java - 尝试将 CA 根证书导入 JVM 信任存储区

Question

首先让大家知道我是这方面的新手!

我有两个文件要添加到信任存储中，以允许我们的 Java 应用程序与传真服务通信。一个是 api.fax.crt，另一个是 api.fax.ca。我一直通过以下方式将证书添加到服务器:

cd /etc/pki/ca-trust/source/anchors/
aws s3 cp s3://BlahBlah/temp/api.fax.ca .
aws s3 cp s3://BlahBlah/temp/api.faxa.crt .
sudo update-ca-trust
sudo service tomcat restart

这似乎确实有效，但有时需要十分钟才能起作用，有时需要几个小时。我所说的工作是指它让使用它的代码与终端传真服务进行通信我读了一下，发现我可能应该将它们安装在 JVM 信任存储中。我尝试了以下方法:

cd /usr/java/latest/lib/security/
aws s3 cp s3://BlahBlah/temp/api.fax.ca .
aws s3 cp s3://BlahBlah/temp/api.fax.crt .
sudo keytool -importcert -noprompt -trustcacerts -alias faxage -file api.fax.com.ca -keystore /usr/java/latest/lib/security/cacerts -storepass blahblah
sudo keytool -importcert -noprompt -trustcacerts -alias faxage2 -file api.fax.com.crt -keystore /usr/java/latest/lib/security/cacerts -storepass blahblah
sudo service tomcat restart

这样做我一直无法连接到传真服务。

还有更好的办法吗？我应该将其添加到 Java 位置还是 ca-trust 位置？我应该添加 ca 和 crt 文件吗？为什么我在第一个示例中会出现延迟？感谢大家的见解!!!!

仅供引用 - 我收到的错误如下。我查找了这些错误，找到的答案是将证书添加到“/usr/java/latest/lib/security/cacert” keystore 中 - 我尝试了它，但它不起作用。

javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target<br>
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)<br>
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)<br>
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:264)<br>
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:259)<br>
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:642)<br>
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:461)<br>
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:361)<br>
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)<br>
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:450)<br>
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:427)<br>
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:178)<br>
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)<br>
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1152)<br>
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1063)<br>
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:402)<br>
at java.base/sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:716)<br>
at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:970)<br>
at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:81)<br>
at java.base/java.io.BufferedOutputStream.write(BufferedOutputStream.java:122)<br>
at java.base/java.io.FilterOutputStream.write(FilterOutputStream.java:108)<br>
at org.apache.commons.httpclient.methods.ByteArrayRequestEntity.writeRequest(ByteArrayRequestEntity.java:90)<br>
      And many more........

Answer 1

您还需要更新server.xml，以告知其 keystore 的路径:

来自tomcat 7 documentation

<Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="${user.home}/.keystore" keystorePass="changeit"
           clientAuth="false" sslProtocol="TLS"/>

文档的其余部分也可能有用