选择您的密钥库,选择私钥条目,然后选择 File->Save to pkcs12 文件(通常为 *.pfx)。 然后您可以使用以下命令查看内容:
$ openssl pkcs12 -in mykeyfile.pfx -info
If you don't need to do it programatically, but just want to manage your keys, then I've used IBM's free KeyMan tool for a long time now. Very nice for exporting a private key to a PFX file (then you can easily use OpenSSL to manipulate it, extract it, change pwds, etc).
You can extract a private key from a keystore with Java6 and OpenSSL. This all depends on the fact that both Java and OpenSSL support PKCS#12-formatted keystores. To do the extraction, you first use keytool to convert to the standard format. Make sure you use the same password for both files (private key password, not the keystore password) or you will get odd failures later on in the second step.
You should be able to handle that PEM file easily enough; it's plain text with an encoded unencrypted private key and certificate(s) inside it (in a pretty obvious format).
When you do this, take care to keep the files created secure. They contain secret credentials. Nothing will warn you if you fail to secure them correctly. The easiest method for securing them is to do all of this in a directory which doesn't have any access rights for anyone other than the user. And never put your password on the command line or in environment variables; it's too easy for other users to grab.
// Load input stream into keystore
keystore.load(is, password.toCharArray());
// List the aliases
Enumeration aliases = keystore.aliases();
for (; aliases.hasMoreElements(); ) {
String alias = (String)aliases.nextElement();
// Does alias refer to a private key?
boolean b = keystore.isKeyEntry(alias);
// Does alias refer to a trusted certificate?
b = keystore.isCertificateEntry(alias);
}
A portion of code originally from Example Depot for listing all of the aliases in a key store:
// Load input stream into keystore
keystore.load(is, password.toCharArray());
// List the aliases
Enumeration aliases = keystore.aliases();
for (; aliases.hasMoreElements(); ) {
String alias = (String)aliases.nextElement();
// Does alias refer to a private key?
boolean b = keystore.isKeyEntry(alias);
// Does alias refer to a trusted certificate?
b = keystore.isCertificateEntry(alias);
}
The exporting of private keys came up on the Sun forums a couple of months ago, and u:turingcompleter came up with a DumpPrivateKey class to stitch into your app.
import java.io.FileInputStream;
import java.security.Key;
import java.security.KeyStore;
import sun.misc.BASE64Encoder;
public class DumpPrivateKey {
/**
* Provides the missing functionality of keytool
* that Apache needs for SSLCertificateKeyFile.
*
* @param args <ul>
* <li> [0] Keystore filename.
* <li> [1] Keystore password.
* <li> [2] alias
* </ul>
*/
static public void main(String[] args)
throws Exception {
if(args.length < 3) {
throw new IllegalArgumentException("expected args: Keystore filename, Keystore password, alias, <key password: default same tha
n keystore");
}
final String keystoreName = args[0];
final String keystorePassword = args[1];
final String alias = args[2];
final String keyPassword = getKeyPassword(args,keystorePassword);
KeyStore ks = KeyStore.getInstance("jks");
ks.load(new FileInputStream(keystoreName), keystorePassword.toCharArray());
Key key = ks.getKey(alias, keyPassword.toCharArray());
String b64 = new BASE64Encoder().encode(key.getEncoded());
System.out.println("-----BEGIN PRIVATE KEY-----");
System.out.println(b64);
System.out.println("-----END PRIVATE KEY-----");
}
private static String getKeyPassword(final String[] args, final String keystorePassword)
{
String keyPassword = keystorePassword; // default case
if(args.length == 4) {
keyPassword = args[3];
}
return keyPassword;
}
}
KeyStore keys = ...
char[] password = ...
Enumeration<String> aliases = keys.aliases();
while (aliases.hasMoreElements()) {
String alias = aliases.nextElement();
if (!keys.isKeyEntry(alias))
continue;
Key key = keys.getKey(alias, password);
if ((key instanceof PrivateKey) && "PKCS#8".equals(key.getFormat())) {
/* Most PrivateKeys use this format, but check for safety. */
try (FileOutputStream os = new FileOutputStream(alias + ".key")) {
os.write(key.getEncoded());
os.flush();
}
}
}
First of all, be careful! All of your security depends on the… er… privacy of your private keys. Keytool doesn't have key export built in to avoid accidental disclosure of this sensitive material, so you might want to consider some extra safeguards that could be put in place to protect your exported keys.
Here is some simple code that gives you unencrypted PKCS #8 PrivateKeyInfo that can be used by OpenSSL (see the -nocrypt option of its pkcs8 utility):
KeyStore keys = ...
char[] password = ...
Enumeration<String> aliases = keys.aliases();
while (aliases.hasMoreElements()) {
String alias = aliases.nextElement();
if (!keys.isKeyEntry(alias))
continue;
Key key = keys.getKey(alias, password);
if ((key instanceof PrivateKey) && "PKCS#8".equals(key.getFormat())) {
/* Most PrivateKeys use this format, but check for safety. */
try (FileOutputStream os = new FileOutputStream(alias + ".key")) {
os.write(key.getEncoded());
os.flush();
}
}
}
If you need other formats, you can use a KeyFactory to get a transparent key specification for different types of keys. Then you can get, for example, the private exponent of an RSA private key and output it in your desired format. That would make a good topic for a follow-up question.
Another less-conventional but arguably easier way of doing this is with JXplorer. Although this tool is designed to browse LDAP directories, it has an easy-to-use GUI for manipulating keystores. One such function on the GUI can export private keys from a JKS keystore.
发布评论
评论(9)
如果您不需要以编程方式执行此操作,而只是想管理密钥,那么我已经使用 IBM 的免费 KeyMan 工具很长时间了。 非常适合将私钥导出到 PFX 文件(然后您可以轻松地使用 OpenSSL 来操作它、提取它、更改密码等)。
https:// www.ibm.com/developerworks/mydeveloperworks/groups/service/html/communityview?communityUuid=6fb00498-f6ea-4f65-bf0c-adc5bd0c5fcc
选择您的密钥库,选择私钥条目,然后选择 File->Save to pkcs12 文件(通常为 *.pfx)。 然后您可以使用以下命令查看内容:
$ openssl pkcs12 -in mykeyfile.pfx -info
If you don't need to do it programatically, but just want to manage your keys, then I've used IBM's free KeyMan tool for a long time now. Very nice for exporting a private key to a PFX file (then you can easily use OpenSSL to manipulate it, extract it, change pwds, etc).
https://www.ibm.com/developerworks/mydeveloperworks/groups/service/html/communityview?communityUuid=6fb00498-f6ea-4f65-bf0c-adc5bd0c5fcc
Select your keystore, select the private key entry, then File->Save to a pkcs12 file (*.pfx, typically). You can then view the contents with:
$ openssl pkcs12 -in mykeyfile.pfx -info
下面是上述代码在 Groovy 中的较短版本。 还内置了base64编码:
Here is a shorter version of the above code, in Groovy. Also has built-in base64 encoding:
您可以使用 Java6 和 OpenSSL 从密钥库中提取私钥。 这一切都取决于 Java 和 OpenSSL 都支持 PKCS#12 格式的密钥库这一事实。 要进行提取,您首先使用
keytool
转换为标准格式。 确保您对两个文件使用相同的密码(私钥密码,而不是密钥库密码),否则稍后在第二步中您将遇到奇怪的失败。接下来,使用 OpenSSL 提取 PEM:
您应该能够轻松处理该 PEM 文件; 它是纯文本,其中包含编码的未加密私钥和证书(以非常明显的格式)。
执行此操作时,请注意保证创建的文件的安全。 它们包含秘密凭证。 如果您未能正确保护它们,则不会有任何警告。 保护它们的最简单方法是在除用户之外的任何人都没有任何访问权限的目录中执行所有这些操作。 切勿将密码放在命令行或环境变量中; 其他用户很容易抢到。
You can extract a private key from a keystore with Java6 and OpenSSL. This all depends on the fact that both Java and OpenSSL support PKCS#12-formatted keystores. To do the extraction, you first use
keytool
to convert to the standard format. Make sure you use the same password for both files (private key password, not the keystore password) or you will get odd failures later on in the second step.Next, use OpenSSL to do the extraction to PEM:
You should be able to handle that PEM file easily enough; it's plain text with an encoded unencrypted private key and certificate(s) inside it (in a pretty obvious format).
When you do this, take care to keep the files created secure. They contain secret credentials. Nothing will warn you if you fail to secure them correctly. The easiest method for securing them is to do all of this in a directory which doesn't have any access rights for anyone other than the user. And never put your password on the command line or in environment variables; it's too easy for other users to grab.
部分代码最初来自示例仓库,用于列出密钥存储中的所有别名:
私钥的导出出现在 Sun 论坛 几个月前,以及 u:turingcompleter 提出了一个 DumpPrivateKey 类来缝合到您的应用程序中。
注意:这里使用 Sun 软件包,这是一件“坏事”< /a>.
如果您可以下载apache commons代码,这里是一个编译时不会发出警告的版本:
和将给出相同的结果:
您可以像这样使用它:
A portion of code originally from Example Depot for listing all of the aliases in a key store:
The exporting of private keys came up on the Sun forums a couple of months ago, and u:turingcompleter came up with a DumpPrivateKey class to stitch into your app.
Note: this use Sun package, which is a "bad thing".
If you can download apache commons code, here is a version which will compile without warning:
and will give the same result:
You can use it like so:
另一个很棒的工具是 KeyStore Explorer:http://keystore-explorer.sourceforge.net/
Another great tool is KeyStore Explorer: http://keystore-explorer.sourceforge.net/
这个问题出现在 stackexchange 安全性上,建议之一是使用 Keystore explorer
https://security.stackexchange.com/ questions/3779/how-can-i-export-my-private-key-from-a-java-keytool-keystore
刚刚尝试过,它效果非常好,我强烈推荐它。
This question came up on stackexchange security, one of the suggestions was to use Keystore explorer
https://security.stackexchange.com/questions/3779/how-can-i-export-my-private-key-from-a-java-keytool-keystore
Having just tried it, it works really well and I strongly recommend it.
对于安卓开发来说,
将 eclipse ADT 中创建的密钥库转换为 SignApk.jar 中使用的公钥和私钥:
导出私钥:
编辑 private.rsa.pem 并将“-----BEGIN PRIVATE KEY-----”保留为“-- ---END PRIVATE KEY-----”段落,然后:
导出公钥:
签署apk:
For android development,
to convert keystore created in eclipse ADT into public key and private key used in SignApk.jar:
export private key:
edit private.rsa.pem and leave "-----BEGIN PRIVATE KEY-----" to "-----END PRIVATE KEY-----" paragraph, then:
export public key:
sign apk:
首先,要小心! 您的所有安全都取决于...呃...隐私您的私钥。Keytool 没有内置密钥导出功能,以避免意外泄露此敏感材料,因此您可能需要考虑采取一些额外的保护措施来保护您导出的密钥。
下面是一些简单的代码,它为您提供了 OpenSSL 可以使用的未加密的 PKCS #8 PrivateKeyInfo(请参阅其 pkcs8 实用程序):
如果您需要其他格式,您可以使用 KeyFactory 来获取不同类型密钥的透明密钥规范。 然后,您可以获得 RSA 私钥的私有指数,并以您想要的格式输出。 这将为后续问题提供一个很好的主题。
First of all, be careful! All of your security depends on the… er… privacy of your private keys. Keytool doesn't have key export built in to avoid accidental disclosure of this sensitive material, so you might want to consider some extra safeguards that could be put in place to protect your exported keys.
Here is some simple code that gives you unencrypted PKCS #8 PrivateKeyInfo that can be used by OpenSSL (see the
-nocrypt
option of its pkcs8 utility):If you need other formats, you can use a KeyFactory to get a transparent key specification for different types of keys. Then you can get, for example, the private exponent of an RSA private key and output it in your desired format. That would make a good topic for a follow-up question.
另一种不太传统但可以说更简单的方法是使用 JXplorer。 尽管此工具旨在浏览 LDAP 目录,但它具有易于使用的 GUI 用于操作密钥库。 GUI 上的此类功能之一可以从 JKS 密钥库导出私钥。
Another less-conventional but arguably easier way of doing this is with JXplorer. Although this tool is designed to browse LDAP directories, it has an easy-to-use GUI for manipulating keystores. One such function on the GUI can export private keys from a JKS keystore.