从 PKCS12 创建私钥对象

Question

I created private key from PKCS12 file with this command:

openssl pkcs12 -in test.p12 -nocerts -out privateKey.pem

How can I create PrivateKey Object from this privateKey.pem file now?

I tried using PKCS12 file itself with this code:

 KeyStore pfx = KeyStore.getInstance("pkcs12");
 pfx.load(new FileInputStream(P12), "123456".toCharArray());
 final Enumeration<String> aliases = pfx.aliases(); //this is empty

pfx.aliases() - was empty, I verified using keytool that it is really empty, no entries.

keytool -v -list -storetype pkcs12 -keystore test.p12

Keystore type: PKCS12
Keystore provider: SunJSSE

Your keystore contains 0 entries

My question is how can I create PrivateKey using code like this:

 public static RSAPrivateKey getPrivateKey(File privateKeyFile) throws IOException {
        byte[] keyBytes = new byte[(int) privateKeyFile.length()];
        FileInputStream fis = new FileInputStream(privateKeyFile);
        fis.read(keyBytes);
        PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);// it works only with PKCS8
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        RSAPrivateKey privKey = (RSAPrivateKey) keyFactory.generatePrivate(spec);
        return privKey;
    }

The problem with this code it only works for PKCS8, I need something like this for PKCS12.

Answer 1

The only way I know is a bit low-level, but it works:

public PrivateKey getPrivateKey(File file) throws IOException, GeneralSecurityException {
    try (FileInputStream fileStream = new FileInputStream(file);
         DataInputStream dataStream = new DataInputStream(fileStream)) {
        byte[] keyBytes = new byte[(int) file.length()];
        dataStream.readFully(keyBytes);
        String temp = new String(keyBytes);
        String header = temp.replace("-----BEGIN PRIVATE KEY-----\n", "");
        header = header.replace("-----END PRIVATE KEY-----", "");
        byte[] decoded = new Base64().decode(header);
        PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(decoded);
        KeyFactory kf = KeyFactory.getInstance("RSA");
        return kf.generatePrivate(spec);
    }
}

This code assumes, that required key is a RSA key.

Answer 2

您可以尝试使用 KeyStore Explorer ( https://keystore-explorer.org/ )，我们使用它来代替 Java Keytool（因为我觉得它很难使用）。

Answer 3

Maybe this will help someone.

Here is how you can generate a private key from your pkcs12 certificate file.

public PrivateKey getPrivateKey(String pathToPKCS12File) {
    try {
        InputStream stream = new FileInputStream(new File(pathToPKCS12File));
        KeyStore ks = KeyStore.getInstance("PKCS12");
        ks.load(stream, "123456".toCharArray());
        return (PrivateKey) ks.getKey(
            ks.aliases.nextElement(),
            "123456".toCharArray()
        );
    } catch (Exception e) {
        //error
    }
}