引起:java.security.UnrecoverableKeyException:无法恢复密钥

Question

我提供了一个名为ABCC_client.store的jks密钥库.当我将此密钥库导入cacerts并尝试连接时,说没有这样的算法错误.PFA堆栈跟踪

    Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class:   com.sun.net.ssl.internal.ssl.DefaultSSLContextImpl)
    at java.security.Provider$Service.newInstance(Provider.java:1245)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:220)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:147)
    at javax.net.ssl.SSLContext.getInstance(SSLContext.java:125)
    at javax.net.ssl.SSLContext.getDefault(SSLContext.java:68)
    at javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:102)
    at org.apache.axis.components.net.JSSESocketFactory.initFactory(JSSESocketFactory.java:61)
    at org.apache.axis.components.net.JSSESocketFactory.create(JSSESocketFactory.java:79)
    ... 32 more
Caused by: java.security.UnrecoverableKeyException: Cannot recover key
    at sun.security.provider.KeyProtector.recover(KeyProtector.java:311)
    at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:121)
    at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:38)
    at java.security.KeyStore.getKey(KeyStore.java:763)
    at com.sun.net.ssl.internal.ssl.SunX509KeyManagerImpl.<init>(SunX509KeyManagerImpl.java:113)
    at com.sun.net.ssl.internal.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:48)
    at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:239)
    at com.sun.net.ssl.internal.ssl.DefaultSSLContextImpl.getDefaultKeyManager(DefaultSSLContextImpl.java:170)
    at com.sun.net.ssl.internal.ssl.DefaultSSLContextImpl.<init>(DefaultSSLContextImpl.java:40)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
    at java.lang.Class.newInstance0(Class.java:355)
    at java.lang.Class.newInstance(Class.java:308)
    at java.security.Provider$Service.newInstance(Provider.java:1221)
    ... 39 more

但是,如果我独立使用这个密钥库,即不将它添加到cacerts,它就可以工作.

一些谷歌搜索引导我到http://joewlarson.com/blog/2009/03/25/java-ssl-use-the-same-password-for-keystore-and-key/这说明密码可能与我有所不同密钥和密钥库.

Answer 1

如果使用Tomcat 6及更早版本,请确保密钥库密码和密钥密码相同.如果使用Tomcat 7及更高版本,请确保它们相同或在server.xml文件中指定密钥密码.

Answer 2

您的app/config中定义的私钥密码不正确.首先尝试通过更改为另一个密码来验证私钥密码,如下所示:

keytool -keypasswd -new changeit -keystore cacerts -storepass changeit -alias someapp -keypass password

上面的示例将密码从password更改为changeit.如果私钥密码是密码,则此命令将成功.

Answer 3

为了没有Cannot recover key例外,我不得不将Java Cryptography Extension(JCE)Unlimited Strength Jurisdiction Policy Files应用于运行我的应用程序的Java的安装.这些文件的版本8可在此处找到,或者此页面上应列出最新版本.下载包含一个文件,说明如何应用策略文件.

从JDK 8u151开始,没有必要添加策略文件.相反,JCE管辖区域策略文件由名为的Security属性控制crypto.policy.将其设置为unlimited允许JDK使用无限加密.作为与上述状态相关联的发行说明,可以Security.setProperty()通过java.security文件或通过文件进行设置.该java.security文件还可以通过添加附加-Djava.security.properties=my_security.properties到命令详见启动程序在这里.

由于默认情况下启用了JDK 8u161无限加密.

Answer 4

通过运行以下命令检查您使用的密码是否正确

keytool -keypasswd -new temp123 -keystore awsdemo-keystore.jks -storepass temp123 -alias movie-service -keypass changeit

如果您收到以下错误，则说明您的密码错误

keytool error: java.security.UnrecoverableKeyException: Cannot recover key

Answer 5

当我们将密钥导入使用64位OpenSSL版本构建的密钥库时,我遇到了同样的错误.当我们按照相同的过程将密钥导入到使用32位OpenSSL版本构建的密钥库时,一切都很顺利.