rsaKeys = (keyrecoverysession.keyRecovery(administrator, username)).getKeyPair();
keyData = (keyrecoverysession.keyRecovery(administrator, username, endEntityProfileId)); rsaKeys = keyData.getKeyPair();  if(reusecertificate){ keyrecoverysession.unmarkUser(administrator,username); }
    private KeyStore generateToken(Admin administrator, String username, String password, int caid, int keylength, boolean createJKS, boolean loadkeys, boolean savekeys)       throws Exception{         KeyPair rsaKeys = null;         if(loadkeys){           // used saved keys.           IKeyRecoverySessionRemote keyrecoverysession = keyrecoveryhome.create();           rsaKeys = (keyrecoverysession.keyRecovery(administrator, username)).getKeyPair();         }         else{           // generate new keys.           rsaKeys = KeyTools.genKeys(keylength);         }         ISignSessionRemote signsession = signsessionhome.create();         X509Certificate cert = (X509Certificate)signsession.createCertificate(administrator, username, password, rsaKeys.getPublic());        // Make a certificate chain from the certificate and the CA-certificate        Certificate[] cachain = (Certificate[]) signsession.getCertificateChain(administrator, caid).toArray(new Certificate[0]);        // Verify CA-certificate        if (CertTools.isSelfSigned((X509Certificate) cachain[cachain.length - 1])) {            try {                cachain[cachain.length - 1].verify(cachain[cachain.length - 1].getPublicKey());            } catch (GeneralSecurityException se) {                throw new Exception("RootCA certificate does not verify");            }        } else {            throw new Exception("RootCA certificate not self-signed");        }        // Verify that the user-certificate is signed by our CA        try {            cert.verify(cachain[0].getPublicKey());        } catch (GeneralSecurityException se) {            throw new Exception("Generated certificate does not verify using CA-certificate.");        }        if (savekeys) {            // Save generated keys to database.            IKeyRecoverySessionRemote keyrecoverysession = keyrecoveryhome.create();            keyrecoverysession.addKeyRecoveryData(administrator, cert, username, rsaKeys);        }        // Use CN if as alias in the keystore, if CN is not present use username        String alias = CertTools.getPartFromDN(CertTools.getSubjectDN(cert), "CN");        if (alias == null) alias = username;        // Store keys and certificates in keystore.        KeyStore ks = null;        if (createJKS) {            ks = KeyTools.createJKS(alias, rsaKeys.getPrivate(), password, cert, cachain);        } else {            ks = KeyTools.createP12(alias, rsaKeys.getPrivate(), cert, cachain);        }        return ks;    }