堆栈内存溢出
  简体   繁体   English

在JKS中找不到私钥的详细信息

[英]Unable to find details of private key in JKS

 原文  2017-07-31 21:58:11  2   1    ssl/ ssl-certificate/ weblogic12c/ private-key/ keytool

问题描述

I generated a JKS using this command: 我使用以下命令生成了JKS： 

keytool -genkey -alias $1 -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -dname "CN=$3,OU=$4,O=$5,L=$6,S=$7,C=$8" -keypass $9 -keystore keystore.jks -storepass ${10} -validity 375

$1 to $10 all being variables stored in a file. $ 1到$ 10都是存储在文件中的变量。

I then generated a CSR using this command. 然后，我使用此命令生成了CSR。 

keytool -certreq -alias mydomain -keystore keystore.jks -file mydomain.csr

I then applied for Digi sign CA cert. 然后，我申请了Digi sign CA证书。 I received the below 4 certs which i imported in my JKS. 我收到了我在JKS中导入的以下4种证书。

Alias, Filename and details below: 别名，文件名和以下详细信息：

  1. root AddTrustExternalCARoot.crt Owner: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE root AddTrustExternalCARoot.crt所有者：CN = AddTrust外部CA Root，OU = AddTrust外部TTP网络，O = AddTrust AB，C = SE颁发者：CN = AddTrust外部CA Root，OU = AddTrust外部TTP网络，O = AddTrust AB，C = SE

  2. inter USERTrustRSAAddTrustCA.crt Owner: CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE 内部USERTrustRSAAddTrustCA.crt所有者：CN = USERTrust RSA证书颁发机构，O = USERTRUST网络，L =泽西市，ST =新泽西州，C =美国发行人：CN = AddTrust外部CA根，OU = AddTrust外部TTP网络，O = AddTrust AB，C = SE

  3. inter_second DigiSignCADigiSSL.crt Owner: CN=Digi-Sign CA Digi-SSL, O=Digi-Sign Limited, L=Dublin, ST=County Dublin, C=IE Issuer: CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US inter_second DigiSignCADigiSSL.crt所有者：CN = Digi-Sign CA Digi-SSL，O = Digi-Sign Limited，L =都柏林，ST =都柏林郡，C = IE发行者：CN = USERTrust RSA证书颁发机构，O = USERTRUST网络， L =泽西城，ST =新泽西，C =美国

  4. mydomain mydomain_com.crt Owner: CN=mymac1.com, OU=Digi-SSL Xp, OU=Provided by Digi-Sign Limited, OU=Batel Affinity, O=Batel & Moss Group, L=Texas, ST=NJ, C=US Issuer: CN=Digi-Sign CA Digi-SSL, O=Digi-Sign Limited, L=Dublin, ST=County Dublin, C=IE mydomain mydomain_com.crt所有者：CN = mymac1.com，OU = Digi-SSL Xp，OU =由Digi-Sign Limited提供，OU = Batel Affinity，O = Batel＆Moss Group，L = Texas，ST = NJ，C =美国发行人：CN = Digi-Sign CA Digi-SSL，O = Digi-Sign Limited，L =都柏林，ST =都柏林郡，C = IE

Imported them in JKS using the below command: 使用以下命令将它们导入到JKS中： 

keytool -import -v -alias "root" -file AddTrustExternalCARoot.crt -keystore keystore.jks 

keytool -import -v -alias "intermediate1" -file USERTrustRSAAddTrustCA.crt -keystore keystore.jks 

keytool -import -v -alias "intermediate2" -file DigiSignCADigiSSL.crt -keystore keystore.jks 

keytool -import -v -alias "USWL1212CONPERF01" -file mydomain_com.crt -keystore keystore.jks

When i set the JKS in weblogic i get this exception in WebLogic Server logs: 当我在weblogic中设置JKS时，我在WebLogic Server日志中得到此异常： 

####<Jul 31, 2017 11:07:14 AM CDT> <Error> <WebLogicServer> <sysa5av> <ISIS01> <[ACTIVE] ExecuteThread: '34' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1501517234413> <BEA-000297> <Inconsistent security configuration, weblogic.management.configuration.ConfigurationException: No identity key/certificate entry was found under alias mydomain in keystore /web/bea/mydomains/config/keystore.jks on server MS1.>

i tried changing my JKS to PKCS12 format so that i can see what my private key and alias is but that too failed with the below error: 我试图将我的JKS更改为PKCS12格式，以便可以看到我的私钥和别名是什么，但是也因以下错误而失败： 

keytool -v -importkeystore -srckeystore keystore.jks -srcalias certificatekey -destkeystore myp12file.p12 -deststoretype PKCS12

Problem importing entry for alias root: java.security.KeyStoreException: TrustedCertEntry not supported.

i Then tried the java program here: keytool - see the public and private keys 然后我在这里尝试了Java程序： keytool-查看公钥和私钥

But the output does not show any private keys. 但是输出不显示任何私钥。 I used the alias mydomain. 我使用别名mydomain。 Could be the alias for the privatekey is wrong as it was populated using variables as shown in the first command of this post. 私钥的别名可能是错误的，因为它是使用变量来填充的，如本文第一条命令所示。 What would be the solution in that case ? 在那种情况下，解决方案是什么？ How could i retrieve the alias and the private key for the certificate that digisign gave me ? 我该如何检索digisign给我的证书的别名和私钥？

If the alias is correct why am i getting error starting the weblogic server ? 如果别名正确，为什么启动weblogic服务器时出错？

Incase needed, I'm also sharing the output of 如果需要，我还将分享 

keytool -v -list -keystore keystore.jks

Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 4 entries

Alias name: root
Creation date: Jul 31, 2017
Entry type: trustedCertEntry

Owner: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Serial number: 1
Valid from: Tue May 30 06:48:38 EDT 2000 until: Sat May 30 06:48:38 EDT 2020
Certificate fingerprints:
         MD5:  1D:35:54:04:85:78:B0:3F:42:42:4D:BF:20:73:0A:3F
         SHA1: 02:FA:F3:E2:91:43:54:68:60:78:57:69:4D:F5:E4:5B:68:85:18:68
         SHA256: 68:7F:A4:51:38:22:78:FF:F0:C8:B1:1F:8D:43:D5:76:67:1C:6E:B2:BC:EA:B4:13:FB:83:D9:65:D0:6D:2F:F2
         Signature algorithm name: SHA1withRSA
         Version: 3

Extensions:

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: AD BD 98 7A 34 B4 26 F7   FA C4 26 54 EF 03 BD E0  ...z4.&...&T....
0010: 24 CB 54 1A                                        $.T.
]
[CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE]
SerialNumber: [    01]
]

#2: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

#3: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  Key_CertSign
  Crl_Sign
]

#4: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: AD BD 98 7A 34 B4 26 F7   FA C4 26 54 EF 03 BD E0  ...z4.&...&T....
0010: 24 CB 54 1A                                        $.T.
]
]



*******************************************
*******************************************


Alias name: mydomain
Creation date: Jul 31, 2017
Entry type: trustedCertEntry

Owner: CN=mymac1.com, OU=Digi-SSL Xp, OU=Provided by Digi-Sign Limited, OU=Batel Affinity, O=Batel & Moss Group, L=Texas, ST=NJ, C=US
Issuer: CN=Digi-Sign CA Digi-SSL, O=Digi-Sign Limited, L=Dublin, ST=County Dublin, C=IE
Serial number: 6f70e9e8abce2003529156bf5cb98a1f
Valid from: Sun Jul 16 20:00:00 EDT 2017 until: Tue Jul 17 19:59:59 EDT 2018
Certificate fingerprints:
         MD5:  9A:F1:62:71:C4:02:C2:C1:64:87:84:A2:07:EA:1A:07
         SHA1: A0:BF:8A:61:D7:AE:82:A6:EE:4B:EB:E0:22:19:73:2E:FC:85:F8:AC
         SHA256: 56:1D:22:04:4B:E5:9D:09:1E:0C:FD:36:33:0B:E7:49:DB:C0:37:2D:93:24:F1:B1:8B:6E:27:D5:D9:76:3D:59
         Signature algorithm name: SHA256withRSA
         Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: caIssuers
   accessLocation: URIName: http://crt.usertrust.com/DigiSignCADigiSSL.crt
,
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.usertrust.com
]
]

#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 78 29 0F AE CD 90 2C C0   DC D2 7A D4 9B 5F 9C 45  x)....,...z.._.E
0010: E0 88 A8 2C                                        ...,
]
]

#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.usertrust.com/DigiSignCADigiSSL.crl]
]]

#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.9]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 19 68 74 74 70 73 3A   2F 2F 63 70 73 2E 75 73  ..https://cps.us
0010: 65 72 74 72 75 73 74 2E   63 6F 6D                 ertrust.com

]]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

#7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

#8: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: mymac1.com
  DNSName: www.mymac1.com
]

#9: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 3F 71 B1 50 5A 94 A7 0E   4E 1C B6 7E 6D 06 43 90  ?q.PZ...N...m.C.
0010: 90 5F 86 AF                                        ._..
]
]



*******************************************
*******************************************


Alias name: intermediate2
Creation date: Jul 31, 2017
Entry type: trustedCertEntry

Owner: CN=Digi-Sign CA Digi-SSL, O=Digi-Sign Limited, L=Dublin, ST=County Dublin, C=IE
Issuer: CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US
Serial number: 1b3249d255747b4e23feb384e5cdcab5
Valid from: Thu Nov 06 19:00:00 EST 2014 until: Wed Nov 06 18:59:59 EST 2024
Certificate fingerprints:
         MD5:  71:BC:96:90:5B:38:8F:01:4C:32:90:06:90:D3:CF:51
         SHA1: 70:60:8B:40:D0:B7:76:17:4A:4E:D8:54:16:58:27:70:B3:07:B9:05
         SHA256: EC:0E:91:6E:74:AB:F1:50:D7:26:9B:A8:85:AE:6C:74:1E:48:78:55:CF:DD:00:21:B1:F9:25:0E:0F:02:40:A4
         Signature algorithm name: SHA384withRSA
         Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: caIssuers
   accessLocation: URIName: http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt
,
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.usertrust.com
]
]

#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 53 79 BF 5A AA 2B 4A CF   54 80 E1 D8 9B C0 9D F2  Sy.Z.+J.T.......
0010: B2 03 66 CB                                        ..f.
]
]

#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:0
]

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl]
]]

#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.9]
[]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

#7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_CertSign
  Crl_Sign
]

#8: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 78 29 0F AE CD 90 2C C0   DC D2 7A D4 9B 5F 9C 45  x)....,...z.._.E
0010: E0 88 A8 2C                                        ...,
]
]



*******************************************
*******************************************


Alias name: intermediate1
Creation date: Jul 31, 2017
Entry type: trustedCertEntry

Owner: CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US
Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Serial number: 13ea28705bf4eced0c36630980614336
Valid from: Tue May 30 06:48:38 EDT 2000 until: Sat May 30 06:48:38 EDT 2020
Certificate fingerprints:
         MD5:  DB:78:CB:D1:90:95:27:35:D9:40:BC:80:AC:24:32:C0
         SHA1: EA:B0:40:68:9A:0D:80:5B:5D:6F:D6:54:FC:16:8C:FF:00:B7:8B:E3
         SHA256: 1A:51:74:98:0A:29:4A:52:8A:11:07:26:D5:85:56:50:26:6C:48:D9:88:3B:EA:69:2B:67:B6:D7:26:DA:98:C5
         Signature algorithm name: SHA384withRSA
         Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.usertrust.com
]
]

#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: AD BD 98 7A 34 B4 26 F7   FA C4 26 54 EF 03 BD E0  ...z4.&...&T....
0010: 24 CB 54 1A                                        $.T.
]
]

#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]
]]

#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.5.29.32.0]
[]  ]
]

#6: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_CertSign
  Crl_Sign
]

#7: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 53 79 BF 5A AA 2B 4A CF   54 80 E1 D8 9B C0 9D F2  Sy.Z.+J.T.......
0010: B2 03 66 CB                                        ..f.
]
]



*******************************************
*******************************************

Please Suggest & let me know if you need more information. 请提出建议，让我知道是否需要更多信息。

1 个解决方案

解决方案1
 1  2017-08-01 17:08:08

It doesnt looks like you added the public certificates from CA to the same keystore.jks file. 看起来您没有将CA的公共证书添加到同一keystore.jks文件中。

Can you try to run keytool with just the list command without verbose option? 您可以尝试仅使用带无详细选项的list命令运行keytool吗？

keytool -list -keystore keystore.jks -storepass <your storepass>

暂无
暂无

声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

相关问题 无法将 .jks 转换为 .pkcs12：私钥过多 - Unable to convert .jks to .pkcs12: excess private key Tomcat / JKS / Keytool - 重新生成私钥？ - Tomcat / JKS / Keytool - regenerate private key? 通过证书和私钥创建.jks文件 - Create a .jks file from a Certificate and private Key 如果我没有私钥，如何将 pki 转换为 jks？ - how to convert a pki to jks if I don't have the private key? 将受信任的证书（加上私钥/链）从Java密钥库（jks）传输到Windows证书管理器 - Transfer trusted certificate (plus private key / chain) from Java keystore (jks) to Windows Certificate Manager 将公共证书、私钥和证书链 .pem 文件转换为 jks 密钥库 - Convert public cert, private key, and certificate chain .pem files to jks keystore 在 Tomcat/Spring Boot 上配置 SSL（“Could not find key store classpath:keystore.jks”错误） - Configuring SSL on Tomcat/Spring Boot ("Could not find key store classpath:keystore.jks" error) 无法在 CentOS 上启动 Apache 未找到私钥 - Unable to start Apache on CentOS Private Key Not Found 找不到预期的 Java 密钥库 (JKS) 文件！ 当使用 Kafka Bitnami helm chart 启用通过 TLS 加密时，它们是强制性的 - Couldn't find the expected Java Key Stores (JKS) files! They are mandatory when encryption via TLS is enabled with Kafka Bitnami helm chart 无法将CA证书[crt]作为PrivateKeyEntry添加到JKS - Unable to add CA cert [crt] to JKS as PrivateKeyEntry
相关标签
 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM