在我的情况下，我得到错误连接到AWS Gov Postgres RDS。GOV RDS CA证书有一个单独的链接- https://s3.us-gov-west-1.amazonaws.com/rds-downloads/rds-combined-ca-us-gov-bundle.pem

将此pem certs添加到java的cacerts中。您可以使用下面的脚本。

——WINDOWDS步骤

使用VSCODE编辑器，安装openssl, keytool插件 在C:/rds-ca目录下创建目录 将“cacerts”文件和下面的脚本文件-“addCerts.sh”在目录“rd-ca” 运行vscode: 4.1 CD /c/rds-ca/ . 4.2。/ addCerts.sh 拷贝cacerts到${JAVA_HOME}/jre/lib/security目录下

脚本代码:

#!/usr/bin/env sh

OLDDIR="$PWD"

CACERTS_FILE=cacerts

cd /c/rds-ca

echo "Downloading RDS certificates..."

curl  https://s3.us-gov-west-1.amazonaws.com/rds-downloads/rds-combined-ca-us-gov-bundle.pem > rds-combined-ca-bundle.pem

csplit -sk rds-combined-ca-bundle.pem "/-BEGIN CERTIFICATE-/" "{$(grep -c 'BEGIN CERTIFICATE' rds-combined-ca-bundle.pem | awk '{print $1 - 2}')}"

for CERT in xx*; do
    # extract a human-readable alias from the cert
    ALIAS=$(openssl x509 -noout -text -in $CERT |
                   perl -ne 'next unless /Subject:/; s/.*CN=//; print')
    echo "importing $ALIAS"
    
    keytool -import \
            -keystore  $CACERTS_FILE \
            -storepass changeit -noprompt \
            -alias "$ALIAS" -file $CERT
done

cd "$OLDDIR"
echo "$NEWDIR"

(转载自我的其他回复) 使用java软件发行版中的cli实用工具keytool导入(并信任!)所需的证书

示例:

从命令行更改目录到jre\bin 检查密钥库(在jre\bin目录中找到的文件) Keytool -list -keystore ..\lib\security\cacerts . txt 密码为changeit 从需要的服务器下载并保存链中的所有证书。 添加证书(在需要删除文件..\lib\security\cacerts上的“只读”属性之前)，运行: keytool -alias REPLACE_TO_ANY_UNIQ_NAME -import -keystore.使用实例\lib\security\cacerts -file "r:\root.crt"

我偶然发现了这么一个简单的小窍门。 其他解决方案需要使用InstallCert.Java和JDK

来源:http://www.java-samples.com/showtutorial.php?tutorialid=210

这就是我所做的。

我想在Java 10上开发应用程序，我有Eclipse IDE 2020-06。 证书导入解决方案对我不起作用。 因此，我安装了Java 11 JDK，切换到最新的Eclipse IDE(在Java 11上运行)，并通过在Maven POM下添加以下语句来确保源代码仍然可以根据Java 10编译:

    <maven.compiler.target>1.10</maven.compiler.target>
    <maven.compiler.source>1.10</maven.compiler.source>
    <maven.compiler.release>10</maven.compiler.release>

它就像一个魔法;没有错误。

I am working on a tutorial for REST web services at www.udemy.com (REST Java Web Services). The example in the tutorial said that in order to have SSL, we must have a folder called "trust_store" in my eclipse "client" project that should contain a "key store" file (we had a "client" project to call the service, and "service" project that contained the REST web service - 2 projects in the same eclipse workspace, one the client, the other the service). To keep things simple, they said to copy "keystore.jks" from the glassfish app server (glassfish\domains\domain1\config\keystore.jks) we are using and put it into this "trust_store" folder that they had me make in the client project. That seems to make sense: the self-signed certs in the server's key_store would correspond to the certs in the client trust_store. Now, doing this, I was getting the error that the original post mentions. I have googled this and read that the error is due to the "keystore.jks" file on the client not containing a trusted/signed certificate, that the certificate it finds is self-signed.

为了让事情更清楚，让我说一下我理解的“密钥库”。“Jks”包含自签名的certs，以及“cacerts. Jks”。“jks”文件中包含CA证书(由CA签名)。“密钥存储库。Jks是“密钥存储库”，cacerts是“cacerts”。Jks”是“信任商店”。正如一位名叫“布鲁诺”的评论者所说，“密钥库。Jks是本地的，cacerts是本地的。Jks”用于远程客户端。

So, I said to myself, hey, glassfish also has the "cacerts.jks" file, which is glassfish's trust_store file. cacerts.jsk is supposed to contain CA certificates. And apparently I need my trust_store folder to contain a key store file that has at least one CA certificate. So, I tried putting the "cacerts.jks" file in the "trust_store" folder I had made, on my client project, and changing the VM properties to point to "cacerts.jks" instead of "keystore.jks". That got rid of the error. I guess all it needed was a CA cert to work.

这对于生产来说可能并不理想，甚至对于开发来说也不理想。例如，您可以使用“keytool”命令将CA证书添加到“密钥存储库”中。Jks”文件在客户端。但无论如何，希望这至少能缩小可能导致错误的情况。

另外:我的方法似乎对客户端有用(服务器证书添加到客户端trust_store)，看起来上面解决原始帖子的注释对服务器有用(客户端证书添加到服务器trust_store)。欢呼。

Eclipse项目设置:

MyClientProject src 测验 JRE系统库 .．. trust_store ——cacerts.jks ——keystore.jks

MyClientProject.java文件片段:

static {
  // Setup the trustStore location and password
  System.setProperty("javax.net.ssl.trustStore","trust_store/cacerts.jks");
  // comment out below line
  System.setProperty("javax.net.ssl.trustStore","trust_store/keystore.jks");
  System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
  //System.setProperty("javax.net.debug", "all");

  // for localhost testing only
  javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(new javax.net.ssl.HostnameVerifier() {
        public boolean verify(String hostname, javax.net.ssl.SSLSession sslSession) {
          return hostname.equals("localhost");
        }

  });
}

我在试图从我的应用程序访问https url时遇到了这个错误，该应用程序正在使用自签名证书。 他们提供的是一个.cert文件，我不知道该把它放在哪里。我是这样解决的:

keytool的位置在JDK/bin文件夹下

方法1:将证书添加到默认的Java信任库- cacerts:

keytool -import -alias myCert -file C://certificate.cert -keystore C://Program Files//Java//jdk1.8.0_271//jre//lib//security//cacerts

密码:changeit

方法2:

创建信任存储:

keytool -import -alias myCert -file C://certificate.cert -keystore myTrustStore

它会给你以下提示，可以填充为:

Enter keystore password:changeit
Re-enter new password:changeit
Trust this certificate?yes

这将在运行此命令的文件夹中创建一个myTrustStore文件。 将这个“mytrustStore”复制到一个方便的位置。

使用信任存储:

当你运行你的应用程序/服务器时，传递这些JVM参数:

-Djavax.net.ssl.trustStore=C://myTrustStore -Djavax.net.ssl.trustStorePassword=changeit

我的问题是通过软件更新在我的工作笔记本电脑上安装了一个云访问安全代理NetSkope。这正在改变证书链，在将整个链导入到cacerts密钥存储库后，我仍然无法通过java客户端连接到服务器。我禁用了NetSkope，并且能够成功连接。