在 Java cacerts 中導入根證書和中間證書的正確方法

Question

我公司有自己的ROOT證書。 他們使用此證書簽署了intermediate證書。

然后我們為server證書頒發 CSR 並使用intermediate證書對其進行簽名。

在Java cacerts文件中導入ROOT證書和intermediate的正確方法是什么，以便能夠與具有intermediate簽名的server證書的服務器建立SSL連接？

我使用 OpenSSL 來測試服務器上的證書鏈：

openssl s_client -showcerts -connect host:443

CONNECTED(00000003)
depth=0 C = COUNTRYCODE, ST = myCountry, O = myOrganization, CN = myServer, emailAddress = myMail
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = COUNTRYCODE, ST = myCountry, O = myOrganization, CN = myServer, emailAddress = myMail
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = COUNTRYCODE, ST = myCountry, O = myOrganization, CN = myServer, emailAddress = myMail
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=COUNTRYCODE/ST=myCountry/O=myOrganization/CN=myServer/emailAddress=myMail
   i:/CN=INTERMEDIATECERT
-----BEGIN CERTIFICATE-----
MIIFr...
-----END CERTIFICATE-----
---
Server certificate
subject=/C=COUNTRYCODE/ST=myCountry/O=myOrganization/CN=myServer/emailAddress=myMail
issuer=/CN=INTERMEDIATECERT
---
No client certificate CA names sent
---
SSL handshake has read 1601 bytes and written 589 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA

Answer 1

您只需要在信任庫中導入根證書。

 keytool -import -trustcacerts -keystore path/to/cacerts -storepass changeit  -alias aliasName -file path/to/certificate.cer

握手期間的 SSL 服務器應提供證書和中間件。 您客戶端的 TrustManager 將驗證認證鏈，直到找到根

注意：建議使用自己的truststore，不要修改cacerts