使用keytool生成双向认证仓库及证书

小吴在此

已于 2022-05-16 16:05:49 修改

阅读量1.6k

点赞数

文章标签：服务器运维

于 2022-05-16 16:03:04 首次发布

本文链接：https://blog.youkuaiyun.com/qq_38981656/article/details/124801237

版权

本文详细介绍了如何生成服务端和客户端的自签名证书，并进行双向认证配置。首先，生成服务端的自签名证书，接着创建客户端的密钥对和证书仓库，将服务端证书导入客户端仓库。然后，生成客户端的自签名证书，并将其导入到服务端的信任证书仓库中。最后，提供了查看证书仓库和证书的命令。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

生成服务端自签名证书

root@master01:/home/casa/cer-test#  keytool -genkey -alias tlsServer -keysize 2048 -validity 365 -keyalg RSA -dname "CN=localhost" -keypass server -storepass server -keystore server.jks

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore server.jks -destkeystore server.jks -deststoretype pkcs12".

生成服务端自签名证书

root@master01:/home/casa/cer-test# keytool -export -alias tlsServer -keystore server.jks -storepass server -file server.cer
Certificate stored in file <server.cer>

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore server.jks -destkeystore server.jks -deststoretype pkcs12".

生成客户端的密钥对和证书仓库

root@master01:/home/casa/cer-test# keytool -genkey -alias tlsClient -keysize 2048 -validity 365 -keyalg RSA -dname "CN=node01" -keypass client -storepass client -keystore client.jks

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -impo