“签名不匹配”将证书导入密钥库时出错 - 为什么？
原则上，这是一个关键工具问题，与 Shibboleth 无关，但它可能有助于理解我想要到达的地方（如果 Shibboleth 的东西不存在，请跳到粗体中的位）对你来说没有任何意义）：
我正在尝试设置 Shibboleth SSO 配置。 IdP 已经设置，并且我已经建立了一个 SP 来与其通信。到目前为止（经过多次黑客攻击后），一切顺利 - SP（链接到 apache 反向代理）拦截对安全资源的调用并正确重定向到 IdP，从而显示登录页面。登录后，IdP 回复并交给 SP 一个令牌。
然后，SP 应该联系 IdP，将令牌转换为对登录者有效的属性，但 IdP 抱怨该消息不符合安全要求。
据我所知，这是因为 tomcat 不接受 SP 的自签名证书。
相反，我尝试生成 CA 证书，并使用它来签署证书。我已将 CA 证书添加到 $JAVA_HOME/jre/lib/security/cacerts 中，因此 keytool 应该信任它，但是当我尝试将签名的 SP 证书导入密钥库时，出现错误：
keytool 错误：java.security。 SignatureException：签名不匹配。
我使用的导入命令是：
keytool -import -v -alias sp_signed_cert -keystore idp.jks -trustcacerts -file server.crt
其中 server.crt 是签名的 SP 证书。
为什么我会收到此错误，我该怎么办？
我似乎剩下的唯一选择是：
- 将 apache 放在运行 IdP 的 Tomcat 前面，并使用其“Optional_no_ca”设置能够使用自签名证书，
- 支付知名 CA 的费用来签署证书（尽管不太适合概念验证）
In principle, this is a keytool issue, not anything to do with Shibboleth, but it would probably be helpful to understand where I am trying to get to (skip to the bits in bold if the Shibboleth stuff doesn't mean anything to you):
I am trying to set up a Shibboleth SSO configuration. The IdP was already set up, and I have established an SP to talk to it. So far (after much hacking away), so good - the SP (linked into an apache reverse proxy) intercepts calls to secured resources and redirects to the IdP correctly, which presents a login page. After logging in, the IdP replies handing the SP a token.
The SP is then supposed to contact the IdP to get the token translated into attributes valid for the person who logged in, but here the IdP is complaining that the message doesn't meet security requirements.
As best as I can tell, this is because tomcat is not accepting the SP's certificate, which was self-signed.
Instead I am trying to generate a CA cert, and use that to sign the certificate. I have added the CA cert into $JAVA_HOME/jre/lib/security/cacerts, so keytool should trust it, but then when I try importing the signed SP certificate into the keystore, I get the error:
keytool error: java.security.SignatureException: Signature does not match.
The import command I am using is:
keytool -import -v -alias sp_signed_cert -keystore idp.jks -trustcacerts -file server.crt
where server.crt is the signed SP certificate.
Why am I getting this error, and what can I do about it?
The only options I seem to have left are:
- put apache in front of the Tomcat running the IdP and use its "optional_no_ca" setting to be able to use a self-signed certificate,
- pay for a well-known CA to sign the certificate (not really appropriate for a proof-of-concept, though)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
老实说，我不知道 SSO 或 IdP，但这里是：
如果这确实是问题所在，您所要做的就是将该证书导入到 Tomcat 的信任库中。
我不知道你想在这里做什么。由谁签署？
默认情况下，cacerts 具有所有受信任的 CA 的证书，例如 Verisign。
此外，您在帖子中提到的导入命令正在尝试导入到 idp.jks 而不是 cacerts
Well don't know about SSO or IdP to be honest but here goes:
If this is indeed the problem all you have to do is import that certificate to Tomcat's truststore.
I have no idea what you are trying to do here. It is signed by who?
The cacerts by default has the certificate of all CAs that are trusted e.g. Verisign.
Also the import command you mention in the post is trying to import to
idp.jksnot thecacerts你不需要在tomcat前面安装apache，而且Shibboleth人说不需要。
需要一个众所周知的 CA，只是因为在信任链上，如果您不愿意，您将永远不需要付费。
首先尝试在不加密的情况下进行通信，因为您正在进行概念验证。
错误是你导入的时候出现的？
为什么不导入 CA 证书而不是仅导入特定的 SP？
You don't need apache in front of tomcat, also, Shibboleth people say don't.
The need for a wll-known CA, is just because o trust-chains, you will never need to pay, if you don't want.
Try to communicate first without encryption, since you are doing a proof-of-concept.
The error is when you do the import?
Why don't you import the CA cert instead of just a specific SP?