Skip to content

Commit 66cc588

Browse files
author
0xfab1
committed
Add comprehensive JDK documentation including tool overview and keytool usage examples
1 parent ae960ab commit 66cc588

File tree

1 file changed

+197
-0
lines changed

1 file changed

+197
-0
lines changed

‎docs/tech/tools/cli/jdk.md‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
# JDK
2+
3+
The JDK (Java Development Kit) is the full-featured development and runtime environment for Java, bundling the Java compiler (javac), a comprehensive set of development tools (such as javadoc, jdb, jar, etc.), and the JRE (Java Runtime Environment), which contains the JVM, core classes, and supporting files required to execute Java applications. While the JRE is solely intended for end-users running Java applications and omits developer tools, the JDK enables both compilation and execution, making it essential for development workflows. Since Java 9, the standalone JRE is no longer offered separately, and modularization via JPMS allows developers to create custom, minimized runtimes using tools like jlink. In practice, the JDK now serves as the default distribution for both development and production, while the historical distinction between JDK and JRE is largely obsolete except in legacy contexts.
4+
5+
## Tool overview
6+
7+
Some tools in the JDK with a simple example:
8+
9+
| Tool | Purpose | Example Command |
10+
| ------------- | --------------------------------------- | ------------------------------------------------------------------------------------------- |
11+
| **javac** | Compile Java source code | `javac HelloWorld.java` |
12+
| **java** | Run Java programs | `java HelloWorld` |
13+
| **jar** | Package/distribute Java applications | `jar cf app.jar *.class` |
14+
| **javadoc** | Generate API documentation | `javadoc -d doc HelloWorld.java` |
15+
| **jdb** | Debug Java applications | `jdb HelloWorld` |
16+
| **jconsole** | Monitor/manage Java apps (GUI) | `jconsole` |
17+
| **jvisualvm** | Visual profiling/monitoring (GUI) | `jvisualvm` |
18+
| **jstack** | View thread stack traces | `jstack <pid>` |
19+
| **jmap** | Memory stats/heap dumps | `jmap -heap <pid>` |
20+
| **jstat** | JVM stats (GC, class loading, etc.) | `jstat -gc <pid>` |
21+
| **jps** | List Java processes | `jps` |
22+
| **jinfo** | JVM configuration info | `jinfo <pid>` |
23+
| **jshell** | Interactive Java shell (REPL) | `jshell` |
24+
| **javap** | Disassemble class files | `javap HelloWorld` |
25+
| **keytool** | Manage keys/certificates/keystores | `keytool -genkeypair -alias mykey -keystore mykeystore.jks` |
26+
| **serialver** | Show serialVersionUID for classes | `serialver HelloWorld` |
27+
| **jlink** | Custom runtime image creation (Java 9+) | `jlink --module-path mods --add-modules com.example.helloworld --output helloworld-runtime` |
28+
29+
## Comparing builds
30+
31+
| Name | License | Supported By | Open Source | Free | LTS | Target Audience/Notes |
32+
| ----------------- | ---------------------------- | ------------------ | ----------- | ----- | --- | ------------------------------------------- |
33+
| Oracle JDK | NFTC (Java 17+), earlier BCL | Oracle | No | Yes | Yes | Official JDK, enterprise support |
34+
| OpenJDK | GPLv2 + Classpath | Community | Yes | Yes | Yes | Upstream, most other JDKs are based on this |
35+
| Amazon Corretto | GPLv2 + Classpath | Amazon | Yes | Yes | Yes | Free, supported by AWS, LTS |
36+
| Microsoft OpenJDK | MIT (binaries), GPLv2 (src) | Microsoft | Yes | Yes | Yes | For Azure, free, open source |
37+
| Eclipse Temurin | GPLv2 + Classpath | Eclipse Foundation | Yes | Yes | Yes | Broad adoption, successor to AdoptOpenJDK |
38+
| Red Hat OpenJDK | GPLv2 + Classpath | Red Hat | Yes | Yes | Yes | Default for RHEL, commercial support |
39+
| Azul Zulu OpenJDK | GPLv2 + Classpath | Azul Systems | Yes | Yes | Yes | Commercial/enterprise options |
40+
| SAP SapMachine | GPLv2 + Classpath | SAP | Yes | Yes | Yes | For SAP users |
41+
42+
## keytool
43+
44+
Keytool is a command-line utility that comes with the Java Development Kit (JDK). It is used to generate, import, export, and store keys and certificates.
45+
46+
Here are some more details on how to use it:
47+
48+
### Creation and Importing
49+
50+
Generate a Java keystore and key pair:
51+
52+
```bash
53+
keytool -genkeypair -keyalg RSA -keysize 2048 -keystore keystore.jks -alias server -validity 3650
54+
```
55+
56+
Generate a Java keystore and key pair with Distinguished Name and extensions:
57+
58+
```bash
59+
keytool -genkeypair -keyalg RSA -keysize 2048 -keystore keystore.jks -alias server \
60+
-dname "CN=0xfab1,OU=net,O=lol,C=DE" -storepass secret -keypass secret -validity 3650 \
61+
-ext KeyUsage=digitalSignature,dataEncipherment,keyEncipherment,keyAgreement \
62+
-ext ExtendedKeyUsage=serverAuth,clientAuth \
63+
-ext SubjectAlternativeName=DNS:localhost,IP:127.0.0.1
64+
```
65+
66+
Import a certificate into a Java keystore:
67+
68+
```bash
69+
keytool -importcert -file server.crt -keystore truststore.jks -alias server
70+
```
71+
72+
Generate a Root CA with signing capabilities:
73+
74+
```bash
75+
keytool -genkeypair -keystore root-ca.jks -storepass secret -keypass secret -keyalg RSA -keysize 2048 \
76+
-alias root-ca -validity 3650 -dname "CN=Root-CA,OU=Certificate Authority,O=lol,C=DE" \
77+
-ext KeyUsage=digitalSignature,keyCertSign -ext BasicConstraints=ca:true,pathlen:3
78+
```
79+
80+
Generate a Certificate Signing Request (CSR):
81+
82+
```bash
83+
keytool -certreq -keystore keystore.jks -alias server -file server.csr
84+
```
85+
86+
Import a root or intermediate CA certificate into a Java keystore:
87+
88+
```bash
89+
keytool -import -trustcacerts -file root-ca.crt -alias my-newly-trusted-ca -keystore keystore.jks
90+
```
91+
92+
Import keystore contents into another keystore:
93+
94+
```bash
95+
keytool -importkeystore -srckeystore source.p12 -srcstoretype PKCS12 -srcstorepass changeit \
96+
-destkeystore target.p12 -deststoretype PKCS12 -deststorepass changeit
97+
```
98+
99+
### Checking
100+
101+
Check a standalone certificate:
102+
103+
```bash
104+
keytool -printcert -file server.crt
105+
```
106+
107+
Check a standalone certificate in PEM format:
108+
109+
```bash
110+
keytool -printcert -file server.crt -rfc
111+
```
112+
113+
List certificates in a keystore:
114+
115+
```bash
116+
keytool -list -v -keystore keystore.jks
117+
```
118+
119+
List details of a specific keystore entry:
120+
121+
```bash
122+
keytool -list -v -keystore keystore.jks -alias server
123+
```
124+
125+
### Other Commands
126+
127+
Delete a certificate from a keystore:
128+
129+
```bash
130+
keytool -delete -alias server -keystore keystore.jks
131+
```
132+
133+
Change keystore password:
134+
135+
```bash
136+
keytool -storepasswd -keystore keystore.jks
137+
```
138+
139+
Change password of a key entry (only for JKS keystore):
140+
141+
```bash
142+
keytool -keypasswd -alias server -keystore keystore.jks
143+
```
144+
145+
Sign a CSR with a CA keystore:
146+
147+
```bash
148+
keytool -gencert -infile server.csr -outfile server-signed.cer -keystore root-ca.jks \
149+
-storepass secret -alias root-ca -validity 3650 \
150+
-ext KeyUsage=digitalSignature,dataEncipherment,keyEncipherment,keyAgreement \
151+
-ext ExtendedKeyUsage=serverAuth,clientAuth
152+
```
153+
154+
Sign a CSR with extensions for Subject Alternative Name and Authority Info Access:
155+
156+
```bash
157+
keytool -gencert -infile server.csr -outfile server-signed.cer -keystore root-ca.jks \
158+
-storepass secret -alias root-ca -validity 3650 \
159+
-ext KeyUsage=digitalSignature,dataEncipherment,keyEncipherment,keyAgreement \
160+
-ext ExtendedKeyUsage=serverAuth,clientAuth \
161+
-ext SubjectAlternativeName=DNS:localhost,DNS:myserver.local,IP:127.0.0.1 \
162+
-ext AuthorityInfoAccess=caIssuers:uri:http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
163+
```
164+
165+
Convert JKS to PKCS12:
166+
167+
```bash
168+
keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -destkeystore keystore.p12 \
169+
-deststoretype PKCS12 -srcstorepass password -deststorepass password
170+
```
171+
172+
Convert PKCS12 to JKS:
173+
174+
```bash
175+
keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -destkeystore keystore.jks \
176+
-deststoretype JKS -srcstorepass password -deststorepass password
177+
```
178+
179+
### Exporting
180+
181+
Export a certificate in binary format:
182+
183+
```bash
184+
keytool -exportcert -keystore keystore.jks -alias server -file server.crt
185+
```
186+
187+
Export a certificate in PEM format:
188+
189+
```bash
190+
keytool -exportcert -keystore keystore.jks -alias server -rfc -file server.crt
191+
```
192+
193+
Export Java keystore to PKCS12 (.p12):
194+
195+
```bash
196+
keytool -importkeystore -srckeystore keystore.jks -destkeystore keystore.p12 -srcstoretype JKS -deststoretype PKCS12
197+
```

0 commit comments

Comments
 (0)