将JKS的公钥导入Pem，反之亦然

Question

I have a Java Server Which understands .jks format and client which understand .pem . I have generate Server key-pair using keytool and Client key-pair using openssl but for mutual authentication how do I import client's public key into server's JKS and Server Public key into client .pem file.

Answer 1

Most recent versions of keytool understand PEM. So in those cases one uses

keytool -importcert ...

and assuming that you've already imported the cert you've signed the client cert with (as a trustcacert) you should be good. Otherwise also import that with the -trustcacert (or if it is iselfsigned - add that flag to the import).

If you are on an older java, say on RHEL, then you need to convert it to DER format first. Conversion is done with:

openssl x509 -in client.pem -out client.der -outform DER
openssl x509 -in client.pem -out client.net -outform NET

And that should be it. On the client side - one generally does not import the server cert into the client cert - but imports these separately into your application. So to answer that one would need to know what your client application is.