将客户端自签名证书导入到java密钥库中
另请参阅：Java 密钥存储可以导入 OpenSSL 生成的密钥对吗？
我提供了以下文件来针对 thrift 端点进行身份验证：
- cacert.pem
- local.crt
- local.key
我在尝试创建包含客户端证书的密钥库时遇到了最困难的时间。端点应用程序有自己的 CA 来验证其客户端证书。老实说，我不确定密钥库中需要包含什么（假设客户端证书和端点公共证书），但我一生都无法让它工作。
有谁知道如何将客户端证书导入密钥库？或者，我需要做什么才能使其正常工作？谢谢。
See also: Can a Java key store import a key pair generated by OpenSSL?
I am provided with the following files to authenticate against a thrift endpoint:
- cacert.pem
- local.crt
- local.key
I am having the hardest time trying to create a keystore that has the client cert in it. The endpoint application has its own CA to authenticate they client certs. I honestly am not sure what needs to be included in the keystore (assuming the client cert, and the endpoint public cert), but for the life of me can not get it working.
Does anyone know how to import a client cert into a keystore? Or, what I need to do in order to get this working? Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
问题出在密钥库上，这就是我最终让它工作的方法。
首先要注意的是，据我所知，不可能使用 keytool 将私钥导入密钥库...
知道这一点后，我通过 openssl 将 local.crt 和 local.key 转换为 .p12 文件：
openssl pkcs12 -export -in local.crt -inkey local.key -out local.p12
然后使用 IBM 的工具（keyman）： http://www.alphaworks.ibm.com/tech/keyman/download
导入 CA 证书 (cacert.crt)，然后导入 .p12 文件，然后将其另存为一个密钥库。
希望这对某人有帮助！
The problem was with the keystore, this is how I finally got it working.
First thing to note is that its not possible (as far as I know) to import private keys into a keystore using keytool...
Knowing that, I converted the local.crt and local.key to a .p12 file via openssl:
openssl pkcs12 -export -in local.crt -inkey local.key -out local.p12
Then used a tool from IBM (keyman): http://www.alphaworks.ibm.com/tech/keyman/download
To import the CA cert (cacert.crt) and then the .p12 file, then saved that as a keystore.
Hope this helps someone!