首页 > 解决方案 > 为什么 Java 的 keytool 不显示使用 openssl 创建的 PKCS12 信任库的条目?

问题描述

我不确定为什么 Javakeytool认为我的.p12密钥库是空的。

如果我创建一个新的自签名证书并将其放在truststore.p12pkcs12 密钥库中openssl,如下所示:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -subj "/C=US/ST=Oregon/L=Portland/O=Company Name/OU=Org/CN=www.example.com" -sha256

# This prompts for a password, I used 'changeit'
openssl pkcs12 -export -out truststore.p12 -nokeys -in cert.pem

然后查看truststore.p12with的内容:

openssl pkcs12 -in truststore.p12 -nodes

MAC verified OK
Bag Attributes: <No Attributes>
subject=/C=US/ST=Oregon/L=Portland/O=Company Name/OU=Org/CN=www.example.com
issuer=/C=US/ST=Oregon/L=Portland/O=Company Name/OU=Org/CN=www.example.com
-----BEGIN CERTIFICATE-----
MIIFszCCA5ugAwIBAgIJAPddgoNwHemLMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNV
BAYTAlVTMQ8wDQYDVQQIDAZPcmVnb24xETAPBgNVBAcMCFBvcnRsYW5kMRUwEwYD
VQQKDAxDb21wYW55IE5hbWUxDDAKBgNVBAsMA09yZzEYMBYGA1UEAwwPd3d3LmV4
YW1wbGUuY29tMB4XDTIxMDgyNDIyMzcwN1oXDTIyMDgyNDIyMzcwN1owcDELMAkG
A1UEBhMCVVMxDzANBgNVBAgMBk9yZWdvbjERMA8GA1UEBwwIUG9ydGxhbmQxFTAT
BgNVBAoMDENvbXBhbnkgTmFtZTEMMAoGA1UECwwDT3JnMRgwFgYDVQQDDA93d3cu
ZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCmx0XY
pkxMIPgq1GwgpBacHkKHz5R5tQD+uLBzKPa/mwHSwX2MQiHdnq5WIf3omx9AdsF1
gV56iNaHEVPp3WcW9BGkG3UrRuUBuWgGRuy2rEVpUQOFR+WziPbzG8Sq9ot9qQBP
d8sLLwfSj1JlN7sTLkco9mdvxvhYmPp4874qz2Okk3Madh3M94gWTPRdEmqcHDP8
cdETCmJOAw+NfLO962adssUz+ppRWFbG2+w44Xn2fkbgyfZ06CFz6WLfstVrEcvD
j82am0Ysp5+I9zzicvcCrchu5gPwWXS0zKDQsrsrgOXHvYhzOkrD+i3+89BWFyh0
DxGG8uOnnd8nWWiLD/nrQzQLqqXK+i/CvVS+7qr8GBWNgOC+x47rGp33+Oq50EFj
h2kj0gZC5zhhbtA+Y/magcSoFcH7cCj9k9RKeyZDJSHvlIMvkzMveyPAs2upApwx
lEBIq+0/M1/m+6eEbFz5ZxLa+zR21gdIjVo6PejzowzS6GB5yJSwXMvE/WZsb1c5
Ae5AMvssIE85A3NONm73lqV6HiBuQW3K92id6PiLLP+nMmDCVP3KneO+K5exPF53
KwIkC9YtThPsKxQywOztql08k9zVYKf86y0TfqxnHezGCpm9ZQb+f0Adj/NVw0yT
brXPCLCUpbIa1VlP2cYSJ5ZaNRGcE5GC5kDd4wIDAQABo1AwTjAdBgNVHQ4EFgQU
Ll1H2X+k+3uUe7kXEpGx1D/NY30wHwYDVR0jBBgwFoAULl1H2X+k+3uUe7kXEpGx
1D/NY30wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEApmlL3QxP0nD3
nVcphCRfAzjZW0UCrJXz7ldGqfTatR4gwSauU04mazvo5OBvnr6QYEtY8JhlDciX
cTdFYsR25Y52f6XvBgh/EHQ8l1PRJ4SlKcQU1JJxTW2sWRexPVqrCcLo3h18O67V
AZnIWLSlPth1nhbYoqWJJPgWqjDp0DIazIFwZSkK7BhJkXFlPhEsGmw0SeDuqVye
Tm6AcnW1ybrScw6aZgMlsARw80OVxvrHLyXW9kHPeInku5OvsCdBQNj8yR6uQykl
SN8yyBnFO6LVdLPTHrdyAC6VbJwXdajXSUEwx5y6so+9thIHx2Vk7OoHGAl62rzf
B6td3GPVVJpO/7Fm16IHq6V3hQznhiVj2wBqOzfApnxotJsWj80G7VofSPoD705F
iimNwHuvE7oJeYc4K/Uk3YJIkrxUoUkRp7z4pjvKUN+FEEB6gdquBTm9FJaTStNf
BRyzUiu3TMkZPWzDm8tJ79zhFj+BbOlbbivZGV/Bqy2j5y1Zc6XThWGGwRehgGmJ
qPuGAWvZ5b7N4dvArU58B+28F5F1Ka73nr29P9lKV1EOSBMs7vBjR9L1DBpvr/wl
sFU1LhITEJcOPAjHzVh/2ubH2UOHEDH+WH/QETS7oFORoTTZ5+bew2cfsIYniL3/
sKd4THRpAbJtWRAQOQceRDqdAUx6ZPA=
-----END CERTIFICATE-----

一切看起来都很好。但是当我尝试使用 keytool 查看相同的文件时:

keytool -list -v -keystore truststore.p12 -storepass changeit -storetype PKCS12

我从keytool

Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 0 entries

为什么?

对于上下文,我正在生成自己的自签名 CA 并使用它颁发客户端和服务器证书。我有一些 Java 应用程序需要使用我的 CA 信任链(通过-Djavax.net.ssl.trustStore命令行参数,但失败,因为我怀疑 keytool 认为它是空的)。

现在,keytool将显示privateKeyEntry我是否包含证书的相应私钥。但是,我正在创建一个信任存储(即 CA 链),它不应该有任何私钥;只有公共证书。

标签: javasslopenssl

解决方案


推荐阅读