IIS apache VFS2 上的证书无法恢复 KEY SSL

Question

I'm building an app using VFS2 to communicate throught FTPS on a IIS server.

For testing purpose I've created a self signed certificate on IIS server. For now, I can connect through Winscp and FileZilla.

Then I exported the private key and certificate from IIS

• Right click on certificate
• Yes I want to export private KEY
• Set a password and export to PFX file.

Then

• Created a brand new JKS KeyStore with KeyStore explorer with the same password as the key .

• Imported the key into the keystore with the same password as the store

Now, with VFS2 when i'm trying to make a FTPS connection, I've got an exception:

UnrecoverableKeyException: Cannot recover key

Which as the internet says, an exception that occurs when keystore and key password aren't the same. I've checked and recreated stores and key 200 times, and the password are the same.

Did I do something wrong in all that process?

Answer 1

Instead of exporting the certificate from iis try to export the certificate from the certificate store:

1. Run mmc.exe
2. Click the 'Console' menu and then click 'Add/Remove Snap-in'.
3. Click the 'Add' button and then choose the 'certificates' snap-in and click on 'Add'.
4. Select 'Computer Account' then click 'Next'.
5. Select 'Local Computer' and then click 'OK'.
6. Click 'Close' and then click 'OK'.
7. Expand the menu for 'Certificates' and click on the 'Personal' folder.
8. Right-click on the certificate that you want to export and select 'All tasks' -> 'Export'.
9. A wizard will appear. Make sure you check the box to include the private key and continue through with this wizard until you have a.PFX file.

Next run openssl to extract the private key, and the cert file.

Extract the private key:

Export the private key file from the.PFX file.

openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Extract the certificate file:

Export the certificate file from the.PFX file.

openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

Remove the passphrase:

This command removes the passphrase from the private key so Apache won't prompt you for your passphase when it starts.

openssl rsa -in key.pem -out server.key

Make sure that the following lines are present in your apache virtual host configuration file and they are correct:

SSLEngine on
SSLOptions +StrictRequire
SSLCertificateFile /path/to/certificate/cert.pem
SSLCertificateKeyFile /patch/to/key/server.key

Restart the apache server after doing all the configuration changes.