有关 keytool 证书导入的详细信息
我有一个远程数据库服务器的 server.crt、root.crt 和 server.key 文件要添加到我们的 CF8 Enterprise 密钥库中。我学会了如何通过 keytool 轻松导入证书。我的问题特别集中在导入什么以及如何导入：
- 我应将 3 个文件中的哪一个或全部输入到 Castore 中？如果有的话，首选哪个？如果全部，我是否只需按顺序同时添加它们？
- 本教程描述了如何使用 .cer 文件。我必须从 .crt 转换吗？
- .crt 文件作为 X.509 发送给我。这是否自动采用可区分编码规则 (DER) 格式（CF8 认为这是必要的）？
以下是我使用的参考页面：
http://cf-click.blogspot .com/2010/06/configuring-ssl-to-work-with-coldfusion.html
http://download.oracle.com/javase /6/docs/technotes/tools/solaris/keytool.html#KeyStore
I have a remote db server's server.crt, root.crt and server.key files to add into our CF8 Enterprise keystore. I learned how to import a certificate via keytool easy enough. My questions focus specifically on what and how to import:
- Which one, or all, of the 3 files do I enter into castore? If one, which is preferred? If all, do I just add them at the same time in sequence?
- The tutorials describe using .cer files. Do I have to convert from .crt?
- The .crt files were sent to me as X.509. Is this automatically in Distinguished Encoding Rules (DER) format, which CF8 says is necessary?
Here are the reference pages I used:
http://cf-click.blogspot.com/2010/06/configuring-ssl-to-work-with-coldfusion.html
http://download.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html#KeyStore
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
root.crt 进入castore，因为这是服务器信任库，并且 root.cer 可能包含 server.crt 证书链基础上的证书。通过这样做，您表示您相信它可以识别其他值得信任的证书。
server.crt 是包含服务器公钥的证书，server.key 是服务器相应的私钥，这些密钥存储在服务器的密钥库中。
.crt 和 .cer 一般是等价的（只是表明它是一个证书，通常是 X.509）。通常采用 DER 格式，但也可以采用其他格式，例如 Base64。
root.crt goes in the castore since this is the servers truststore and root.cer presumably contains the certificate at the base of the server.crt certificate chain. By doing this you are saying you trust it to identify other certificates to trust.
server.crt is a certificate containing the servers's public key and server.key is the corresponding private key for the server's and these go in the server's keystore.
.crt and and .cer are generally equivalent (just indicates that it is a certificate, normally X.509). Usually this will be in DER format but could be otherwise such as Base64.