must be NONE
  4. keytool -storetype Windows-MY -list -storepass changeit Error: storepass cannot be specfied
  5. keytool -storetype Windows-MY -list -storepasswd Error: storepasswd not supported
PKCS#11 tests
  1. sccs edit cert8.db key3.db
  2. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -genkey -alias genkey -dname cn=genkey -keysize 512 -keyalg rsa
  3. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -list
  4. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -list -alias genkey
  5. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -certreq -alias genkey -file genkey.certreq
  6. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -export -alias genkey -file genkey.cert
  7. keytool -printcert -file genkey.cert
  8. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -selfcert -alias genkey -dname cn=selfCert
  9. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -list -alias genkey -v (check that cert subject DN is [cn=selfCert])
  10. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -delete -alias genkey
  11. keytool -keystore NONE -storepass test12 -storetype PKCS11 -providerName SunPKCS11-nss -providerClass sun.security.pkcs11.SunPKCS11 -providerArg p11-nss.txt -list (check for empty database listing)
  12. sccs unedit cert8.db key3.db
If all the output (english) is correct, then the test passed. Otherwise, the test failed. Press "Pass" if ... press "Fail" otherwise.