无法加载包含的JKS密钥库

Question

我正在尝试加载包含从现有Web服务器获取的中间CA证书的JKS密钥库.

Verisign证书如下所示.

-----BEGIN CERTIFICATE-----
MIIF5DCCBMygAwIBAgIQW3dZxheE4V7HJ8AylSkoazANBgkqhkiG9w0BAQUFADCB
yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp
U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW
ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMTYxMTA3MjM1OTU5WjCBujEL
MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW
ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQg
aHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwNjE0MDIGA1UEAxMrVmVy
aVNpZ24gQ2xhc3MgMyBFeHRlbmRlZCBWYWxpZGF0aW9uIFNTTCBDQTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJjboFXrnP0XeeOabhQdsVuYI4cWbod2
nLU4O7WgerQHYwkZ5iqISKnnnbYwWgiXDOyq5BZpcmIjmvt6VCiYxQwtt9citsj5
OBfH3doxRpqUFI6e7nigtyLUSVSXTeV0W5K87Gws3+fBthsaVWtmCAN/Ra+aM/EQ
wGyZSpIkMQht3QI+YXZ4eLbtfjeubPOJ4bfh3BXMt1afgKCxBX9ONxX/ty8ejwY4
P1C3aSijtWZfNhpSSENmUt+ikk/TGGC+4+peGXEFv54cbGhyJW+ze3PJbb0S/5tB
Ml706H7FC6NMZNFOvCYIZfsZl1h44TO/7Wg+sSdFb8Di7Jdp91zT91ECAwEAAaOC
AdIwggHOMB0GA1UdDgQWBBT8ilC6nrklWntVhU+VAGOP6VhrQzASBgNVHRMBAf8E
CDAGAQH/AgEAMD0GA1UdIAQ2MDQwMgYEVR0gADAqMCgGCCsGAQUFBwIBFhxodHRw
czovL3d3dy52ZXJpc2lnbi5jb20vY3BzMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6
Ly9FVlNlY3VyZS1jcmwudmVyaXNpZ24uY29tL3BjYTMtZzUuY3JsMA4GA1UdDwEB
/wQEAwIBBjARBglghkgBhvhCAQEEBAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZ
MFcwVRYJaW1hZ2UvZ2lmMCEwHzAHBgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7
GS4wJRYjaHR0cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nby5naWYwKQYDVR0R
BCIwIKQeMBwxGjAYBgNVBAMTEUNsYXNzM0NBMjA0OC0xLTQ3MD0GCCsGAQUFBwEB
BDEwLzAtBggrBgEFBQcwAYYhaHR0cDovL0VWU2VjdXJlLW9jc3AudmVyaXNpZ24u
Y29tMB8GA1UdIwQYMBaAFH/TZafC3ey78DAJ80M5+gKvMzEzMA0GCSqGSIb3DQEB
BQUAA4IBAQCWovp/5j3t1CvOtxU/wHIDX4u6FpAl98KD2Md1NGNoElMMU4l7yVYJ
p8M2RE4O0GJis4b66KGbNGeNUyIXPv2s7mcuQ+JdfzOE8qJwwG6Cl8A0/SXGI3/t
5rDFV0OEst4t8dD2SB8UcVeyrDHhlyQjyRNddOVG7wl8nuGZMQoIeRuPcZ8XZsg4
z+6Ml7YGuXNG5NOUweVgtSV1LdlpMezNlsOjdv3odESsErlNv1HoudRETifLriDR
fip8tmNHnna6l9AW5wtsbfdDbzMLKTB3+p359U64drPNGLT5IO892+bKrZvQTtKH
qQ2mRHNQ3XBb7a1+Srwi1agm5MKFIA3Z
-----END CERTIFICATE-----

我已使用以下命令将证书导入JKS密钥库:

keytool -importcert -trustcacerts -alias vs -file vs.cer -keystore vs.jks -storepass changeit -storetype JKS

我已经验证了keytool可以从新创建的密钥库中读取证书详细信息.

最后,我使用以下Java代码加载密钥库:

final KeyStore trustStore = KeyStore.getInstance("JKS");   
trustStream = getClass().getClassLoader().getResourceAsStream("vs.jks"); 
trustStore.load(trustStream, "changeit".toCharArray());

目前使用的是JDK 1.7.0_51.

不幸的是,在load()方法中抛出异常.

java.security.cert.CertificateParsingException: java.io.IOException: X500 RDN
    at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:171)
    at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1788)
    at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:202)
    at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:97)
    at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:747)
    at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
    at java.security.KeyStore.load(KeyStore.java:1214)

    ...

Caused by: java.io.IOException: X500 RDN
    at sun.security.x509.RDN.<init>(RDN.java:242)
    at sun.security.x509.X500Name.parseDER(X500Name.java:804)
    at sun.security.x509.X500Name.<init>(X500Name.java:307)
    at sun.security.x509.CertificateIssuerName.<init>(CertificateIssuerName.java:82)
    at sun.security.x509.X509CertInfo.parse(X509CertInfo.java:685)
    at sun.security.x509.X509CertInfo.<init>(X509CertInfo.java:169)
    ... 37 more

我做错了吗？

我觉得证书中有一些意外的东西让解析器感到困惑.堆栈跟踪表明解析发行者名称可能存在问题.

有什么办法可以解决这个问题吗？

Answer 1

我弄明白了原因.证书文件或密钥库没有错!

我正在使用Maven编译我的项目,它自动将jks文件复制到目标构建目录.

事实证明,在复制过程中,Maven认为该文件是一个文本文件,并"帮助"将任何扩展的ASCII字符(> = 0x80)转换为'？' (0x3F的)!

在分析/列出JKS文件时,我自然只查看了我的源目录,从未想过验证资源文件的内容是否相同!

确认黄金法则,Never Trust Maven!

我通过在pom.xml中添加以下内容来解决这个问题

    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-resources-plugin</artifactId>
        <version>2.6</version>
        <configuration>
            <nonFilteredFileExtensions>                            
                <nonFilteredFileExtension>jks</nonFilteredFileExtension>
            </nonFilteredFileExtensions>
        </configuration>
    </plugin>