Spring Security - Third Edition

Creating a client certificate key pair

The self-signed client certificate is created in the same way as the self-signed server certificate is created—by generating a key pair using the keytool command. A client certificate key pair differs in that it requires the key store to be available to the web browser and requires the client's public key to be loaded into the server's trust store (we'll explain what this is in a moment).

If you do not wish to generate your own key right now, you may skip to the next section and use the sample certificates in the ./src/main/resources/keys folder in the sample chapter. Otherwise, create the client key pair, as follows:

keytool -genkeypair -alias jbcpclient -keyalg RSA -validity 365 -keystore jbcp_clientauth.p12 ...