Locating or Creating a Keystore and Certificate

Before you can sign the content archive, you must have an unexpired certificate that you can use. This certificate must be stored in a keystore that you can access and you must know the alias to access the certificate. The certificate can be signed by a certificate authority or it can be self-signed.

If you do not have a keystore or certificate to use, you can create a keystore and a self-signed certificate to sign the content archive.

Creating a Keystore and Self-Signed Certificate

The example shown in this section creates a keystore named .keystore_archive_signing, in which a self-signed certificate can be accessed using the alias csa_archive. The self-signed certificate is valid for 365 days and is generated using the RSA key algorithm and a 2048 bit key size.

1. Open a command prompt and change the directory to JRE_HOME/bin. For example, if you are using the JRE installed with CSA, go to /usr/local/hpe/csa/openjre/bin on Linux.

2. Run the following command:

   keytool -genkeypair -keystore /tmp/.keystore_archive_signing -alias
csa_archive -validity 365 -keyalg rsa -keysize 2048

3. Enter a keystore password (<keystore_password>). This password is used to control access to the keystore. You will need this password when signing a content archive.

4. Follow the prompts to enter your name, organization, and location values.

5. Enter the key password (<key_password>). This password is used to control access to the alias. You will need this password when signing a content archive.

You have completed creating a keystore and self-signed certificate and can now sign your content archives.