Sometimes, you don’t have a PKI in place but you still need a key and a corresponding certificate to sign stuff (outside of the TLS context). And after the certificate in initially generated JKS file expires, you have few options – either generate an entirely new keypair or somehow “extend” the existing certificate.

Read full article on Dzone