Creating a client key pair and certificate

Follow these steps to create a client key pair and a client certificate.

1. Choose a password for the key store.

   Suppose you choose the password secretClientPassword.

2. On the client system, issue the following command to create the client's public/private key pair.

   You will be prompted to enter the password plus some identifying information (your input is marked bold):

   keytool -genkey -alias MyClientName -keystore ~/vault/ClientKeyStore
   Enter keystore password: secretClientPassword
   What is your first and last name?
   [Unknown]: MyFirstName MyLastName
   What is the name of your organizational unit?
   [Unknown]: Proofreading Department
   What is the name of your organization?
   [Unknown]: Name of my bookstore
   What is the name of your City or Locality?
   [Unknown]: New York
   What is the name of your State or Province?
   [Unknown]: NY
   What is the two-letter country code for this unit?
   [Unknown]: US
   Is CN=MyFirstName MyLastName, OU=Proofreading Department, O=Name of my bookstore, L=New York, ST=NY, C=US correct?
   [no]: yes
   
   
   Enter key password for <MyClientName>
      (RETURN if same as keystore password):

3. Next, create a certificate for this client. Enter the command all on one line:

   keytool -export -alias MyClientName \
   -keystore ~/vault/ClientKeyStore  -rfc -file ClientCertificate \
   -storepass secretClientPassword

   This command creates a file called ClientCertificate. Later, you will import this file into the server's trust store.