密钥库别名空错误
我正在尝试配置一个名为 Hermes 的产品来进行数字签名。
我有一个文件 MyCert.pfx，我在其配置中指定如下：
<component id="keystore-manager-for-signature" name="Key Store Manager for Digital Signature">
<class>hk.hku.cecid.piazza.commons.security.KeyStoreManager</class>
<parameter name="keystore-location" value="/opt/mycompany/certs/MyCert.pfx"/>
<parameter name="keystore-password" value="12345678"/>
<!-- parameter name="key-alias" value="joeblank"/-->
<!-- parameter name="key-password" value="12345678"/-->
<parameter name="keystore-type" value="PKCS12"/>
<parameter name="keystore-provider" value="org.bouncycastle.jce.provider.BouncyCastleProvider"/>
</component>
Hermes 抛出这样的异常：
hk.hku.cecid.ebms.spa.task.MessageValidationException: Cannot sign the ebxml message
by hk.hku.cecid.ebms.pkg.SignatureException: [10204] Cannot sign message Exception: java.lang.NullPointerException Message: null
Try to retreive key alias[null] from keystore[/opt/mycompany/certs/MyCert.pfx]
by java.lang.NullPointerException
我没有 pfx 文件的别名。我在Tomcat的server.xml中使用时不需要指定一个。
还有人建议我应该使用这样的命令将证书导入到 jsk 存储中：
keytool -importkeystore -deststorepass [password] -destkeystore [JKS keystore file] -deststoretype JKS -destalias [alias] -srckeystore [p12 keystore file] -srcstoretype PKCS12 -srcstorepass [password] -srcalias [alias]
我必须删除 -srcalias 部分，因为我没有该部分，这也要求我删除 -destalias 。因此，在这种情况下，我在 mycompany.jks 中没有可引用的已知别名
。无论如何，我都没有别名。我尝试使用 keytool -import 导入 pfx 文件，但这会引发“输入不是 X.509 证书”。
你们建议我接下来应该尝试什么？
I am trying to configure a product called Hermes for a digital signature.
I have a file MyCert.pfx which I specified in its configuration as follows:
<component id="keystore-manager-for-signature" name="Key Store Manager for Digital Signature">
<class>hk.hku.cecid.piazza.commons.security.KeyStoreManager</class>
<parameter name="keystore-location" value="/opt/mycompany/certs/MyCert.pfx"/>
<parameter name="keystore-password" value="12345678"/>
<!-- parameter name="key-alias" value="joeblank"/-->
<!-- parameter name="key-password" value="12345678"/-->
<parameter name="keystore-type" value="PKCS12"/>
<parameter name="keystore-provider" value="org.bouncycastle.jce.provider.BouncyCastleProvider"/>
</component>
Hermes throws an exception like this:
hk.hku.cecid.ebms.spa.task.MessageValidationException: Cannot sign the ebxml message
by hk.hku.cecid.ebms.pkg.SignatureException: [10204] Cannot sign message Exception: java.lang.NullPointerException Message: null
Try to retreive key alias[null] from keystore[/opt/mycompany/certs/MyCert.pfx]
by java.lang.NullPointerException
I don't have the alias for the pfx file. I didn't need to specify one when I used it in Tomcat's server.xml.
It was also suggested that I should use a command like this to import the certificate into a jsk store:
keytool -importkeystore -deststorepass [password] -destkeystore [JKS keystore file] -deststoretype JKS -destalias [alias] -srckeystore [p12 keystore file] -srcstoretype PKCS12 -srcstorepass [password] -srcalias [alias]
I had to remove the -srcalias portion since I didn't have that, which required me to remove the -destalias as well. So in this case, I don't have a known alias to reference in mycompany.jks
Either way I don't have an alias. I tried importing the pfx file using keytool -import, but that throws a " Input not an X.509 certificate".
What do you guys suggest I should try next?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
听起来您的应用程序在未指定别名的情况下不使用默认的
别名。应用程序/库（包括 Apache Tomcat）在未指定别名时选择它们找到的第一个别名是很常见的。然而，你的似乎需要一个。您可以使用
keytool -list -storetype PKCS12 -keystore找到它（如果需要，也可以使用-v来更清楚地查看别名）。别名应该是该行的第一部分，内容类似于2, Jan 12, 2012, PrivateKeyEntry（此处为“2”），位于指纹之前。keystore -import确实仅用于证书。keytool -importkeystore可用于将 PKCS#12 存储转换为 JKS 存储，但您不需要它，因为您可以指定PKCS12类型。It sounds like your application doesn't use a default
aliaswhen none is specified. It's quite common for applications/libraries (including Apache Tomcat) to pick the first alias they find when none is specified. However, yours seems to need one.You can find it using
keytool -list -storetype PKCS12 -keystore(if needed, use-vtoo to see the alias more clearly). The alias name should be the first part of the line that says something like2, Jan 12, 2012, PrivateKeyEntry(here "2"), just before the fingerprint.keystore -importis indeed just for certificates.keytool -importkeystorecould be used for converting the PKCS#12 store into a JKS store, but you shouldn't need it, since you're able to specify thePKCS12type.