diff --git a/README.md b/README.md
index 5104ca8..78fd0e3 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,10 @@ You must have an account on Apigee Edge to perform any `apigeetool` functions. T
 * create or delete a Cache resource in Edge
 * create, retrieve or delete a KVM Map in Edge
 * create, retrieve or delete a KVM Entry in Edge
+* create, retrieve or delete a Keystore in Edge
+* retrieve a Keystore Reference in Edge
+* retrieve a Keystore Alias in Edge
+* retrieve a Certificate from a Keystore in Edge
 * attach, detach, or get a FlowHook
 * create, get, delete, list Target Servers
 * create, get, delete, List Roles
@@ -119,6 +123,7 @@ Currently this only affects file uploads in the `deploynodeapp` command. Default
 * [deleteapp](#deleteapp)
 * [deletecache](#deletecache)
 * [deletedeveloper](#deletedeveloper)
+* [deleteKeystore](#deleteKeystore)
 * [deleteKVMentry](#deleteKVMentry)
 * [deleteKVMmap](#deleteKVMmap)
 * [deleteproduct](#deleteproduct)
@@ -133,14 +138,19 @@ Currently this only affects file uploads in the `deploynodeapp` command. Default
 * [detachFlowHook](#detachFlowHook) 
 * [fetchproxy](#fetchproxy)
 * [fetchSharedflow](#fetchSharedflow)
+* [getAlias](#getAlias)
+* [getCertificate](#getCertificate)
 * [getFlowHook](#getFlowHook)
 * [getKVMentry](#getKVMentry)
 * [getKVMmap](#getKVMmap)
 * [getlogs](#getlogs)
+* [getReference](#getReference)
 * [getRole](#getRole)
 * [getRolePermissions](#getRolePermissions)
 * [getTargetServer](#getTargetServer)
 * [listdeployments](#listdeployments)
+* [listKeystores](#listKeystores)
+* [listReferences](#listReferences)
 * [listRoles](#listRoles)
 * [listRoleUsers](#listRoleUsers)
 * [listSharedflowDeployments](#listSharedflowDeployments)
@@ -1419,6 +1429,141 @@ the "-u" and "-p" parameters for username and password or preferably -N for .net
 `--email` (required) Email for an existing User in Edge.  
 `--roleName` (required) The name for the role. 
 
+## <a name="Keystore Operations"></a>Keystore Operations
+
+### <a name="getAlias"></a>getAlias
+
+Get details about certificate alias.
+
+#### Example
+Get details about a certificate from the specific keystore "MyKeyStore-20210101" , using the cert alias "my-cert-alias".
+
+    apigeetool getAlias --keystoreName MyKeyStore-20210101 --aliasName my-cert-alias
+
+#### Required parameters
+
+The following parameters are required. However, if any are left unspecified
+on the command line, and if apigeetool is running in an interactive shell,
+then apigeetool will prompt for them.
+
+See [Common Parameters](#commonargs) for a list of additional parameters, including
+the "-u" and "-p" parameters for username and password or preferably -N for .netrc usage.
+
+`--organization -o` (required) The organization to target.··
+`--environment -e` (required) The environment to target.··
+`--keystoreName` (required) The keystore to query.
+`--aliasName` (required) The alias to query
+
+### <a name="getCertificate"></a>getCertificate
+
+Get details about a certificate in a keystore.
+
+#### Example
+Get details about the certificate "my-cert" in the keystore "MyKeyStore-20210101"
+
+    apigeetool getCertificate --keystoreName MyKeyStore-20210101 --certificateName my-cert
+
+#### Required parameters
+
+The following parameters are required. However, if any are left unspecified
+on the command line, and if apigeetool is running in an interactive shell,
+then apigeetool will prompt for them.
+
+See [Common Parameters](#commonargs) for a list of additional parameters, including
+the "-u" and "-p" parameters for username and password or preferably -N for .netrc usage.
+
+`--organization -o` (required) The organization to target.··
+`--environment -e` (required) The environment to target.··
+`--keystoreName` (required) The keystore to query.
+`--certificateName` (required) The certificate to query
+
+### <a name="getKeystore"></a>getKeystore
+
+Get details about a keystore
+
+#### Example
+Get details about the keystore "MyKeyStore-20210101"
+
+    apigeetool getKeystore --keystoreName MyKeyStore-20210101
+
+#### Required parameters
+
+The following parameters are required. However, if any are left unspecified
+on the command line, and if apigeetool is running in an interactive shell,
+then apigeetool will prompt for them.
+
+See [Common Parameters](#commonargs) for a list of additional parameters, including
+the "-u" and "-p" parameters for username and password or preferably -N for .netrc usage.
+
+`--organization -o` (required) The organization to target.··
+`--environment -e` (required) The environment to target.··
+`--keystoreName` (required) The keystore to query.
+
+### <a name="getReference"></a>getReference
+
+Get details about a reference
+
+#### Example
+Get details about the reference "TLSReference" about which real keystore it is pointing at. 
+
+    apigeetool getreference --referenceName "TLSReference"
+
+#### Required parameters
+
+The following parameters are required. However, if any are left unspecified
+on the command line, and if apigeetool is running in an interactive shell,
+then apigeetool will prompt for them.
+
+See [Common Parameters](#commonargs) for a list of additional parameters, including
+the "-u" and "-p" parameters for username and password or preferably -N for .netrc usage.
+
+`--organization -o` (required) The organization to target.··
+`--environment -e` (required) The environment to target.··
+`--referenceName` (required) The reference to query.
+
+### <a name="listKeystores"></a>listKeystores
+
+List all the keystore in an Apigee Environment
+
+#### Example
+List Keystores in the Dev Environment
+
+    apigeetool listKeystores -e "Dev"
+
+#### Required parameters
+
+The following parameters are required. However, if any are left unspecified
+on the command line, and if apigeetool is running in an interactive shell,
+then apigeetool will prompt for them.
+
+See [Common Parameters](#commonargs) for a list of additional parameters, including
+the "-u" and "-p" parameters for username and password or preferably -N for .netrc usage.
+
+`--organization -o` (required) The organization to target.··
+`--environment -e` (required) The environment to target.··
+
+### <a name="deleteKeystores"></a>deleteKeystore
+
+Delete a keystore.
+
+#### Example
+Delete a keystore "MyKeyStore-20210101"
+
+    apigeetool deleteKeystore --keystoreName MyKeyStore-20210101
+
+#### Required parameters
+
+The following parameters are required. However, if any are left unspecified
+on the command line, and if apigeetool is running in an interactive shell,
+then apigeetool will prompt for them.
+
+See [Common Parameters](#commonargs) for a list of additional parameters, including
+the "-u" and "-p" parameters for username and password or preferably -N for .netrc usage.
+
+`--organization -o` (required) The organization to target.
+`--environment -e` (required) The environment to target.
+`--keystoreName` (required) The keystore to delete.
+
 # <a name="sdkreference"></a>SDK Reference
 
 You could use apigeetool as an SDK to orchestrate tasks that you want to perform with Edge, for eg, deploying an api proxy or running tests etc.
diff --git a/lib/commands/commands.js b/lib/commands/commands.js
index 26445fb..f93ded3 100644
--- a/lib/commands/commands.js
+++ b/lib/commands/commands.js
@@ -276,6 +276,48 @@ var Commands = {
     load: function () {
       return require('./listRoleUsers');
     }
+  },
+  listKeystores: {
+    description: "List Keystores",
+    load: function () {
+      return require('./listKeystores');
+    }
+  },
+  listReferences: {
+    description: "List References",
+    load: function () {
+      return require('./listReferences');
+    }
+  },
+  getKeystore: {
+    description: "Get Keystore",
+    load: function () {
+      return require('./getKeystore');
+    }
+  },
+  deleteKeystore: {
+    description: "Delete Keystore",
+    load: function () {
+      return require('./deleteKeystore');
+    }
+  },
+  getReference: {
+    description: "Get References",
+    load: function () {
+      return require('./getReference');
+    }
+  },
+  getAlias: {
+    description: "Get Alias",
+    load: function () {
+      return require('./getAlias');
+    }
+  },
+  getCertificate: {
+    description: "Get Certificate",
+    load: function () {
+      return require('./getCertificate');
+    }
   }
 };
 
diff --git a/lib/commands/deleteKeystore.js b/lib/commands/deleteKeystore.js
new file mode 100644
index 0000000..9df0765
--- /dev/null
+++ b/lib/commands/deleteKeystore.js
@@ -0,0 +1,38 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  },
+   keystoreName:{
+    name:'Keystore Name',
+    required: true,
+    prompt: true
+  }
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('deleteKeystore: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/keystores/%s', opts.baseuri, opts.organization, opts.environment, opts.keystoreName);
+  var requestOptions = {
+    uri: uri,
+    method:'DELETE',
+    json:true
+  }
+  command_utils.run('deleteKeystore', opts,requestOptions,cb)  
+};
diff --git a/lib/commands/getAlias.js b/lib/commands/getAlias.js
new file mode 100644
index 0000000..5b2e372
--- /dev/null
+++ b/lib/commands/getAlias.js
@@ -0,0 +1,43 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  },
+   keystoreName: {
+    name:'Keystore Name',
+    required: true,
+    prompt: true
+  },
+  aliasName: {
+    name: 'Alias Name',
+    required: true,
+    prompt: true
+  }
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('getAlias: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/keystores/%s/aliases/%s', opts.baseuri, opts.organization, opts.environment, opts.keystoreName, opts.aliasName);
+  var requestOptions = {
+    uri: uri,
+    method:'GET',
+    json:true
+  }
+  command_utils.run('getAlias', opts,requestOptions,cb)  
+};
diff --git a/lib/commands/getCertificate.js b/lib/commands/getCertificate.js
new file mode 100644
index 0000000..e68b662
--- /dev/null
+++ b/lib/commands/getCertificate.js
@@ -0,0 +1,43 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  },
+  keystoreName: {
+    name:'Keystore Name',
+    required: true,
+    prompt: true
+  },
+  certificateName: {
+    name: 'Certificate Name',
+    required: true,
+    prompt: true
+  }
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('getCertificate: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/keystores/%s/certs/%s', opts.baseuri, opts.organization, opts.environment, opts.keystoreName, opts.certificateName);
+  var requestOptions = {
+    uri: uri,
+    method:'GET',
+    json:true
+  }
+  command_utils.run('getCertificate', opts,requestOptions,cb)  
+};
diff --git a/lib/commands/getKeystore.js b/lib/commands/getKeystore.js
new file mode 100644
index 0000000..3144b5f
--- /dev/null
+++ b/lib/commands/getKeystore.js
@@ -0,0 +1,38 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  },
+   keystoreName:{
+    name:'Keystore Name',
+    required: true,
+    prompt: true
+  },
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('getKeystore: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/keystores/%s', opts.baseuri, opts.organization, opts.environment, opts.keystoreName);
+  var requestOptions = {
+    uri: uri,
+    method:'GET',
+    json:true
+  }
+  command_utils.run('getKeystore', opts,requestOptions,cb)  
+};
diff --git a/lib/commands/getReference.js b/lib/commands/getReference.js
new file mode 100644
index 0000000..8aac1b4
--- /dev/null
+++ b/lib/commands/getReference.js
@@ -0,0 +1,38 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  },
+  referenceName: {
+    name:'Reference Name',
+    required: true,
+    prompt: true
+  }
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('getReference: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/references/%s', opts.baseuri, opts.organization, opts.environment, opts.referenceName);
+  var requestOptions = {
+    uri: uri,
+    method:'GET',
+    json:true
+  }
+  command_utils.run('getReference', opts,requestOptions,cb)
+};
diff --git a/lib/commands/listKeystores.js b/lib/commands/listKeystores.js
new file mode 100644
index 0000000..e3cc602
--- /dev/null
+++ b/lib/commands/listKeystores.js
@@ -0,0 +1,33 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  }
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('listKeystores: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/keystores', opts.baseuri, opts.organization, opts.environment);
+  var requestOptions = {
+    uri: uri,
+    method:'GET',
+    json:true
+  }
+  command_utils.run('listKeystores', opts,requestOptions,cb)  
+};
diff --git a/lib/commands/listReferences.js b/lib/commands/listReferences.js
new file mode 100644
index 0000000..fedd957
--- /dev/null
+++ b/lib/commands/listReferences.js
@@ -0,0 +1,33 @@
+/* jshint node: true  */
+'use strict';
+
+var util = require('util');
+var _ = require('underscore');
+
+var defaults = require('../defaults');
+var options = require('../options');
+var command_utils = require('./command-utils')
+
+var descriptor = defaults.defaultDescriptor({
+  environment: {
+    name: 'Environment',
+    shortOption: 'e',
+    required: true,
+    prompt: true
+  }
+});
+
+module.exports.descriptor = descriptor;
+
+module.exports.run = function(opts, cb) {  
+  if (opts.debug) {
+    console.log('listReferences: %j', opts);
+  }
+  var uri = util.format('%s/v1/o/%s/e/%s/references', opts.baseuri, opts.organization, opts.environment);
+  var requestOptions = {
+    uri: uri,
+    method:'GET',
+    json:true
+  }
+  command_utils.run('listReferences', opts,requestOptions,cb)  
+};
diff --git a/lib/main.js b/lib/main.js
index d100df6..74241b9 100644
--- a/lib/main.js
+++ b/lib/main.js
@@ -23,6 +23,16 @@ ApigeeTool.listDeployments = function(opts, cb) {
   runCommand(cmd, opts, cb);
 };
 
+ApigeeTool.listKeystores = function(opts, cb) {
+  var cmd = require('./commands/listkeystores');
+  runCommand(cmd, opts, cb);
+};
+
+ApigeeTool.listReferences = function(opts, cb) {
+  var cmd = require('./commands/listreferences');
+  runCommand(cmd, opts, cb);
+};
+
 ApigeeTool.deployNodeApp = function(opts, cb) {
   var cmd = require('./commands/deploynodeapp');
   runCommand(cmd, opts, cb);
@@ -53,6 +63,31 @@ ApigeeTool.getLogs = function(opts, cb) {
   runCommand(cmd, opts, cb);
 };
 
+ApigeeTool.getKeystore = function(opts, cb) {
+  var cmd = require('./commands/getkeystore');
+  runCommand(cmd, opts, cb);
+};
+
+ApigeeTool.deleteKeystore = function(opts, cb) {
+  var cmd = require('./commands/deletekeystore');
+  runCommand(cmd, opts, cb);
+};
+
+ApigeeTool.getReference = function(opts, cb) {
+  var cmd = require('./commands/getreference');
+  runCommand(cmd, opts, cb);
+};
+
+ApigeeTool.getAlias = function(opts, cb) {
+  var cmd = require('./commands/getalias');
+  runCommand(cmd, opts, cb);
+};
+
+ApigeeTool.getCertificate = function(opts, cb) {
+  var cmd = require('./commands/getcertificate');
+  runCommand(cmd, opts, cb);
+};
+
 ApigeeTool.delete = function(opts, cb) {
   var cmd = require('./commands/delete');
   runCommand(cmd, opts, cb);
diff --git a/lib/promisesdk.js b/lib/promisesdk.js
index cefb991..23a2fc8 100644
--- a/lib/promisesdk.js
+++ b/lib/promisesdk.js
@@ -24,6 +24,18 @@ ApigeeTool.listDeployments = function(opts) {
   return cb.promise
 };
 
+ApigeeTool.listKeystores = function(opts, cb) {
+  var cmd = require('./commands/listkeystores');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
+ApigeeTool.listReferences = function(opts, cb) {
+  var cmd = require('./commands/listreferences');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
 ApigeeTool.listSharedflowDeployments = function(opts) {
   var cb = q.defer()
   var cmd = require('./commands/listsharedflowdeployments');
@@ -101,6 +113,41 @@ ApigeeTool.getLogs = function(opts) {
   return cb.promise
 };
 
+ApigeeTool.getKeystore = function(opts, cb) {
+  var cb = q.defer()
+  var cmd = require('./commands/getkeystore');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
+ApigeeTool.deleteKeystore = function(opts, cb) {
+  var cb = q.defer()
+  var cmd = require('./commands/deletekeystore');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
+ApigeeTool.getAlias = function(opts, cb) {
+  var cb = q.defer()
+  var cmd = require('./commands/getalias');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
+ApigeeTool.getCertificate = function(opts, cb) {
+  var cb = q.defer()
+  var cmd = require('./commands/getcertificate');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
+ApigeeTool.getReference = function(opts, cb) {
+  var cb = q.defer()
+  var cmd = require('./commands/getreference');
+  runCommand(cmd, opts, cb);
+  return cb.promise
+};
+
 ApigeeTool.delete = function(opts) {
   var cb = q.defer()
   var cmd = require('./commands/delete');