将证书链添加到p12(pfx)证书 [英] Adding certificate chain to p12(pfx) certificate

问题描述

我在Java和cxf中有一个用客户端证书连接到WebServices的应用程序.

I have aplication in java and cxf which connects to WebServices with client certificate.

我从WebService所有者那里获得了证书

I got certificates form WebService owner

• certificate.p12
• certificate.pem
• certificate.crt
• trusted_ca.cer
• root_ca.cer

我无法直接将此p12证书转换为Java要求的有效的jks密钥库.

I have problem with straightforward converting this p12 certficate to working jks keystore requred by java.

我这样做了:

keytool -importkeystore -srckeystore certificate.p12 -srcstoretype PKCS12 -destkeystore certificate1.jks -deststoretype JKS -storepass secret
keytool -import -alias root -file root_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret
keytool -import -alias trusted -file trusted_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret

但是此jks不起作用，使用此证书时，我收到HTTP响应'403:Forbidden'.

but this jks doesn`t work and I get HTTP response '403: Forbidden' when using this certificate1.jks

但是，如果我将此p12(pfx)证书导入Internet Explorer，然后将该证书从IE导出为pfx格式，请选中在证书路径中包括所有证书"复选框并使用:

However if I import this p12(pfx) certificate to Internet Explorer and then export this certificate from IE to pfx format selecting "Include all certificates in the certification path" checkbox and use:

keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore certificate2.jks -deststoretype JKS -storepass secret
keytool -import -alias root -file root_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret
keytool -import -alias trusted -file trusted_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret

然后一切正常，我可以使用certificate2.jks连接到WebService.

Then everything works fine and I can connect to WebService using certificate2.jks.

我发现原始证书.p12(pfx)仅包含一个条目(证书链长度:1):

I found that original certificate.p12(pfx) contains only one entry (Certificate chain length: 1):

keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v


*******************************************
*******************************************

Alias name: alias
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=MyCompany, EMAILADDRESS=[e-mail], O=bla, C=PL
Issuer: CN=Trusted CA, O=ble, C=PL
Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid from: ... until: ...
Certificate fingerprints:
         MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: X.X.XX.XX Criticality=false
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

...

*******************************************
*******************************************

从IE导出的带有在证书路径中包括所有证书"的certificate.pfx包含具有第二个受信任CA证书的证书链(证书链长度:2):

while certificate.pfx exported from IE with "Include all certificates in the certification path" contains certificate chain with second Trusted CA certificate (Certificate chain length: 2):

keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v



*******************************************
*******************************************

Alias name: alias
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=MyCompany, EMAILADDRESS=[e-mail], O=bla, C=PL
Issuer: CN=Trusted CA, O=ble, C=PL
Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid from: ... until: ...
Certificate fingerprints:
         MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: X.X.XX.XX Criticality=false
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

...

Certificate[2]:
Owner: CN=Trusted CA, O=ble ble ble, C=PL
Issuer: CN=ROOT CA, O=ble ble ble, C=PL
Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Valid from: ... until: ...
Certificate fingerprints:
         MD5:  XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:


*******************************************
*******************************************

因此，要解决我的问题，我需要拥有带有可信任CA证书链的p12证书. 为此，我可以将p12导入IE，然后使用在证书路径中包括所有证书"将其导出.

So to solve my problem I need to have p12 certificate with chain to trusted CA certificate. I can do this by importing p12 to IE and then exporting back with "Include all certificates in the certification path".

在没有使用keytool或其他工具的IE的情况下如何做到这一点?

How can I do this without IE using keytool or other tool?

Bary

推荐答案

自己的答案.

我想出了如何使用OpenSSL做到这一点:

I figured out how to do this with OpenSSL:

openssl pkcs12 -in certificate.p12 -out clientcert.pem -nodes -clcerts
openssl x509 -in trusted_ca.cer -inform DER -out trusted_ca.pem
openssl x509 -in root_ca.cer -inform DER -out root_ca.pem
cat clientcert.pem trusted_ca.pem root_ca.pem >> clientcertchain.pem
openssl pkcs12 -export -in clientcertchain.pem -out clientcertchain.pfx

这篇关于将证书链添加到p12(pfx)证书的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！