如何在Java密钥库中导入现有的X.509证书和私钥以用于SSL?
我在ActiveMQ配置中有以下内容:如何在Java密钥库中导入现有的X.509证书和私钥以用于SSL?,java,ssl,jms,activemq,jks,Java,Ssl,Jms,Activemq,Jks,我在ActiveMQ配置中有以下内容: 我有一对X.509证书和一个密钥文件 如何导入这两个,以便在SSL和SSL+stomp连接器中使用它们?所有的例子我都可以谷歌自己生成密钥,但我已经有了一个密钥 我试过了 keytool -import -keystore ./broker.ks -file mycert.crt 但这只导入证书而不是密钥文件,并导致 2009-05-25 13:16:24,270 [localhost:61612] ERROR TransportConnector
我有一对X.509证书和一个密钥文件
如何导入这两个,以便在SSL和SSL+stomp连接器中使用它们?所有的例子我都可以谷歌自己生成密钥,但我已经有了一个密钥
我试过了
keytool -import -keystore ./broker.ks -file mycert.crt
但这只导入证书而不是密钥文件,并导致
2009-05-25 13:16:24,270 [localhost:61612] ERROR TransportConnector - Could not accept connection : No available certificate or key corresponds to the SSL cipher suites which are enabled.
我尝试将证书和密钥连接起来,但得到了相同的结果
如何导入密钥?信不信由你,keytool不提供像将私钥导入密钥库这样的基本功能。您可以尝试将带有私钥的PKSC12文件合并到密钥库:
keytool -importkeystore \
-deststorepass storepassword \
-destkeypass keypassword \
-destkeystore my-keystore.jks \
-srckeystore cert-and-key.p12 \
-srcstoretype PKCS12 \
-srcstorepass p12password \
-alias 1
$ keytool -importkeystore -deststorepass changeit -destkeypass changeit \
-destkeystore keystore.jks -srckeystore server.p12 -srcstoretype PKCS12 \
-srcstorepass changeit
或者只使用IBM提供的更为用户友好的密钥库处理功能,而不是keytool。是的,keytool没有导入私钥的功能,这确实是一个令人遗憾的事实
作为记录,最后我使用了所描述的解决方案,Java 6中的Keytool确实具有以下功能: 以下是该帖子的基本细节
openssl pkcs12 -export -in [my_certificate.crt] -inkey [my_key.key] -out [keystore.p12] -name [new_alias] -CAfile [my_ca_bundle.crt] -caname root
keytool -importkeystore -deststorepass [new_keystore_pass] -destkeypass [new_key_pass] -destkeystore [keystore.jks] -srckeystore [keystore.p12] -srcstoretype PKCS12 -srcstorepass [pass_used_in_p12_keystore] -alias [alias_used_in_p12_keystore]
我使用了以下两个步骤,我在其他答案中链接的评论/帖子中找到了这两个步骤: 第一步:将x.509证书和密钥转换为pkcs12文件
openssl pkcs12 -export -in server.crt -inkey server.key \
-out server.p12 -name [some-alias] \
-CAfile ca.crt -caname root
keytool -importkeystore \
-deststorepass [changeit] -destkeypass [changeit] -destkeystore server.keystore \
-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some-password \
-alias [some-alias]
openssl genrsa -out server.key 2048
openssl req -new -out server.csr -key server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
注意:确保您在pkcs12文件上输入了密码-否则在尝试导入时会出现空指针异常。(以防其他人头痛)。(谢谢jocull!) 注意2:您可能需要添加
-chain
选项以保留完整的证书链。(谢谢Mafuba)
第二步:将pkcs12文件转换为Java密钥库
openssl pkcs12 -export -in server.crt -inkey server.key \
-out server.p12 -name [some-alias] \
-CAfile ca.crt -caname root
keytool -importkeystore \
-deststorepass [changeit] -destkeypass [changeit] -destkeystore server.keystore \
-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some-password \
-alias [some-alias]
openssl genrsa -out server.key 2048
openssl req -new -out server.csr -key server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
完成
可选步骤零:创建自签名证书
openssl pkcs12 -export -in server.crt -inkey server.key \
-out server.p12 -name [some-alias] \
-CAfile ca.crt -caname root
keytool -importkeystore \
-deststorepass [changeit] -destkeypass [changeit] -destkeystore server.keystore \
-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some-password \
-alias [some-alias]
openssl genrsa -out server.key 2048
openssl req -new -out server.csr -key server.key
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
干杯 在我的例子中,我有一个pem文件,其中包含两个证书和一个用于相互SSL身份验证的加密私钥。 因此,我的pem文件如下所示:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,C8BF220FC76AA5F9
...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
$ openssl req -x509 -newkey rsa:2048 -keyout localhost.key -out localhost.csr -subj "/CN=localhost"
以下是我所做的:
将文件拆分为三个单独的文件,以便每个文件只包含一个条目,
以“---开始…”开头,以“---结束…”结尾。假设我们现在有三个文件:cert1.pem cert2.pem和pkey.pem
使用openssl和以下语法将pkey.pem转换为DER格式:
openssl pkcs8-topk8-nocrypt-in-pkey.pem-通知pem-out-pkey.der-出站
注意,如果私钥已加密,则需要提供密码(从原始pem文件的供应商处获取)
要转换为DER格式,
openssl将要求您输入如下密码:“输入pkey.pem的密码:
如果转换成功,您将获得一个名为“pkey.der”的新文件
创建新的java密钥存储并导入私钥和证书:
String keypass = "password"; // this is a new password, you need to come up with to protect your java key store file
String defaultalias = "importkey";
KeyStore ks = KeyStore.getInstance("JKS", "SUN");
// this section does not make much sense to me,
// but I will leave it intact as this is how it was in the original example I found on internet:
ks.load( null, keypass.toCharArray());
ks.store( new FileOutputStream ( "mykeystore" ), keypass.toCharArray());
ks.load( new FileInputStream ( "mykeystore" ), keypass.toCharArray());
// end of section..
// read the key file from disk and create a PrivateKey
FileInputStream fis = new FileInputStream("pkey.der");
DataInputStream dis = new DataInputStream(fis);
byte[] bytes = new byte[dis.available()];
dis.readFully(bytes);
ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
byte[] key = new byte[bais.available()];
KeyFactory kf = KeyFactory.getInstance("RSA");
bais.read(key, 0, bais.available());
bais.close();
PKCS8EncodedKeySpec keysp = new PKCS8EncodedKeySpec ( key );
PrivateKey ff = kf.generatePrivate (keysp);
// read the certificates from the files and load them into the key store:
Collection col_crt1 = CertificateFactory.getInstance("X509").generateCertificates(new FileInputStream("cert1.pem"));
Collection col_crt2 = CertificateFactory.getInstance("X509").generateCertificates(new FileInputStream("cert2.pem"));
Certificate crt1 = (Certificate) col_crt1.iterator().next();
Certificate crt2 = (Certificate) col_crt2.iterator().next();
Certificate[] chain = new Certificate[] { crt1, crt2 };
String alias1 = ((X509Certificate) crt1).getSubjectX500Principal().getName();
String alias2 = ((X509Certificate) crt2).getSubjectX500Principal().getName();
ks.setCertificateEntry(alias1, crt1);
ks.setCertificateEntry(alias2, crt2);
// store the private key
ks.setKeyEntry(defaultalias, ff, keypass.toCharArray(), chain );
// save the key store to a file
ks.store(new FileOutputStream ( "mykeystore" ),keypass.toCharArray());
(可选)验证新密钥存储的内容:
keytool-list-keystoremykeystore-storepass密码
密钥库类型:JKS密钥库提供程序:SUN
您的密钥库包含3个条目
cn=…,ou=…,o=…,2014年9月2日,trustedCertEntry,证书
指纹(SHA1):2C:B8:
importkey,2014年9月2日,PrivateKeyEntry,证书指纹
(SHA1):9C:B0:
cn=…,o=…,2014年9月2日,trustedCertEntry,证书指纹
(沙1):83:63:
(可选)根据SSL服务器测试新密钥存储中的证书和私钥:
(您可能希望将调试作为VM选项启用:-Djavax.net.debug=all)
如果计划使用HttpsURLConnection,请最终向其注册证书:
char[] passw = "password".toCharArray();
KeyStore ks = KeyStore.getInstance("JKS", "SUN");
ks.load(new FileInputStream ( "mykeystore" ), passw );
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(ks, passw);
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ks);
TrustManager[] tm = tmf.getTrustManagers();
SSLContext sclx = SSLContext.getInstance("TLS");
sclx.init( kmf.getKeyManagers(), tm, null);
HostnameVerifier hv = new HostnameVerifier()
{
public boolean verify(String urlHostName, SSLSession session)
{
if (!urlHostName.equalsIgnoreCase(session.getPeerHost()))
{
System.out.println("Warning: URL host '" + urlHostName + "' is different to SSLSession host '" + session.getPeerHost() + "'.");
}
return true;
}
};
HttpsURLConnection.setDefaultSSLSocketFactory( sclx.getSocketFactory() );
HttpsURLConnection.setDefaultHostnameVerifier(hv);
还有一点:
#!/bin/bash
# We have:
#
# 1) $KEY : Secret key in PEM format ("-----BEGIN RSA PRIVATE KEY-----")
# 2) $LEAFCERT : Certificate for secret key obtained from some
# certification outfit, also in PEM format ("-----BEGIN CERTIFICATE-----")
# 3) $CHAINCERT : Intermediate certificate linking $LEAFCERT to a trusted
# Self-Signed Root CA Certificate
#
# We want to create a fresh Java "keystore" $TARGET_KEYSTORE with the
# password $TARGET_STOREPW, to be used by Tomcat for HTTPS Connector.
#
# The keystore must contain: $KEY, $LEAFCERT, $CHAINCERT
# The Self-Signed Root CA Certificate is obtained by Tomcat from the
# JDK's truststore in /etc/pki/java/cacerts
# The non-APR HTTPS connector (APR uses OpenSSL-like configuration, much
# easier than this) in server.xml looks like this
# (See: https://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html):
#
# <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
# SSLEnabled="true"
# maxThreads="150" scheme="https" secure="true"
# clientAuth="false" sslProtocol="TLS"
# keystoreFile="/etc/tomcat6/etl-web.keystore.jks"
# keystorePass="changeit" />
#
# Let's roll:
TARGET_KEYSTORE=/etc/tomcat6/foo-server.keystore.jks
TARGET_STOREPW=changeit
TLS=/etc/pki/tls
KEY=$TLS/private/httpd/foo-server.example.com.key
LEAFCERT=$TLS/certs/httpd/foo-server.example.com.pem
CHAINCERT=$TLS/certs/httpd/chain.cert.pem
# ----
# Create PKCS#12 file to import using keytool later
# ----
# From https://www.sslshopper.com/ssl-converter.html:
# The PKCS#12 or PFX format is a binary format for storing the server certificate,
# any intermediate certificates, and the private key in one encryptable file. PFX
# files usually have extensions such as .pfx and .p12. PFX files are typically used
# on Windows machines to import and export certificates and private keys.
TMPPW=$$ # Some random password
PKCS12FILE=`mktemp`
if [[ $? != 0 ]]; then
echo "Creation of temporary PKCS12 file failed -- exiting" >&2; exit 1
fi
TRANSITFILE=`mktemp`
if [[ $? != 0 ]]; then
echo "Creation of temporary transit file failed -- exiting" >&2; exit 1
fi
cat "$KEY" "$LEAFCERT" > "$TRANSITFILE"
openssl pkcs12 -export -passout "pass:$TMPPW" -in "$TRANSITFILE" -name etl-web > "$PKCS12FILE"
/bin/rm "$TRANSITFILE"
# Print out result for fun! Bug in doc (I think): "-pass " arg does not work, need "-passin"
openssl pkcs12 -passin "pass:$TMPPW" -passout "pass:$TMPPW" -in "$PKCS12FILE" -info
# ----
# Import contents of PKCS12FILE into a Java keystore. WTF, Sun, what were you thinking?
# ----
if [[ -f "$TARGET_KEYSTORE" ]]; then
/bin/rm "$TARGET_KEYSTORE"
fi
keytool -importkeystore \
-deststorepass "$TARGET_STOREPW" \
-destkeypass "$TARGET_STOREPW" \
-destkeystore "$TARGET_KEYSTORE" \
-srckeystore "$PKCS12FILE" \
-srcstoretype PKCS12 \
-srcstorepass "$TMPPW" \
-alias foo-the-server
/bin/rm "$PKCS12FILE"
# ----
# Import the chain certificate. This works empirically, it is not at all clear from the doc whether this is correct
# ----
echo "Importing chain"
TT=-trustcacerts
keytool -import $TT -storepass "$TARGET_STOREPW" -file "$CHAINCERT" -keystore "$TARGET_KEYSTORE" -alias chain
# ----
# Print contents
# ----
echo "Listing result"
keytool -list -storepass "$TARGET_STOREPW" -keystore "$TARGET_KEYSTORE"
#/bin/bash
#我们有:
#
#1)$KEY:PEM格式的密钥(“----开始RSA私钥------”)
#2)$LEAFCERT:从某些服务器获得的密钥证书
#认证机构,同样采用PEM格式(“BEGIN证书”)
#3)$CHAINCERT:将$LEAFCERT链接到受信任证书的中间证书
#自签名根CA证书
#
#我们希望使用
#密码$TARGET_STOREPW,由Tomcat用于HTTPS连接器。
#
#密钥库必须包含:$KEY、$LEAFCERT、$CHAINCERT
#自签名根CA证书由Tomcat从
#JDK在/etc/pki/java/cacerts中的信任库
#非APR HTTPS连接器(APR)使用类似OpenSSL的配置
#(比这更简单)在server.xml中如下所示
#(见:https://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html):
#
#
#
#让我们开始:
TARGET_KEYSTORE=/etc/tomcat6/foo-server.KEYSTORE.jks
TARGET_STOREPW=changeit
TLS=/etc/pki/TLS
KEY=$TLS/private/httpd/foo-server.example.com.KEY
LEAFCERT=$TLS/certs/httpd/foo-server.example.com.pem
CHAINCERT=$TLS/certs/httpd/chain.cert.pem
# ----
#创建PKCS#12文件,以便稍后使用keytool导入
# ----
#从https://www.sslshopper.com/ssl-converter.html:
#PKCS#12或PFX格式是用于存储服务器证书的二进制格式,
#任何中间证书,以及一个可加密文件中的私钥。PFX
#文件的扩展名通常为.pfx和.p12。通常使用PFX文件
#在Windows计算机上导入和导出证书和私钥。
TMPPW=$$#一些随机密码
PKCS12FILE=`mktemp`
如果[[$?!=0]];然后
echo“创建临时PKCS12文件失败--正在退出”>&2;出口1
fi
TRANSITFILE=`mktemp`
如果[[$?!=0]];然后
echo“创建临时传输文件失败--正在退出”>&2;出口1
fi
cat“$KEY”“$LEAFCERT”>“$TRANSITFILE”
openssl pkcs12-export-passout“pass:$TMPPW”-在“$TRANSITFILE”-名称etl web>“$PKCS12FILE”中
/bin/rm“$TRANSITFILE”
#打印出来的结果很有趣!文档中的Bug(我认为):
$ keytool -importkeystore -deststorepass changeit -destkeypass changeit \
-destkeystore keystore.jks -srckeystore server.p12 -srcstoretype PKCS12 \
-srcstorepass changeit
openssl pkcs12 -export -in certificate.crt -inkey privateKey.key -name alias -out yourconvertedfile.p12
keytool -importkeystore -deststorepass changeit -destkeystore keystore.jks -srckeystore umeme.p12 -srcstoretype PKCS12
char[] keyPassword = "changeit".toCharArray();
KeyStore keyStore = KeyStore.getInstance("JKS");
InputStream keyStoreData = new FileInputStream("keystore.jks");
keyStore.load(keyStoreData, keyPassword);
KeyStore.ProtectionParameter entryPassword = new KeyStore.PasswordProtection(keyPassword);
KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry)keyStore.getEntry("alias", entryPassword);
System.out.println(privateKeyEntry.toString());
byte[] data = "test".getBytes("UTF8");
keyStore.load(keyStoreData, keyPassword);
//get cert, pubkey and private key from the store by alias
Certificate cert = keyStore.getCertificate("localhost");
PublicKey publicKey = cert.getPublicKey();
KeyPair keyPair = new KeyPair(publicKey, (PrivateKey) key);
//sign with this alg
Signature sig = Signature.getInstance("SHA1WithRSA");
sig.initSign(keyPair.getPrivate());
sig.update(data);
byte[] signatureBytes = sig.sign();
System.out.println("Signature:" + Base64.getEncoder().encodeToString(signatureBytes));
sig.initVerify(keyPair.getPublic());
sig.update(data);
System.out.println(sig.verify(signatureBytes));
public static void main(String[] args) throws Exception {
byte[] data = "test".getBytes("UTF8");
// load keystore
char[] keyPassword = "changeit".toCharArray();
KeyStore keyStore = KeyStore.getInstance("JKS");
//System.getProperty("user.dir") + "" < for a file in particular path
InputStream keyStoreData = new FileInputStream("keystore.jks");
keyStore.load(keyStoreData, keyPassword);
Key key = keyStore.getKey("localhost", keyPassword);
Certificate cert = keyStore.getCertificate("localhost");
PublicKey publicKey = cert.getPublicKey();
KeyPair keyPair = new KeyPair(publicKey, (PrivateKey) key);
Signature sig = Signature.getInstance("SHA1WithRSA");
sig.initSign(keyPair.getPrivate());
sig.update(data);
byte[] signatureBytes = sig.sign();
System.out.println("Signature:" + Base64.getEncoder().encodeToString(signatureBytes));
sig.initVerify(keyPair.getPublic());
sig.update(data);
System.out.println(sig.verify(signatureBytes));
}
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out pkcs.p12 \
-name letsencrypt
keytool -importkeystore -destkeystore keystore.jks -srckeystore pkcs.p12 \
-srcstoretype PKCS12 -alias letsencrypt