从命令行启动 java 应用程序时可以防止数字签名警告吗？
当您从命令行运行 Java 应用程序时，是否有任何方法可以防止出现“无法验证应用程序的数字签名”警告消息？
我正在寻找一个命令行解决方案，它允许在持续集成服务器上启动这样的应用程序，因此我需要一个不需要手动干预的解决方案。
另外，我不希望对任何应用程序禁用此警告，因为这可能会带来安全风险。
不确定是否有帮助，但我确实知道签名的“名称”、“发布者”和“来自”字段的值。
请确定，我不是在询问如何签署此应用程序。
更新 1
我认为解决方案是使用 keytool 从命令行导入证书，但由于某种原因，它确实无法正确导入它，因为在此之后它不会出现在控制面板小程序中应用程序仍然需要它。
keytool -importcert -file my.cer -alias alf2 -storepass changeme -noprompt
它是否与默认keystore相关，我如何保证我是导入到正确的密钥库？
更新2
经过在网上进行大量研究后，我取得了一些进展，至少在 Windows 7 和 Java 6 上工作：keytool -importcert -file my.cer -keystore "%USERPROFILE%\AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs" -storepass "" -noprompt -v
我看起来 Sun 未能在文档中指定默认密钥库的真实位置以及默认密码为空的事实。
但这还不是结束，因为当在自动化用户帐户上运行时它失败了，它失败是因为该用户还没有密钥库，并且因为命令行工具 keytool 无法创建一个密钥库。密钥库的密码为空，要求至少 6 个字符。 查看 Sun 的论坛动态...
Is there any way to prevent the "The application's digital signature cannot be verified" warning message from appearing when you run a Java application from the command line?
I'm looking for a command line solution that would allow to start an application like this on a continuous integration server, so I need a solution that would not require manual intervention.
Also, I would prefer not to disable this warning for any application because this could be a security risk.
Not sure if helps but I do know the values of "name", "publisher" and "from" fields of the signature.
Just be sure, I'm not asking about how to sign this application.
update 1
I suppose that the solution is to use keytool to import the certificate from the command line but for some reason it does fail to import it properly because it does not appear in control panel applet after this and the application still requires it.
keytool -importcert -file my.cer -alias alf2 -storepass changeme -noprompt
Is it something related to the the default keystore, how can I assure I'm importing into the right keystore?
update 2
After lot of research on the net I made some progress, worked at least on Windows 7 with Java 6: keytool -importcert -file my.cer -keystore "%USERPROFILE%\AppData\LocalLow\Sun\Java\Deployment\security\trusted.certs" -storepass "" -noprompt -v
I looks that Sun failed to specify in the documentation the real location of the default keystore and the fact that the default password is blank.
But this is not the end, because when this run on the automation user account it failed, it failed because this user did not had an keystore yet and because the command line tool keytool is not able to create a keystore with an empty password, requesting at least 6 characters. see Sun's forum tread...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
trust.certs 文件是基于用户（配置文件）的。使用 keytool 还可以将受信任的根 CA 添加到“cacert”文件，其中存储了 java 的默认受信任 CA。
XP 上的 cacert 文件位置（取决于 Java 版本）：C:\Program Files\Java\jre6\lib\security
更多详细信息：
默认密码是：changeit
trusted.certs file is user (profile) based. Using keytool it is also possible to add trusted root CA to "cacert" file, where are default trusted CA for java stored.
cacert file location on XP (depends on Java version): C:\Program Files\Java\jre6\lib\security
More details here:
default password is: changeit
有两种方法：
让软件供应商重新发布带有正确签名的软件。 “更多信息”链接应该告诉您为什么无法验证签名，但最可能的原因是签名是使用自签名 CA 证书或已过期的证书创建的。 （如果供应商不提供帮助，您可以使用自己的证书对 JAR 文件进行签名。）
将相关签名证书作为“可信证书”添加到 JVM 的证书存储中。不幸的是，您需要对每台需要运行应用程序的计算机上的每个 JVM 执行此操作。
There are two approaches:
Get the supplier of the software to reissue it with a proper signature. The "More Information" link should tell you why the signature cannot be verified, but the most likely causes are that the signature was created using a self-signed CA certificate, or a certificate that has since expired. (If the supplier won't help, you may be able to resign the JAR file with your own certificate.)
Add the relevant signing certificate to the JVM's certificate store as a "trusted certificate". Unfortunately, you'll need to do this for every JVM on every machine that needs to run the application.
如果未经用户同意而允许运行未签名的应用程序，这将严重损害用户的安全/隐私。
答案是“否”，除非您对应用程序进行了签名或者用户手动将发布者添加到“受信任”列表中。
更多信息此处
It would be a serious compromise on user security/privacy if unsigned applications are allowed to run without user's consent.
The answer is 'NO', unless you get your app signed or the user manually adds the publisher to the 'trusted' lists.
More here
如果证书存储实际上不存在，不知道是否仍然是 Windows XP keytool 要求输入密码，因此您应该在导入证书之前手动创建或从某处复制存储。用户存储没有密码。
Don't know whether it is still actually Windows XP keytool asks for password if cert store actally not exist, so you should create manually or copy store from somewhere before importing certificates. User store was without password.
我认为您应该在 java.home/lib/security 中创建文件，例如 mypolicy.policy 并授予您签名的代码的所有权限，并将此文件添加到 java.security （例如，在 java.policy 路径所在的行下）此警告窗口将不再提示
I think you should create file for example mypolicy.policy in java.home/lib/security with grant all permisions to code signed by you and add this file to java.security (ex. under line where is java.policy path) this warning window will never prompt again