java 证书链添加到p12(pfx)

最新推荐文章于 2025-06-28 23:15:59 发布

转载最新推荐文章于 2025-06-28 23:15:59 发布 · 1.6k 阅读

本文探讨了将p12证书转换为Java兼容的jks格式时遇到的问题，特别是当证书链不完整导致HTTP响应'403：Forbidden'时。通过对比从IE导出的p12和直接转换的p12，发现后者缺少完整的证书链。文章详细描述了如何确保转换后的jks文件包含所有必要的证书，以便在调用WebService时不会遇到权限问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

我有问题,直接将此p12证书转换为java要求的工作jks密钥库.

我这样做了：

keytool -importkeystore -srckeystore certificate.p12 -srcstoretype PKCS12 -destkeystore certificate1.jks -deststoretype JKS -storepass secret
keytool -import -alias root -file root_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret
keytool -import -alias trusted -file trusted_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret

但这个jks不起作用,我在使用这个certificate1.jks时得到HTTP响应’403：Forbidden’

但是,如果我将此p12(pfx)证书导入Internet Explorer,然后将此证书从IE导出为pfx格式,选择“在证书路径中包含所有证书”复选框并使用：

keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore certificate2.jks -deststoretype JKS -storepass secret
keytool -import -alias root -file root_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret
keytool -import -alias trusted -file trusted_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret

然后一切正常,我可以使用certificate2.jks连接到WebService.

我发现原始certificate.p12(pfx)只包含一个条目(证书链长度：1)：

keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v


*******************************************
*******************************************

Alias name: alias
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=MyCompany, EMAILADDRESS=my.email@domain.com, O=bla, C=PL
Issuer: CN=Trusted CA, O=ble, C=PL
Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid from: ... until: ...
Certificate fingerprints:
         MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: X.X.XX.XX Criticality=false
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

...

*******************************************
*******************************************

而从IE导出的“包含证书路径中的所有证书”的certificate.pfx包含带有第二个可信CA证书的证书链(证书链长度：2)：

keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v



*******************************************
*******************************************

Alias name: alias
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=MyCompany, EMAILADDRESS=my.email@domain.com, O=bla, C=PL
Issuer: CN=Trusted CA, O=ble, C=PL
Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid from: ... until: ...
Certificate fingerprints:
         MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: X.X.XX.XX Criticality=false
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

...

Certificate[2]:
Owner: CN=Trusted CA, O=ble ble ble, C=PL
Issuer: CN=ROOT CA, O=ble ble ble, C=PL
Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid from: ... until: ...
Certificate fingerprints:
         MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:


*******************************************
*******************************************

因此,为了解决我的问题,我需要将p12证书与链接到可信CA证书.
我可以通过将p12导入IE然后导出回“使用证书路径中的所有证书”来完成此操作.

如果没有IE使用keytool或其他工具,我怎么能这样做？