Java 将second.p12导入密钥库后握手失败且CA未知
我向密钥库添加了一个.p12证书（到目前为止还没有证书） 我在SOAPUI中使用了keyStore.p12，密码为myDestPassword，一切正常 现在，我在现有密钥库中导入了第二个.p12（参数相同）： 导入成功了，但在我尝试使用更新的keyStore.p12（与之前相同的wsdl和地址）进行SOAP调用之后，我得到了 有人知道为什么吗 更新： 我还尝试在Java应用程序中使用这个密钥存储。行为是一样的。我添加了第一个证书-->它可以工作。我添加了第二个证书，但我得到了一个错误，但现在，我的错误是：Java 将second.p12导入密钥库后握手失败且CA未知,java,soap,ssl-certificate,soapui,keytool,Java,Soap,Ssl Certificate,Soapui,Keytool,我向密钥库添加了一个.p12证书（到目前为止还没有证书） 我在SOAPUI中使用了keyStore.p12，密码为myDestPassword，一切正常 现在，我在现有密钥库中导入了第二个.p12（参数相同）： 导入成功了，但在我尝试使用更新的keyStore.p12（与之前相同的wsdl和地址）进行SOAP调用之后，我得到了 有人知道为什么吗 更新： 我还尝试在Java应用程序中使用这个密钥存储。行为是一样的。我添加了第一个证书-->它可以工作。我添加了第二个证书，但我得到了一个错误，但现在，
Exception in thread "main" java.lang.Exception: myService.uploadParameters call FAILED with: com.sun.xml.internal.ws.client.ClientTransportException: HTTP-Transportfehler: javax.net.ssl.SSLHandshakeException: Received fatal alert: unknown_ca
C:\>keytool -list -keystore KeyStore.p12 -storetype PKCS12
Keystore-Kennwort eingeben:
Keystore-Typ: PKCS12
Keystore-Provider: SunJSSE
Keystore enthält 2 Einträge
muster max (btt/beat2), 23.03.2020, PrivateKeyEntry,
Zertifikat-Fingerprint (SHA1): 03:A0:3C:0F:4A:91:1A:40:2D:C3:EC:A0:23:D5:E6:44:C5:29:34:DC
client_cert_muster, 23.03.2020, PrivateKeyEntry,
Zertifikat-Fingerprint (SHA1): 06:13:A2:8A:84:E8:F9:74:50:E8:BA:D3:79:9F:FB:5F:CB:09:1E:D0
我认为问题在于您试图将两个密钥对放在同一个中。p12和客户端通常只需要密钥对的公共部分，编码为X509证书。当.p12中有多个
PrivateKeyEntrykeytool -exportcert -keystore FIRSTCert.p12 -storetype PKCS12 -storepass mySrcPassword -file firstcert.cer
keytool -exportcert -keystore SECONDCert.p12 -storetype PKCS12 -storepass 12345 -file secondcert.cer
keytool -importcert -keystore keyStore.p12 -storetype PKCS12 -storepass myDestPassword -file firstcert.cer
keytool -importcert -keystore keyStore.p12 -storetype PKCS12 -storepass myDestPassword -file secondcert.cer -alias mykey2
keytool -list -keystore keyStore.p12 -storetype PKCS12 -storepass myDestPassword
Keystore type: PKCS12
Keystore provider: SUN
Your keystore contains 2 entries
mykey, 23 march 2020, trustedCertEntry,
Certificate fingerprint (SHA-256): 26:FB:B4:8F:42:9C:48:5E:EE:8D:35:2E:A5:1C:79:EA:23:B5:36:50:47:62:4D:BC:D1:3D:26:61:04:1C:1A:32
mykey2, 23 march 2020, trustedCertEntry,
Certificate fingerprint (SHA-256): C1:06:CA:06:F1:29:80:72:16:1F:F6:72:04:39:16:17:31:E0:7A:5B:28:BB:41:4C:77:8E:94:F1:C5:8D:70:F8
trustedCertEntry除非你真的知道自己在做什么，否则不要将服务器的完整密钥对移出机器；它应该只有服务器知道。我认为问题在于您试图将两个密钥对放在同一个中。p12和客户端通常只需要密钥对的公共部分，编码为X509证书。当.p12中有多个
PrivateKeyEntrykeytool -exportcert -keystore FIRSTCert.p12 -storetype PKCS12 -storepass mySrcPassword -file firstcert.cer
keytool -exportcert -keystore SECONDCert.p12 -storetype PKCS12 -storepass 12345 -file secondcert.cer
keytool -importcert -keystore keyStore.p12 -storetype PKCS12 -storepass myDestPassword -file firstcert.cer
keytool -importcert -keystore keyStore.p12 -storetype PKCS12 -storepass myDestPassword -file secondcert.cer -alias mykey2
keytool -list -keystore keyStore.p12 -storetype PKCS12 -storepass myDestPassword
Keystore type: PKCS12
Keystore provider: SUN
Your keystore contains 2 entries
mykey, 23 march 2020, trustedCertEntry,
Certificate fingerprint (SHA-256): 26:FB:B4:8F:42:9C:48:5E:EE:8D:35:2E:A5:1C:79:EA:23:B5:36:50:47:62:4D:BC:D1:3D:26:61:04:1C:1A:32
mykey2, 23 march 2020, trustedCertEntry,
Certificate fingerprint (SHA-256): C1:06:CA:06:F1:29:80:72:16:1F:F6:72:04:39:16:17:31:E0:7A:5B:28:BB:41:4C:77:8E:94:F1:C5:8D:70:F8
trustedCertEntry除非你真的知道自己在做什么，否则不要将服务器的完整密钥对移出机器；它应该只被服务器知道。Thx@Daniel-alot感谢他的帮助。 我终于找到了办法。我不知道这是不是正确的，但它是有效的。回答我。 启动应用程序时，我仅使用信任库初始化TLS：
static void initTLS(String trustStore, String trustStorePW ){
System.setProperty("https.protocols", "TLSv1.2")
System.setProperty("javax.net.ssl.trustStore",trustStore)
System.setProperty("javax.net.ssl.trustStorePassword", trustStorePW)
}
static void initKeyStore( String aliasName ){
String keyStorePW = "abc..."
String keyStorePath = "path/to/keyStore"
KeyStore keystore = KeyStore.getInstance("PKCS12");
char[] pwdArray = keyStorePW.toCharArray();
keystore.load(new FileInputStream(keyStorePath), pwdArray);
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(keystore, keyStorePW.toCharArray());
final X509KeyManager origKm = (X509KeyManager)kmf.getKeyManagers()[0];
X509KeyManager km = new X509KeyManager() {
@Override
public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
return aliasName
}
@Override
public X509Certificate[] getCertificateChain(String alias) {
return origKm.getCertificateChain(alias);
}
@Override
public String[] getClientAliases(String keyType, Principal[] issuers) {
return origKm.getClientAliases(keyType, issuers)
}
@Override
public String[] getServerAliases(String keyType, Principal[] issuers) {
return origKm.getServerAliases(keyType, issuers)
}
@Override
public PrivateKey getPrivateKey(String alias) {
return origKm.getPrivateKey(alias);
}
@Override
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
return origKm.chooseServerAlias(keyType, issuers, socket );
}
}
SSLContext sslContext = SSLContext.getInstance("TLS");
KeyManager[] kms = [km]
sslContext.init(kms, null, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
aliasName我认为这是相当肮脏的，我将不得不优化这段代码。但最终还是成功了。谢谢丹尼尔的帮助。 我终于找到了办法。我不知道这是不是正确的，但它是有效的。回答我。 启动应用程序时，我仅使用信任库初始化TLS：
static void initTLS(String trustStore, String trustStorePW ){
System.setProperty("https.protocols", "TLSv1.2")
System.setProperty("javax.net.ssl.trustStore",trustStore)
System.setProperty("javax.net.ssl.trustStorePassword", trustStorePW)
}
static void initKeyStore( String aliasName ){
String keyStorePW = "abc..."
String keyStorePath = "path/to/keyStore"
KeyStore keystore = KeyStore.getInstance("PKCS12");
char[] pwdArray = keyStorePW.toCharArray();
keystore.load(new FileInputStream(keyStorePath), pwdArray);
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(keystore, keyStorePW.toCharArray());
final X509KeyManager origKm = (X509KeyManager)kmf.getKeyManagers()[0];
X509KeyManager km = new X509KeyManager() {
@Override
public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
return aliasName
}
@Override
public X509Certificate[] getCertificateChain(String alias) {
return origKm.getCertificateChain(alias);
}
@Override
public String[] getClientAliases(String keyType, Principal[] issuers) {
return origKm.getClientAliases(keyType, issuers)
}
@Override
public String[] getServerAliases(String keyType, Principal[] issuers) {
return origKm.getServerAliases(keyType, issuers)
}
@Override
public PrivateKey getPrivateKey(String alias) {
return origKm.getPrivateKey(alias);
}
@Override
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
return origKm.chooseServerAlias(keyType, issuers, socket );
}
}
SSLContext sslContext = SSLContext.getInstance("TLS");
KeyManager[] kms = [km]
sslContext.init(kms, null, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
aliasName我认为这是相当肮脏的，我将不得不优化这段代码。但最后它还是起作用了。导入密钥库时是否指定了单独的别名？默认别名为
mykeykeytool-nopromptPrivateKeyEntryTrustedCertificateEntry-importkeystore-importcert-importcertkeytool-list-keystore keystore.p12-storetype pkcs12mykeykeytool-nopromptPrivateKeyEntryTrustedCertificateEntry-importkeystore-importcert-importcertkeytool-list-keystore keystore.p12-storetype pkcs12