我在activemq配置中有这个
<sslContext>
<sslContext keyStore="file:/home/alex/work/amq/broker.ks"
keyStorePassword="password" trustStore="file:${activemq.base}/conf/broker.ts"
trustStorePassword="password"/>
</sslContext>
我有一对x509证书和一个密钥文件
如何导入这两个用于ssl和ssl + stomp连接器？我可以谷歌的所有例子总是自己生成密钥,但我已经有了密钥.
我试过了
keytool -import -keystore ./broker.ks -file mycert.crt
但这只导入证书而不是密钥文件并导致结果
__CODE__
我尝试连接证书和密钥但得到了相同的结果
如何导入密钥？
UPDATE 1/26/2015 -- It appears the most recent JRE/JDK for Java 8 (update >= 31) and JRE/JDK for Java 7 now include the Godaddy G2 CA server in the default trust store. If possible, it's urged you upgrade your JRE/JDK to the latest Java 8 update to resolve this issue.
更新2014年11月29日 - 这仍然是一个问题,Godaddy似乎不关心也不会做任何事情.几个月前,Godaddy安全产品副总裁在这里发布了一篇博客文章,说它正在修复它并提供了一个临时的解决方案,但到目前为止没有任何改变.值得注意的是Godaddy的G2 CA服务器已经存在了至少5年,并且在那段时间Godaddy没有采取适当的步骤来解决这个已知问题.所提供的解决方案就是解决方案,而不是解决方案.第三方服务的用户无法控制服务器上的证书安装方式.
It seems users should avoid purchasing Godaddy SSL certs until they get serious about being a CA.
如果您愿意致电以下是他们的SSL团队的联系信息:
GoDaddy SSL Team Support Number: 1-480-505-8852 …
想知道是否有人可以告诉我在哪里搞砸了!我有一个keytool创建的密钥库,来自Thawte的主要,次要和ssl证书.我最初使用openssl创建了CSR,然后使用记录的过程将私钥转换为PKCS12以导入到密钥库中.
我相信我已将它们全部导入密钥库ok(但显然不是!)但是我从Tomcat获得的错误是:'java.io.IOException别名不能识别密钥条目
如果我这样做,keytool -list -keystore keystore.ks这就是我得到的:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 4 entries
secondary, Jun 22, 2012, trustedCertEntry,
Certificate fingerprint (MD5): EB:A3:71:66:38:5E:3E:F4:24:64:ED:97:52:E9:9F:1B
tomcat, Jun 22, 2012, trustedCertEntry,
Certificate fingerprint (MD5): EA:D0:43:F8:7F:D5:1C:4A:BA:A7:F4:64:A9:6A:A1:B0
primary, Jun 22, 2012, trustedCertEntry,
Certificate fingerprint (MD5): D6:6A:92:1C:83:BF:A2:AE:6F:99:5B:44:E7:C2:AB:2A
1, Jul 2, 2012, PrivateKeyEntry,
Certificate fingerprint (MD5): EA:D0:43:F8:7F:D5:1C:4A:BA:A7:F4:64:A9:6A:A1:B0
我很确定我的Tomcat server.xml是可以的,但这里也适用于https连接器:
<Connector port="443"
protocol="org.apache.coyote.http11.Http11Protocol"
maxHttpHeaderSize="8192"
SSLEnabled="true"
maxThreads="150"
minSpareThreads="25"
maxSpareThreads="75"
enableLookups="false"
disableUploadTimeout="true"
acceptCount="100"
scheme="https"
secure="true"
clientAuth="false"
sslProtocol="TLS"
URIEncoding="UTF-8"
keystorePass="xxxxxx"
keystoreFile="/keys/keystore.ks"
keyAlias="tomcat"/>
有任何想法吗？这是我第一次这样做,所以也许我搞砸了一些非常明显的东西？
该站点在端口80上正常工作.
很想听到一些建议:)
我在Tomcat服务器上安装SSL,并遵循发行人https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&actp=CROSSLINK&id=SO16181的这些说明,并声明:
Verify the following information:
The SSL certificate is imported into the alias with the "Entry Type" of
PrivateKeyEntry or KeyEntry. If not, please import the certificate into
the Private Key alias.
当我导入证书(tomcat)时我正在使用:
keytool -import -trustcacerts -alias your_alias_name -keystore your_keystore_filename
-file your_certificate_filename
但是当我这样做时它导入为trustCertEntry
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 3 entries
primaryca, Jul 26, 2014, trustedCertEntry,
Certificate fingerprint (SHA1): <snip>
tomcat, Jul 26, 2014, trustedCertEntry,
Certificate fingerprint (SHA1): <snip>
secondaryca, Jul 26, 2014, trustedCertEntry,
Certificate …我正在通过HTTPS连接到Web服务.我已经完成了我认为使其工作所需的所有内容,但最终我得到了握手失败.
我发现作为一个新用户,我不能发布超过2个链接,因为"垃圾邮件保护" - 比很多堆栈溢出...无论如何这里是一个链接到一个所有链接拼写的pastebin帖子...所以当我在这里写了"链接#1",它是对这些链接的引用:http://pastebin.com/y4zGNRC7
另一个奇怪的事情是,当我设置密钥库时我似乎得到了相同的行为,而当我没有设置密钥库时(唯一的区别是当我在控制台中打印密钥库内容时,但就是这样).
我试过谷歌搜索问题,我在stackoverflow上看到了很多类似的帖子,但没有任何帮助.我尝试更改协议版本("TLSv1","SSLv3",甚至是奇怪的v2 Hello).任何帮助将不胜感激 - 也许我可能忽略了一些基本的东西...我在这里绝望... Thanx
PS我在Fedora Core 15(64位)上运行java 1.6 update 30
团队在尝试使用HTTPS完成相互握手时遇到以下问题
main, READ: TLSv1.2 Handshake, length = 30
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA1withRSA, SHA1withDSA, SHA1withECDSA, SHA256withRSA, Unknown (hash:0x4, signature:0x2), SHA256withECDSA, SHA384withRSA, Unknown (hash:0x5, signature:0x2), SHA384withECDSA
Cert Authorities:
<Empty>
main, READ: TLSv1.2 Handshake, length = 4
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
我的JAVA课程如下
public class ClientCustomSSL {
@SuppressWarnings("deprecation")
public final static void main(String[] args) throws Exception {
// Trust own CA and all self-signed certs …在Windows 7上运行的Java 1.7应用程序中,我正在尝试使用服务器进行双向SSL(智能卡令牌通过openSC提供我的客户端证书).服务器的证书正在由客户端验证,但客户端不响应服务器的证书请求.我相信这是因为客户端无法从我的证书链接到服务器请求的链(即使存在这样的链).
这是服务器证书请求的SSL调试和客户端空响应:
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Cert Authorities:
<CN=c4isuite-SDNI-DC02-CA, DC=c4isuite, DC=local>
<CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US>
...
*** ServerHelloDone
*** Certificate chain
***
我的客户证书如下:
found key for : Certificate for PIV Authentication
chain [0] = [
[
Version: V3
Subject: CN=<...>, OU=CONTRACTOR, OU=PKI, OU=DoD, O=U.S. Government, C=US
Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
Key: Sun RSA public key, 2048 bits
Issuer: CN=DOD CA-30, OU=PKI, OU=DoD, O=U.S. Government, C=US
SerialNumber: [ 05bf13] …我在http://www.globalsign.com/support/install/install_tomcat.php上执行了以下步骤,使用以下条目server.xml:
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
keystoreFile="D:\Tomcat\ukdp.keystore" keystorePass="123456" keyAlias="ukdp"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
但是在启动期间发生以下异常:
SEVERE: Error initializing endpoint
java.io.IOException: Alias name ukdp does not identify a key entry
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:412)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:378)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:125)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:496)
at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:177)
at org.apache.catalina.connector.Connector.initialize(Connector.java:1059)
at org.apache.catalina.core.StandardService.initialize(StandardService.java:677)
at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:792)
at org.apache.catalina.startup.Catalina.load(Catalina.java:518)
at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:260)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:412)
Mar 14, 2011 4:14:56 PM org.apache.catalina.startup.Catalina load
当我删除keyAlias条目如下:
<Connector …关于SSLServerSocket.setWantClientAuth:
如果设置为true如果客户端选择不发送证书,则协商继续.
此外,我注意到如果客户端发送证书但不是信任库的一部分,也会发生这种情况.在这种情况下,协商也不会失败.
那么这个设置的用例是什么？
My Dev OPs team would like to make use of an Intermediate CA certificate in our Java keystore. I believe adding an intermediate certificate into the keystore is the same process as as adding a "regular cert", correct? Are there any "gotchas" I need to be aware of? Also, how do I verify in testing that Java is using the intermediate cert as opposed to checking back with the CA?