将 Thawte 试用证书导入 Java 密钥库 [英] Importing Thawte trial certificates into a Java keystore

问题描述

我正在尝试使用 SSL 配置 Tomcat 服务器.我已经生成了一个密钥对:

I'm trying to configure a Tomcat server with SSL. I've generated a keypair thus:

$ keytool -genkeypair -alias tomcat -keyalg RSA -keystore keys

接下来我生成一个证书签名请求:

Next I generate a certificate signing request:

$ keytool -certreq -keyalg RSA -alias tomcat -keystore keys -file tomcat.csr

然后我将 tomcat.csr 的内容复制粘贴到 Thawte 网站上的表格中，要求提供试用 SSL 证书.作为回报，我得到两个以 -----BEGIN ... -----END 分隔的证书，我保存在 tomcat.crt 和 thawte 下.crt.(Thawte 将第二个证书称为Thawte 测试 CA 根"证书).

Then I copy-paste the contents of tomcat.csr into a form on Thawte's website, asking for a trial SSL certificate. In return I get two certificates delimited with -----BEGIN ... -----END, that I save under tomcat.crt and thawte.crt. (Thawte calls the second certificate a 'Thawte Test CA Root' certificate).

当我尝试导入其中任何一个时都失败了:

When I try to import either of them it fails:

$ keytool -importcert -alias tomcat -file tomcat.crt -keystore keys
Enter keystore password:
keytool error: java.lang.Exception: Failed to establish chain from reply

$ keytool -importcert -alias thawte -file thawtetest.crt -keystore keys
Enter keystore password:
keytool error: java.lang.Exception: Input not an X.509 certificate

向其中任何一个命令添加 -trustcacerts 选项也不会改变任何内容.

Adding the -trustcacerts option to either of these commands doesn't change anything either.

知道我在这里做错了什么吗?

Any idea what I am doing wrong here?

推荐答案

我终于明白这里发生了什么.事实证明，我从 Thawte 得到的答复格式为 PKCS#7，而 keytool 期望以 X.509 格式进行认证.

I finally understood what was going on here. It turns out that the replies that I got from Thawte are formatted as PKCS#7, whereas keytool expects certificated in the X.509 format.

openssl 可用于将证书从一种格式转换为另一种格式:

openssl can be used to convert certificates from one format to another:

$ openssl pkcs7 -in thawtetest.crt -print_certs |
  openssl x509 > thawtetest.x509

现在您可以使用 keytool 导入 thawtetest.x509，并在其后面导入 tomcat.crt.

Now you can import thawtetest.x509 with keytool, and tomcat.crt right behind it.

这篇关于将 Thawte 试用证书导入 Java 密钥库的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！