是否可以在没有密码的情况下从签名的 java 代码访问密钥库中的密钥？
所以，这就是我要拍摄的场景。
我有一个应用程序服务器。该应用程序服务器上有一个受密码保护的密钥库文件。密钥库文件内有一个私钥，我必须以编程方式从部署的 war 文件中获取访问权限。
我不想在我的代码中存储密码。
war 文件是在单独的开发机器上构建的。在构建时，提供开发人员私钥，对 war 文件进行签名。
该开发者的公共证书已导入到应用服务器的密钥库可信证书中。
在代码中，我希望能够加载密钥库并检索私钥，而无需提供密钥的密码。我希望由可信证书签署的代码足以进行身份验证以成功检索密钥。
如果恶意用户获得对应用程序服务器的访问权限，他们将无法修改签名的代码，因为这会破坏签名。他们也无法部署自己的代码，因为他们没有可信的私钥。最后，他们将无法将自己的证书作为可信证书导入到密钥库中，因为他们没有密钥库密码。
这可能吗？如果没有，那为什么不呢？
So, here is the scenario I am shooting for.
I have an application server. On that application server is a password-protected keystore file. Inside the keystore file is a private key that I must programmatically gain access to from a deployed war file.
I do not want to store a password in my code.
The war file is built on a separate developer machine. At build time, a developer private key is supplied, signing the war file.
Said developer's public certificate has been imported into the application server's keystore trusted certificates.
From within the code, I want to be able to load up the keystore, and retrieve the private key, without supplying the password for the key. I was hoping that having the code signed by a trusted certificate would be authentication enough to successfully retrieve the key.
If a malicious user were to gain access to the application server, they would not be able to modify the signed code, because that would break the signature. They also would not be able to deploy their own code, as they don't have a trusted private key. Finally, they would not be able to import their own certificate as a trusted certificate into the keystore, because they do not have the keystore password.
Is this possible? If not, then why not?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果没有密码，您将无法检索“Java Key Store”格式密钥存储中的私钥。
它与“身份验证”无关。在JKS文件中，私钥是加密的，密码就是密钥。没有该密钥，就无法恢复私钥。
不过，您不必将私钥存储在 Java 密钥存储中。例如，您可以将其存储在未加密的文件中。
或者，如果您需要与现有代码兼容，您可以实现自己的
Provider并创建一个不使用加密的KeyStore实现。大多数需要KeyStore的应用程序都支持选项来控制实例化的密钥存储的提供程序和类型。在这两种方法中，您仅依赖操作系统的文件权限来限制对私钥的访问。
更安全的方法是让应用程序在启动时提示输入密码。
You can't retrieve your private key in a "Java Key Store" format key store without a password.
It has nothing to do with "authentication." In a JKS file, private keys are encrypted, and the password is the key. Without that key, there is no way to recover the private key.
You don't have to store private keys in a Java Key Store though. For example, you could store it in an unencrypted file.
Or, if you need compatibility with existing code, you could implement your own
Providerand create aKeyStoreimplementation that does not use encryption. Most applications that require aKeyStoresupport options to control the provider and type of key store that is instantiated.In either of these approaches, you're relying solely on the operating system's file permissions to restrict access to the private key.
A safer approach would be to have the application prompt for the password as it starts up.
没有办法将应用程序由特定证书密钥签名的事实转换为能够访问密钥库文件。您能做的最好的事情就是以其他方式向应用程序提供密钥库的密码 - 使用属性或 JNDI 或配置文件或类似的东西。
There isn't a way to translate the fact that the application is signed by a particular certificate's key to being able to access a keystore file. The best you can do is provide the keystore's password to the application some other way - with a property or JNDI or a config file or something of that sort.