java 证书链添加到p12(pfx)

Love The Way You Lie 2022-04-02 07:22 384阅读 0赞

我有问题,直接将此p12证书转换为java要求的工作jks密钥库.

我这样做了：

keytool -importkeystore -srckeystore certificate.p12 -srcstoretype PKCS12 -destkeystore certificate1.jks -deststoretype JKS -storepass secret
    keytool -import -alias root -file root_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret
    keytool -import -alias trusted -file trusted_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret

但这个jks不起作用,我在使用这个certificate1.jks时得到HTTP响应’403：Forbidden’

但是,如果我将此p12(pfx)证书导入Internet Explorer,然后将此证书从IE导出为pfx格式,选择“在证书路径中包含所有证书”复选框并使用：

keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore certificate2.jks -deststoretype JKS -storepass secret
    keytool -import -alias root -file root_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret
    keytool -import -alias trusted -file trusted_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret

然后一切正常,我可以使用certificate2.jks连接到WebService.

我发现原始certificate.p12(pfx)只包含一个条目(证书链长度：1)：

而从IE导出的“包含证书路径中的所有证书”的certificate.pfx包含带有第二个可信CA证书的证书链(证书链长度：2)：

keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v
    
    
    
    *******************************************
    *******************************************
    
    Alias name: alias
    Entry type: PrivateKeyEntry
    Certificate chain length: 2
    Certificate[1]:
    Owner: CN=MyCompany, EMAILADDRESS=my.email@domain.com, O=bla, C=PL
    Issuer: CN=Trusted CA, O=ble, C=PL
    Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Valid from: ... until: ...
    Certificate fingerprints:
             MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
             SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
             Signature algorithm name: SHA1withRSA
             Version: 3
    
    Extensions:
    
    #1: ObjectId: X.X.XX.XX Criticality=false
    KeyUsage [
      DigitalSignature
      Key_Encipherment
    ]
    
    ...
    
    Certificate[2]:
    Owner: CN=Trusted CA, O=ble ble ble, C=PL
    Issuer: CN=ROOT CA, O=ble ble ble, C=PL
    Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Valid from: ... until: ...
    Certificate fingerprints:
             MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
             SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
             Signature algorithm name: SHA1withRSA
             Version: 3
    
    Extensions:
    
    
    *******************************************
    *******************************************

因此,为了解决我的问题,我需要将p12证书与链接到可信CA证书.  
我可以通过将p12导入IE然后导出回“使用证书路径中的所有证书”来完成此操作.

如果没有IE使用keytool或其他工具,我怎么能这样做？