The keytool subcommand exports or imports secret key values.

The Java keytool command enables you to export and import public keys and certificates, but not secret or symmetric keys. The IDM keytool subcommand provides this functionality.

Usage is as follows:

./ keytool [--export, --import] alias

For example, to export the default IDM symmetric key, run the following command:

./ keytool --export openidm-sym-default
Executing ./
Starting shell in /home/idm/openidm
Use KeyStore from: /openidm/security/keystore.jceks
Please enter the password: 
[OK] Secret key entry with algorithm AES

The default keystore password is changeit. For security reasons, you must change this password in a production environment. For information about changing the keystore password, see "Changing the Default Keystore Password".

To import a new secret key named my-new-key, run the following command:

./ keytool --import my-new-key   
Using boot properties at /openidm/resolver/
Use KeyStore from: /openidm/security/keystore.jceks
Please enter the password: 
Enter the key: 

If a secret key with that name already exists, IDM returns the following error:

"KeyStore contains a key with this alias"
Read a different version of :