#Generate Server Certificate
keytool -genkeypair -alias serverApp -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore serverApp.p12 -validity 7


# Export the Server Certificate
keytool -exportcert -alias serverApp -keystore serverApp.p12 -file serverApp.cer

#Share the Server Certificate with Clients
#Clients need the server's certificate (server.crt) to trust the server. You can share this file with clients, who will import it into their truststore.


#Configure the Client
keytool -importcert -file serverApp.cer -alias serverApp -keystore client-truststore.jks

# view the server certificate 

keytool -printcert -file serverApp.cer

# using openssl
openssl x509 -in serverApp.cer -text -noout


This command will display information about the certificate, including:

Subject: Information about the entity the certificate belongs to.
Issuer: Information about the entity that issued the certificate.
Serial number: A unique identifier for the certificate.
Validity period: The start and end dates for the certificate's validity.
Fingerprints: SHA-256 and SHA-1 fingerprints.
Public key: The public key associated with the certificate.


The file serverApp.cer contains the public certificate of the server, also known as the X.509 certificate. This certificate includes a variety of important information and serves several purposes in the context of SSL/TLS communication. Here’s a breakdown of what it typically contains:

1. Subject
The subject field identifies the entity associated with the public key contained in the certificate. This usually includes:

Common Name (CN): The domain name of the server (e.g., example.com).
Organization (O): The organization that owns the server.
Organizational Unit (OU): The specific department or unit within the organization.
Locality (L): The city where the organization is located.
State (ST): The state or province where the organization is located.
Country (C): The country code (e.g., US for the United States).
2. Issuer
The issuer is the entity that signed the certificate. It is usually a Certificate Authority (CA). The issuer’s details often mirror the fields found in the subject, such as:

Common Name (CN): The CA's name.
Organization (O): The CA's organization.
Organizational Unit (OU): The CA's specific department or unit.
3. Validity Period
The validity period specifies the time frame during which the certificate is considered valid. It includes:

Not Before: The date and time when the certificate becomes valid.
Not After: The expiration date and time of the certificate.
4. Serial Number
A unique identifier assigned to the certificate by the issuer (CA). It helps in identifying and managing certificates.

5. Signature Algorithm
The algorithm used to sign the certificate. It usually specifies the hashing algorithm and the public key algorithm, such as sha256WithRSAEncryption.

6. Public Key Information
This section contains the public key associated with the private key that corresponds to the certificate. It includes:

Public Key Algorithm: The algorithm used for the public key (e.g., RSA).
Public Key: The actual public key value, which can be used for encrypting data or verifying signatures.
7. Extensions
Certificates can include optional extensions that provide additional information and functionality. Common extensions include:

Key Usage: Specifies the purpose of the public key (e.g., digital signature, key encipherment).
Extended Key Usage: Further refines the purposes for which the public key can be used (e.g., server authentication, client authentication).
Subject Alternative Name (SAN): Lists additional identities (such as domain names or IP addresses) that the certificate can secure.
Basic Constraints: Indicates whether the certificate is a CA certificate and whether it can issue other certificates.
8. Signature
The digital signature of the certificate, created by the issuer's private key. The signature ensures the integrity and authenticity of the certificate. The client can use the issuer's public key (from the CA) to verify this signature.

Purpose of the Certificate
The certificate serves multiple purposes:

Authentication: Verifies the identity of the server to the client.
Encryption: Contains the public key used to establish a secure communication channel.
Integrity: The digital signature ensures that the certificate has not been tampered with.
The serverApp.cer file is typically distributed to clients, who can use it to verify the identity of the server and establish a secure connection. The certificate does not contain the private key; the private key remains secure and confidential on the server. The public key, however, can be freely shared, as it does not compromise security.