Search code examples
keystorekeytool

Generate an "expired" SSL certificate with keytool

I am creating my keystore with following command:

keytool -genkey -keystore myStore.keystore -keyalg RSA -keysize 1024 -alias myAlias

How could I generate one with a past expiry date (the use of this? I want to test the behavior of my app with an expired certificate).

Solution

  • Using the java keytool, the minimum validity for a keystore certificate can be 1 day.

    EDIT: looks like there's an option for -startdate as @shyam0191 has answered.

    So, you can't(correction: you can actually) generate a certificate with a past date. I suggest using the following command, which will generate a certificate with a 1-day validity and the next day you will be able to test with it:

    keytool -selfcert -alias Test -genkey -keystore myStore.keystore -keyalg RSA -validity 1

    or use @shyam0191's answer which will have the same end result in the end (but sooner).