java - 如何在JKS中管理两个 key

Question

我有两台服务器

1. Tomcat as Application Server
2. Openfire as Chat Server

现在我需要在两台服务器上通过 SSL/TSL(https 协议(protocol))管理流量。这就是为什么我为两台服务器创建了 keystore 文件和自签名证书:

Tomcat(应用程序服务器)的别名 tomcat

keytool -genkey -alias tomcat -keyalg RSA

以及 Openfire 的别名 openfire(xmpp 服务器)

keytool -genkey -alias openfire -keyalg RSA 

两个别名都有自己唯一的密码，Keystore 文件的密码与 tomcat 相同。

但是当我重新启动 tomcat 服务器时，出现错误:

SEVERE: Failed to initialize end point associated with ProtocolHandler ["http-nio-8443"]
java.security.UnrecoverableKeyException: Cannot recover key
    at sun.security.provider.KeyProtector.recover(KeyProtector.java:328)
    at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:138)
    at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:55)
    at java.security.KeyStore.getKey(KeyStore.java:804)

当我在 keystore 文件中添加另一个别名作为 openfire 时，出现此错误。通过 keytool -delete -alias openfire 删除别名后，tomcat 会正常重新启动并且不会导致任何错误。

这里我无法识别如何管理 keystore 中的两个 key ？

Answer 1

您的 keystore 中有多个 key ，默认情况下 Tomcat 将仅尝试读取找到的第一个 key 。

您需要使用keyAlias <Connector> 上的参数在 server.xml覆盖此行为。来自 the documentation :

The alias used for the server key and certificate in the keystore. If not specified, the first key read from the keystore will be used. The order in which keys are read from the keystore is implementation dependent. It may not be the case that keys are read from the keystore in the same order as they were added. If more than one key is present in the keystore it is strongly recommended that a keyAlias is configured to ensure that the correct key is used.