将密钥对导入现有密钥对文件

Question

我有两个不同的密钥对值，使用Javakeytools生成并存储在两个不同的文件中，称为keystore1.jks和keystore2.jks.

我所做的是从keystore2导入了密钥对。jks呼叫keystore1。jks通过下面的命令

keytool -importkeystore -srcstoretype JKS -srckeystore <source_keystorfile> -deststoretype JKS -destkeystore <keystorfile_to_import_keypair>

我已经添加了密钥。jks到服务器使用这个密钥库监听ssl。

现在我已经从keystore2文件中导入了公钥。jks到名为truststore的信任库文件。jks

从这个信托商店。jks文件，当我尝试连接到服务器时，该服务器使用keystre1监听ssl。不幸的是，jks服务器不接受连接，并引发如下异常

    javax.jms.JMSException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
    at org.apache.activemq.util.JMSExceptionSupport.create(JMSExceptionSupport.java:62)
    at org.apache.activemq.ActiveMQConnection.syncSendPacket(ActiveMQConnection.java:1298)
    at org.apache.activemq.ActiveMQConnection.ensureConnectionInfoSent(ActiveMQConnection.java:1382)
    at org.apache.activemq.ActiveMQConnection.createSession(ActiveMQConnection.java:309)
    at com.sample.ssl.job.handler.MessageQueueLocator.getJmsSession(Unknown Source)
    at com.sample.ssl.job.handler.MessageQueueLocator.sendMessageToGeneralQueue(Unknown Source)
    at com.sample.ssl.communication.JobResposeDispatcherInvoker.dispatchStartupMessage(Unknown Source)
    at com.sample.ssl.job.MessageDispatchJob.dispatchStartupMessage(Unknown Source)
    at com.sample.ssl.job.MessageDispatchJob.execute(Unknown Source)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1731)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:925)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:637)
    at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:89)
    at org.apache.activemq.transport.tcp.TcpBufferedOutputStream.flush(TcpBufferedOutputStream.java:115)
    at java.io.DataOutputStream.flush(DataOutputStream.java:106)
    at org.apache.activemq.transport.tcp.TcpTransport.oneway(TcpTransport.java:181)
    at org.apache.activemq.transport.InactivityMonitor.oneway(InactivityMonitor.java:255)
    at org.apache.activemq.transport.WireFormatNegotiator.sendWireFormat(WireFormatNegotiator.java:168)
    at org.apache.activemq.transport.WireFormatNegotiator.sendWireFormat(WireFormatNegotiator.java:84)
    at org.apache.activemq.transport.WireFormatNegotiator.start(WireFormatNegotiator.java:74)
    at org.apache.activemq.transport.failover.FailoverTransport.doReconnect(FailoverTransport.java:844)
    at org.apache.activemq.transport.failover.FailoverTransport$2.iterate(FailoverTransport.java:135)
    at org.apache.activemq.thread.PooledTaskRunner.runTask(PooledTaskRunner.java:122)
    at org.apache.activemq.thread.PooledTaskRunner$1.run(PooledTaskRunner.java:43)
    at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
    at java.lang.Thread.run(Thread.java:662)
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:289)
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:263)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:184)
    at sun.security.validator.Validator.validate(Validator.java:218)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185)
    ... 21 more
Caused by: java.security.cert.CertPathValidatorException: signature check failed
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:139)
    at sun.security.provider.certpath.PKIXCertPathValidator.doValidate(PKIXCertPathValidator.java:330)
    at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:178)
    at java.security.cert.CertPathValidator.validate(CertPathValidator.java:250)
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:275)
    ... 28 more
Caused by: java.security.SignatureException: Signature does not match.
    at sun.security.x509.X509CertImpl.verify(X509CertImpl.java:421)
    at sun.security.provider.certpath.BasicChecker.verifySignature(BasicChecker.java:133)
    at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:112)
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:117)
    ... 32 more

我不知道我犯了什么错误。在我的例子中，一半的客户端使用keystore1中密钥对的信任存储。JK和其余的使用keystore2。jks。

使用keystore1的信任存储的客户端。jks连接到服务器很好。但这些客户使用密钥库2的信任存储。jks无法连接。

请在这方面帮助我解决。如果我在我的方式上犯了什么错误，请给我一个正确的路径。提前谢谢。

Answer 1

我不明白你说的一些事。。你有两个有密码的文件。。将第二个文件导入第一个文件。所以为什么需要使用第二个文件？

我认为命令应该是：（备份优先）keytool-importkeystore-srckeystorekeystore2。jks-deskeystore密钥库1。jks