// generate a key -- make it long lived so we dont have to do this again
keytool -genkey -alias tomcat -keyalg RSA -validity 3650 -storepass changeit

// export cert to a file
keytool -export -rfc -v -file tomcatCert.crt -alias tomcat -storepass changeit
 
// look at the cert in the file
keytool -printcert -file tomcatCert.crt -storepass changeit


// delete pre-existing cert
keytool -delete -alias tomcat -keystore c:/apps/jdk/jre/lib/security/cacerts -storepass changeit

// import cert into a keystore
keytool -import -file tomcatCert.crt -trustcacerts -alias tomcat -keystore c:/apps/jdk/jre/lib/security/cacerts -storepass changeit

// look at the imported cert
keytool -list -alias tomcat -keystore c:/apps/jdk/jre/lib/security/cacerts -storepass changeit