将证书链添加到p12（pfx）证书
我在java和cxf中有应用程序，它使用客户端证书连接到WebServices。
我从WebService所有者那里获得了证书
- certificate.p12
- certificate.pem
- certificate.crt
- trusted_ca.cer
- root_ca.cer
我有问题，直接将此p12证书转换为java要求的工作jks密钥库。
我这样做了：
keytool -importkeystore -srckeystore certificate.p12 -srcstoretype PKCS12 -destkeystore certificate1.jks -deststoretype JKS -storepass secret keytool -import -alias root -file root_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret keytool -import -alias trusted -file trusted_ca.cer -trustcacerts -keystore certificate1.jks -storepass secret 但这个jks不起作用，我在使用这个certificate1.jks时得到HTTP响应’403：Forbidden’
但是，如果我将此p12（pfx）证书导入Internet Explorer，然后将此证书从IE导出为pfx格式，选择“在证书路径中包含所有证书”复选框并使用：
keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore certificate2.jks -deststoretype JKS -storepass secret keytool -import -alias root -file root_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret keytool -import -alias trusted -file trusted_ca_kir.cer -trustcacerts -keystore certificate2.jks -storepass secret
然后一切正常，我可以使用certificate2.jks连接到WebService。
我发现原始certificate.p12（pfx）只包含一个条目（证书链长度：1）：
keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v ******************************************* ******************************************* Alias name: alias Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=MyCompany, EMAILADDRESS=my.email@domain.com, O=bla, C=PL Issuer: CN=Trusted CA, O=ble, C=PL Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Valid from: ... until: ... Certificate fingerprints: MD5: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Signature algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: XXXX.XX Criticality=false KeyUsage [ DigitalSignature Key_Encipherment ] ... ******************************************* *******************************************
而从IE导出的“包含证书路径中的所有证书”的certificate.pfx包含带有第二个可信CA证书的证书链（证书链长度：2）：
keytool -list -keystore certificate.p12 -storepass secret -storetype PKCS12 -v ******************************************* ******************************************* Alias name: alias Entry type: PrivateKeyEntry Certificate chain length: 2 Certificate[1]: Owner: CN=MyCompany, EMAILADDRESS=my.email@domain.com, O=bla, C=PL Issuer: CN=Trusted CA, O=ble, C=PL Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Valid from: ... until: ... Certificate fingerprints: MD5: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Signature algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: XXXX.XX Criticality=false KeyUsage [ DigitalSignature Key_Encipherment ] ... Certificate[2]: Owner: CN=Trusted CA, O=ble ble ble, C=PL Issuer: CN=ROOT CA, O=ble ble ble, C=PL Serial number: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Valid from: ... until: ... Certificate fingerprints: MD5: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX SHA1: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX Signature algorithm name: SHA1withRSA Version: 3 Extensions: ******************************************* *******************************************
因此，为了解决我的问题，我需要将p12证书与链接到可信CA证书。 我可以通过将p12导入IE然后导出回“使用证书路径中的所有证书”来完成此操作。
如果没有IE使用keytool或其他工具，我怎么能这样做？
巴里
自己的答案。
我想出了如何使用OpenSSL执行此操作：
openssl pkcs12 -in certificate.p12 -out clientcert.pem -nodes -clcerts openssl x509 -in trusted_ca.cer -inform DER -out trusted_ca.pem openssl x509 -in root_ca.cer -inform DER -out root_ca.pem cat clientcert.pem trusted_ca.pem root_ca.pem >> clientcertchain.pem openssl pkcs12 -export -in clientcertchain.pem -out clientcertchain.pfx