java - 未找到 key 保护算法 : java. security.KeyStoreException:证书链未验证

Question

当我尝试创建 JKS 文件，将其写入磁盘，然后运行 ​​keytool 将其转换为 P12 时，出现此错误。我走这条路的原因是因为我无法在代码中获得适用于 iOS 的 P12(不是加密人士)。那里有足够的代码来创建 JKS。为了创建我的最终凭证，我这样做:

public X509Certificate buildEndEntityCert(PublicKey entityKey, PrivateKey caKey, X509Certificate caCert, String clientName)
        throws Exception {
    String name = "CN=" + clientName;
    X509v3CertificateBuilder certBldr = new JcaX509v3CertificateBuilder(
            caCert.getSubjectX500Principal(),
            BigInteger.ONE,
            new Date(System.currentTimeMillis()),
            new Date(System.currentTimeMillis() + VALIDITY_PERIOD),
            new X500Principal(name),
            entityKey);

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    certBldr.addExtension(Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caCert))
            .addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(entityKey))
            .addExtension(Extension.basicConstraints, false, new BasicConstraints(false))
            .addExtension(Extension.keyUsage, false, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.nonRepudiation))
            .addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));

    ContentSigner signer = new JcaContentSignerBuilder("SHA256withRSA").setProvider("BC").build(caKey);

    return new JcaX509CertificateConverter().setProvider("BC").getCertificate(certBldr.build(signer));
}

我调用该方法并创建 JKS，如下所示:

KeyPair endPair = generateRSAKeyPair(2048);
X509Certificate endCert = buildEndEntityCert(endPair.getPublic(), intermediateCredential.getPrivateKey(), intermediateCredential.getCertificate(), clientName);  // intermediateCredential and rootCredential are properties of this class that get loaded when the app starts up
X500PrivateCredential endCredential = new X500PrivateCredential(endCert, endPair.getPrivate(), clientName);

KeyStore store = KeyStore.getInstance("JKS");
store.load(null, null);
store.setKeyEntry(clientName, endCredential.getPrivateKey(), "secret".toCharArray(),
        new Certificate[]{
                endCredential.getCertificate(),
                intermediateCredential.getCertificate(),
                rootCredential.getCertificate()
        });
store.store(new FileOutputStream(clientName + ".jks"), "secret".toCharArray());

然后当我从 ProcessBuilder 运行 keytool 时:

"C:\\Program Files\\Java\\jdk1.7.0_80\\bin\\keytool",     
                "-importkeystore",
                "-srckeystore",
                clientName + ".jks",
                "-destkeystore",
                clientName + ".p12",
                "-srcstoretype", "JKS",
                "-deststoretype", "PKCS12",
                "-deststorepass",
                clientName,
                "-srcalias",
                clientName,
                "-destalias",
                clientName

我得到:

Problem importing entry for alias CLIENT_NAME: java.security.KeyStoreException: Key protection algorithm not found: java.security.KeyStoreException: Certificate chain is not validate.

我尝试搜索此内容，但没有找到太多信息。这是什么意思还是我做错了什么？

Answer 1

我有同样的异常(exception)，尝试以编程方式填充 key 存储。

我跟踪问题到 sun.security.pkcs12.PKCS12KeyStore

在方法setKeyEntry

中

            if (chain != null) {
                // validate cert-chain
                if ((chain.length > 1) && (!validateChain(chain)))
                   throw new KeyStoreException("Certificate chain is " +
                                            "not valid");

方法validateChain

private boolean validateChain(Certificate[] certChain)
{
    for (int i = 0; i < certChain.length-1; i++) {
        X500Principal issuerDN =
            ((X509Certificate)certChain[i]).getIssuerX500Principal();
        X500Principal subjectDN =
            ((X509Certificate)certChain[i+1]).getSubjectX500Principal();
        if (!(issuerDN.equals(subjectDN)))
            return false;
    }


    // Check for loops in the chain. If there are repeated certs,
    // the Set of certs in the chain will contain fewer certs than
    // the chain
    Set<Certificate> set = new HashSet<>(Arrays.asList(certChain));
    return set.size() == certChain.length;
}

因此请检查 middleCredential 和 rootCredential。