无法更改密钥库格式

java encryption cryptography keystore keytool

2022-09-03 15:34:41

我正在尝试使用最新的JRE（版本1.8.0_151）制作一些密钥库。当我使用此命令创建密钥库时，它会向我显示此警告：keytoolkeytool -genkey -alias serverprivate -keystore server.private -keyalg rsa -storepass apassword -keypass apassword

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate 
to  PKCS12 which is an industry standard format using "keytool 
-importkeystore -srckeystore server.private -destkeystore server.private
-deststoretype pkcs12".

所以我键入命令，它说它已完成，旧的密钥库已保存在server.private_old中。但是当我运行并键入密码时，它仍然被列为JKS而不是PKCS12。这是为什么呢？keytool -list -keystore server.private

update
它也没有默默地更改为pkcs12，因为当我在java中使用时，它会抛出错误，而使用时它可以正常工作KeyStore store = KeyStore.getInstance("pkcs12");getInstance("JKS");

更新 2
使用时，它不会向我显示警告，但在使用时仍显示为 JKS 密钥库。keytool -genkey -alias serverprivate -keystore server.private -storetype PKCS12 -keyalg rsakeytool -list server.private

答案 1

这似乎是keytool显示什么而不是它做什么的错误。考虑以下实验。

（编辑：错误报告提交)

首先，我的jdk版本是1.8.0_152：

excalibur:~ ronan$ java -version
java version "1.8.0_152"
Java(TM) SE Runtime Environment (build 1.8.0_152-b16)
Java HotSpot(TM) 64-Bit Server VM (build 25.152-b16, mixed mode)

现在，按照您指定的方式创建密钥库：

excalibur:~ ronan$ keytool -genkey -alias serverprivate -keystore server.private -keyalg rsa -storepass apassword -keypass apassword
What is your first and last name?
  [Unknown]:  Art Vandelay
What is the name of your organizational unit?
  [Unknown]:  Export/Import
What is the name of your organization?
  [Unknown]:  Vandelay Industries
What is the name of your City or Locality?
  [Unknown]:  New York
What is the name of your State or Province?
  [Unknown]:  New York
What is the two-letter country code for this unit?
  [Unknown]:  US
Is CN=Art Vandelay, OU=Export/Import, O=Vandelay Industries, L=New York, ST=New York, C=US correct?
  [no]:  yes


Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore server.private -destkeystore server.private -deststoretype pkcs12".

现在，按照给出的说明进行操作：

excalibur:~ ronan$ keytool -importkeystore -srckeystore server.private -destkeystore server.private -deststoretype pkcs12
Enter source keystore password:  
Entry for alias serverprivate successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

Warning:
Migrated "server.private" to Non JKS/JCEKS. The JKS keystore is backed up as "server.private.old".

但是当我们用keytool列出它时，它仍然说JKS。

excalibur:~ ronan$ keytool -list -keystore server.private
Enter keystore password:  
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

serverprivate, Dec 4, 2017, PrivateKeyEntry, 
Certificate fingerprint (SHA1): 16:E8:C6:12:7A:F1:7A:B8:64:98:EC:12:C4:07:9E:67:06:BD:DD:BD

但是，openssl可以将其解析为pkcs12就好了。

excalibur:~ ronan$ openssl pkcs12 -in server.private
Enter Import Password:
MAC verified OK
Bag Attributes
    friendlyName: serverprivate
    localKeyID: 54 69 6D 65 20 31 35 31 32 34 31 33 32 30 38 31 38 32 
Key Attributes: <No Attributes>
Enter PEM pass phrase:
Bag Attributes
    friendlyName: serverprivate
    localKeyID: 54 69 6D 65 20 31 35 31 32 34 31 33 32 30 38 31 38 32 
subject=/C=US/ST=New York/L=New York/O=Vandelay Industries/OU=Export/Import/CN=Art Vandelay
issuer=/C=US/ST=New York/L=New York/O=Vandelay Industries/OU=Export/Import/CN=Art Vandelay
-----BEGIN CERTIFICATE-----
MIIDoTCCAomgAwIBAgIEKSoRITANBgkqhkiG9w0BAQsFADCBgDELMAkGA1UEBhMC
VVMxETAPBgNVBAgTCE5ldyBZb3JrMREwDwYDVQQHEwhOZXcgWW9yazEcMBoGA1UE
ChMTVmFuZGVsYXkgSW5kdXN0cmllczEWMBQGA1UECxMNRXhwb3J0L0ltcG9ydDEV
MBMGA1UEAxMMQXJ0IFZhbmRlbGF5MB4XDTE3MTIwNDE4NDM1NVoXDTE4MDMwNDE4
NDM1NVowgYAxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhOZXcgWW9yazERMA8GA1UE
BxMITmV3IFlvcmsxHDAaBgNVBAoTE1ZhbmRlbGF5IEluZHVzdHJpZXMxFjAUBgNV
BAsTDUV4cG9ydC9JbXBvcnQxFTATBgNVBAMTDEFydCBWYW5kZWxheTCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAIwVIy24Hws6ffaEQGhYEyaw2JC4UPLH
wtSXpJaZf3lrdtbktbLC+zKJ93fFVfoukX5vpnZKxv+f724duAszkVWN3bBrnAwb
6sh445tXiRhT2eS+z0rHtXwiPWUKOAPOxGUP1Lhfl5ZCPR4bmohyh/daSX1ppT3P
k6//lf1y2RdsS5hZ5Ltx9dr99/txsv4a1D8uuPDHIf8dvWfOqGb7ywIAlrbh5JsA
4IWjMVFMpDQ2WM/C+v48y2W7AdgxGD0J/nNC6t4QfAgwhvVyXbiu9IbAR+ivn59E
VqC83qv4bBkffB3yYk6WSHSl7YloJueWalVAoudf4uHeaNZBLCvbNsMCAwEAAaMh
MB8wHQYDVR0OBBYEFNOc6gJkUFCSgyHCDFGJmZwtPLgIMA0GCSqGSIb3DQEBCwUA
A4IBAQAVyc6j9U+va5U02MxsjDE6LWDPg+0FaqpTAQlU6xhVrZlKWuX+Dup4PF6S
s4oqhInb7XcGOjbLkVTnuEY5mwfHnyGqNhmyyUwJOVrWZJWBZADvhdcZi0w/jclg
jAb7dP1VssR4Ozgsd1XkGxnS7P8e344xpjQd1krPc1Od7qhFSF6FufTDvgEcrmx/
qrHpLpwoYPTyuv+NtD+7KlWINqWq5PT1olydd6ki8O+bTsgDuy8rnvqd/jJ7dsuv
VLNc+IDEEMO26hS8d1WkppTTuLrayE07LCV8df68WHv6KumDSc5Mb0zOUdLqZUDQ
Wmxbt0kEAAG6jgbpACBpGEqtAtTs
-----END CERTIFICATE-----

下面的Java代码片段也可以解析它。

import java.io.FileInputStream;
import java.security.KeyStore;
import java.util.Collections;

public class Main {
    public static void main(String[] args) throws Exception {
        KeyStore pkcs12 = KeyStore.getInstance("PKCS12");
        pkcs12.load(new FileInputStream("../../../server.private"), "apassword".toCharArray());
        for (String alias : Collections.list(pkcs12.aliases())) {
            System.out.println(alias);
        }
    }
}

并且输出为

服务器私有

答案 2

上述问题已解决，请按照此链接进行步骤操作

https://docs.flutter.dev/deployment/android#create-an-upload-keystore

它包含更新的步骤...

运行后

keytool -genkey -v -keystore c:\Users\USER_NAME\upload-keystore.jks -storetype JKS -keyalg RSA -keysize 2048 -validity 10000 -alias upload

我收到此命令作为警告消息的一部分。

keytool -importkeystore -srckeystore c:\Users\USER_NAME\upload-keystore.jks -destkeystore c:\Users\USER_NAME\upload-keystore.jks -deststoretype pkcs12

这是运行上述命令后的以下输出。

Enter source keystore password:
Entry for alias upload successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled

Warning:
Migrated "c:\Users\USER_NAME\upload-keystore.jks" to PKCS12. The JKS keystore is backed up as "c:\Users\USER_NAME\upload-keystore.jks.old".