使用 keytool 将 p7b 文件导入 Java Keystore

Question

I'm trying to import a p7b file from a third party in to a java trust store. It looks like the p7b contains a root cert and a public key.

I'm trying to import it using a command similar to

keytool -importcert -file certs.p7b -keystore dave.jks -storetype JCEKS -trustcacerts

When the file was presented to me by the third party, they did not tell me what the alias of the public key is.

Am I right in thinking that I can't import it without knowing this information?

Answer 1

It is a quite old question. But I just faced the same problem, so I'll post what I did.

We had a .p7b file from a public agency holding a certificate chain that had to be accepted in our system. As it had a certificate chain, it could not be imported directly to a p12 file, so, first, with openssl I inspected it:

 openssl pkcs7 -print_certs -inform der -in file.p7b

This command gives a list of aliases and base64-encoded certificates:

subject=LONG CERTIFICATE1 COMMONNAME WITH ESCAPE SEQUENCES
issuer=LONG CERTIFICATE1'S ISSUER COMMONNAME
-----BEGIN CERTIFICATE-----
long base64 string
-----END CERTIFICATE-----

subject=LONG CERTIFICATE2 COMMONNAME WITH ESCAPE SEQUENCES
issuer=LONG CERTIFICATE2'S ISSUER COMMONNAME
-----BEGIN CERTIFICATE-----
long base64 string
-----END CERTIFICATE-----

This list was quite long, as the .p7b file holded several certificates.

The next step was to copy all fragments between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- and store them in different files with a .pem extension:

certificate1.pem
certificate2.pem
...

And then import them to the keystore, using the long commonname as alias:

keytool -alias "LONG CERTIFICATE1 COMMONNAME WITH ESCAPE SEQUENCES" -importcert -trustcacerts -file certificate1.pem -keystore trustcerts.p12 -storetype PKCS12
keytool -alias "LONG CERTIFICATE2 COMMONNAME WITH ESCAPE SEQUENCES" -importcert -trustcacerts -file certificate2.pem -keystore trustcerts.p12 -storetype PKCS12

After this, we had a pkcs12 keystore with all the .p7b certificates.