Linux 为 tomcat / JKS Keystore 转换 PKCS12 格式的证书
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/10323447/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Convert certificate in PKCS12 format for tomcat / JKS Keystore
提问by Satish
I have following wildcard certificate files from GlobalSign Authority.
我有以下来自 GlobalSign Authority 的通配符证书文件。
root.crt
intermediate.crt
private.key
I want to configure tomcat HTTPS using above cert files. I believe Tomcat support PKCS12 format.
我想使用上述证书文件配置 tomcat HTTPS。我相信 Tomcat 支持 PKCS12 格式。
How do i convert those certificate files in PKSC12 format? also how do i import them in tomcat keystore, specially intermediate cert?
如何将这些证书文件转换为 PKSC12 格式？另外我如何将它们导入 tomcat 密钥库，特别是中间证书？
采纳答案by Bruno Grieder
Use openssl to create your PKCS12 file
使用 openssl 创建你的 PKCS12 文件
First create a single intcacerts.pem file with your intermediate(s) and CA, pasted one after each other (they must be in PEM format).
首先使用中间件和 CA 创建一个 intcacerts.pem 文件，一个接一个地粘贴（它们必须是 PEM 格式）。
Then call openssl
然后调用openssl
openssl pkcs12 -export -in myservercert.pem -inkey private.key -certfile intcacerts.pem -name "aFriendlyName" -out keyandcerts.p12
openssl pkcs12 -export -in myservercert.pem -inkey private.key -certfile intcacerts.pem -name "aFriendlyName" -out keyandcerts.p12
(myservercert.pem is the server certificate in PEM, intcacerts.pem contains the intermediate(s) and CA as described above, private.key is the private key associated with the server certificate)
（myservercert.pem 是 PEM 中的服务器证书，intcacerts.pem 包含上述中间体和 CA，private.key 是与服务器证书关联的私钥）
The documentation for openssl pkcs12 is here
openssl pkcs12 的文档在这里
To convert the generated PKCS12 into a JKS keystore, do something like this
要将生成的 PKCS12 转换为 JKS 密钥库，请执行以下操作
keytool -importkeystore -srckeystore keyandcerts.p12 -srcstoretype PKCS12 -destkeystore myJKS.jks
keytool -importkeystore -srckeystore keyandcerts.p12 -srcstoretype PKCS12 -destkeystore myJKS.jks
