如何以编程方式将 pkcs12 文件导入 Java 密钥库

Question

I have pkcs12 file (keypair.p12 ). With keytool I can import (merge) this with a Java keystore:

keytool -importkeystore \
        -deststorepass [changeit] -destkeypass [changeit] -destkeystore server.keystore \
        -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass some-password \
        -alias [some-alias]

How to do the same programmatically?

Answer 1

You can look up the source as it is Open Source for instance here . There is a method that should show you what is needed to be done:

    private void doImportKeyStore() throws Exception {

        if (alias != null) {
            doImportKeyStoreSingle(loadSourceKeyStore(), alias);
        } else {
            if (dest != null || srckeyPass != null) {
                throw new Exception(rb.getString(
                        "if.alias.not.specified.destalias.and.srckeypass.must.not.be.specified"));
            }
            doImportKeyStoreAll(loadSourceKeyStore());
        }
        /*
         * Information display rule of -importkeystore
         * 1. inside single, shows failure
         * 2. inside all, shows sucess
         * 3. inside all where there is a failure, prompt for continue
         * 4. at the final of all, shows summary
         */
    }

Answer 2

The key to importing a.p12 certificate file is that it's already a "keystore". This means that it can be loaded as "pkcs12" keystore and then copied to another "jks" keystore.

public void importP12Certificate(String filePathP12, String passwordP12, String filePathJks, String passwordJKS) throws Exception {

    KeyStore p12Store = loadKeystore(filePathP12, passwordP12, "pkcs12");

    KeyStore jksStore = loadKeystore(filePathJks, passwordJKS, "jks");

    Enumeration aliases = p12Store.aliases();
    
    while (aliases.hasMoreElements()) {
    
        String alias = (String)aliases.nextElement();

        if (p12Store.isKeyEntry(alias)) {
            System.out.println("Adding key for alias " + alias);
            Key key = p12Store.getKey(alias, passwordP12.toCharArray());

            Certificate[] chain = p12Store.getCertificateChain(alias);

            jksStore.setKeyEntry(alias, key, passwordJKS.toCharArray(), chain);
        }
    }

    storeKeystore(jksStore,filePathJks,passwordJKS);
    
}


private KeyStore loadKeystore(String keyStoreFile, String keystorePassword, String keystoreType) throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException {

    File file = new File(keyStoreFile);
    InputStream inputStream = new FileInputStream(file);
    
    KeyStore keystore = null;
    
    if(keystore == null){
        keystore = KeyStore.getInstance(KeyStore.getDefaultType()); 
    }else{
        keystore = KeyStore.getInstance(keystoreType);  
    }       
    
    keystore.load(inputStream, keystorePassword.toCharArray());

    return keystore;
}

private void storeKeystore(KeyStore keystore, String keyStoreFile, String keystorePassword) throws IOException, CertificateException, NoSuchAlgorithmException, KeyStoreException {

    File file = new File(keyStoreFile);
    FileOutputStream out = new FileOutputStream(file);
    keystore.store(out, keystorePassword.toCharArray());
    out.close();
}