我在ActiveMQ配置中有这个:
<sslContext>
<sslContext keyStore="file:/home/alex/work/amq/broker.ks"
keyStorePassword="password" trustStore="file:${activemq.base}/conf/broker.ts"
trustStorePassword="password"/>
</sslContext>
我有一对X.509证书和一个密钥文件。
我如何导入这两个，以便在SSL和SSL+stomp连接器中使用它们?所有的例子，我总能自己生成键，但我已经有一个键了。
我试过了
keytool -import -keystore ./broker.ks -file mycert.crt
但这只导入证书，而不导入密钥文件，并导致
2009-05-25 13:16:24,270 [localhost:61612] ERROR TransportConnector - Could not accept connection : No available certificate or key corresponds to the SSL cipher suites which are enabled.
我已经尝试连接证书和密钥，但得到相同的结果。
如何导入密钥?
如果你有一个PEM文件(例如server.pem)包含:
受信任证书
私钥
然后您可以像这样将证书和密钥导入JKS密钥存储库:
1)将PEM文件中的私钥复制到ascii文件中(例如server.key)
2)将PEM文件中的cert复制到ascii文件中(例如server.crt)
3)将证书和密钥导出到PKCS12文件中:
$ openssl pkcs12 -export -in server.crt -inkey server.key \
-out server.p12 -name [some-alias] -CAfile server.pem -caname root
PEM文件可以作为-CAfile选项的参数。
提示输入“导出”密码。
如果在git bash中执行此操作，则在命令的开头添加winpty，以便可以输入导出密码。
4)将PKCS12文件转换为JKS密钥存储库:
$ keytool -importkeystore -deststorepass changeit -destkeypass changeit \
-destkeystore keystore.jks -srckeystore server.p12 -srcstoretype PKCS12 \
-srcstorepass changeit
srcstorepass密码应该与步骤3中的导出密码匹配。
还有一点:
#!/bin/bash
# We have:
#
# 1) $KEY : Secret key in PEM format ("-----BEGIN RSA PRIVATE KEY-----")
# 2) $LEAFCERT : Certificate for secret key obtained from some
# certification outfit, also in PEM format ("-----BEGIN CERTIFICATE-----")
# 3) $CHAINCERT : Intermediate certificate linking $LEAFCERT to a trusted
# Self-Signed Root CA Certificate
#
# We want to create a fresh Java "keystore" $TARGET_KEYSTORE with the
# password $TARGET_STOREPW, to be used by Tomcat for HTTPS Connector.
#
# The keystore must contain: $KEY, $LEAFCERT, $CHAINCERT
# The Self-Signed Root CA Certificate is obtained by Tomcat from the
# JDK's truststore in /etc/pki/java/cacerts
# The non-APR HTTPS connector (APR uses OpenSSL-like configuration, much
# easier than this) in server.xml looks like this
# (See: https://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html):
#
# <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
# SSLEnabled="true"
# maxThreads="150" scheme="https" secure="true"
# clientAuth="false" sslProtocol="TLS"
# keystoreFile="/etc/tomcat6/etl-web.keystore.jks"
# keystorePass="changeit" />
#
# Let's roll:
TARGET_KEYSTORE=/etc/tomcat6/foo-server.keystore.jks
TARGET_STOREPW=changeit
TLS=/etc/pki/tls
KEY=$TLS/private/httpd/foo-server.example.com.key
LEAFCERT=$TLS/certs/httpd/foo-server.example.com.pem
CHAINCERT=$TLS/certs/httpd/chain.cert.pem
# ----
# Create PKCS#12 file to import using keytool later
# ----
# From https://www.sslshopper.com/ssl-converter.html:
# The PKCS#12 or PFX format is a binary format for storing the server certificate,
# any intermediate certificates, and the private key in one encryptable file. PFX
# files usually have extensions such as .pfx and .p12. PFX files are typically used
# on Windows machines to import and export certificates and private keys.
TMPPW=$$ # Some random password
PKCS12FILE=`mktemp`
if [[ $? != 0 ]]; then
echo "Creation of temporary PKCS12 file failed -- exiting" >&2; exit 1
fi
TRANSITFILE=`mktemp`
if [[ $? != 0 ]]; then
echo "Creation of temporary transit file failed -- exiting" >&2; exit 1
fi
cat "$KEY" "$LEAFCERT" > "$TRANSITFILE"
openssl pkcs12 -export -passout "pass:$TMPPW" -in "$TRANSITFILE" -name etl-web > "$PKCS12FILE"
/bin/rm "$TRANSITFILE"
# Print out result for fun! Bug in doc (I think): "-pass " arg does not work, need "-passin"
openssl pkcs12 -passin "pass:$TMPPW" -passout "pass:$TMPPW" -in "$PKCS12FILE" -info
# ----
# Import contents of PKCS12FILE into a Java keystore. WTF, Sun, what were you thinking?
# ----
if [[ -f "$TARGET_KEYSTORE" ]]; then
/bin/rm "$TARGET_KEYSTORE"
fi
keytool -importkeystore \
-deststorepass "$TARGET_STOREPW" \
-destkeypass "$TARGET_STOREPW" \
-destkeystore "$TARGET_KEYSTORE" \
-srckeystore "$PKCS12FILE" \
-srcstoretype PKCS12 \
-srcstorepass "$TMPPW" \
-alias foo-the-server
/bin/rm "$PKCS12FILE"
# ----
# Import the chain certificate. This works empirically, it is not at all clear from the doc whether this is correct
# ----
echo "Importing chain"
TT=-trustcacerts
keytool -import $TT -storepass "$TARGET_STOREPW" -file "$CHAINCERT" -keystore "$TARGET_KEYSTORE" -alias chain
# ----
# Print contents
# ----
echo "Listing result"
keytool -list -storepass "$TARGET_STOREPW" -keystore "$TARGET_KEYSTORE"
使用Let's Encrypt证书
假设您已经在/etc/letsencrypt/live/you.com中使用Let's Encrypt创建了您的证书和私钥:
1. 创建一个PKCS #12文件
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out pkcs.p12 \
-name letsencrypt
这将结合您的SSL证书全链。Pem和您的私钥privkey。Pem到一个文件，pkcs.p12。
系统将提示您输入pkcs.p12的密码。
导出选项指定将创建PKCS #12文件，而不是解析(根据手册)。
2. 创建Java密钥库
keytool -importkeystore -destkeystore keystore.jks -srckeystore pkcs.p12 \
-srcstoretype PKCS12 -alias letsencrypt
如果密钥存储库。JKS不存在，它将包含pkcs被创建。12文件创建上面。否则，您将导入pkcs。12到现有的密钥存储库中。
这些说明来自本博客上的文章“从Let’s Encrypt Certificates创建Java密钥存储库(. jks)”。
这里有更多关于/etc/letsencrypt/live/ u.com/中不同类型文件的信息。
根据上面的答案，下面是如何为你的基于java的web服务器创建一个全新的密钥存储库，使用keytool独立创建一个Comodo证书和私钥(需要JDK 1.6+)
Issue this command and at the password prompt enter somepass - 'server.crt' is your server's cert and 'server.key' is the private key you used for issuing the CSR:
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name www.yourdomain.com -CAfile AddTrustExternalCARoot.crt -caname "AddTrust External CA Root"
Then use keytool to convert the p12 keystore into a jks keystore:
keytool -importkeystore -deststorepass somepass -destkeypass somepass -destkeystore keystore.jks -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass somepass
然后导入你从Comodo收到的另外两个根/中间证书:
进口COMODORSAAddTrustCA.crt:
keytool -import -trustcacerts -alias cert1 -file COMODORSAAddTrustCA. exeCRT -keystore keystore.jks
进口COMODORSADomainValidationSecureServerCA.crt:
keytool -import -trustcacerts -alias cert2 -file COMODORSADomainValidationSecureServerCA. txtCRT -keystore keystore.jks
