将 SAN 添加到 SSL 证书（在 Java 中）
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5988671/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Adding an SAN to an SSL cert (in Java)
提问by olefevre
I want to create a self-signed cert with the SAN field (subject alternative name) set but the Java keytool tool does not seem to support that. What is my best option? This is for Java use, so the keystore must still match the JKS format even if a non-Java tool is used to create the cert.
我想创建一个设置了 SAN 字段（主题备用名称）的自签名证书，但 Java keytool 工具似乎不支持。我最好的选择是什么？这是供 Java 使用的，因此即使使用非 Java 工具创建证书，密钥库仍必须匹配 JKS 格式。
采纳答案by olefevre
The JDK7 suggestion is a good one. In the meantime I was able to do it using the Bouncy Castle library. It was educational to do it programmatically instead of with keytool and getting the stores in jks format was straightforward.
JDK7 的建议是一个很好的建议。与此同时，我能够使用 Bouncy Castle 库来做到这一点。以编程方式而不是使用 keytool 来完成它具有教育意义，并且以 jks 格式获取存储很简单。
回答by user2438793
You can do this by adding the SAN function to the command when creating the CSR:
您可以通过在创建 CSR 时将 SAN 功能添加到命令中来执行此操作：
Create the Keystore:
创建密钥库：
keytool -genkey -alias SANTEST -keyalg RSA -keystore SANTEST.jks -keysize 2048
Issue the CSR:
发出 CSR：
keytool -certreq -alias SANtest01 -keystore SANTEST.jks -ext san=dns:san.yourdomain.com -keysize 204
http://download.java.net/jdk8/docs/technotes/tools/solaris/keytool.html
http://download.java.net/jdk8/docs/technotes/tools/solaris/keytool.html
回答by President James K. Polk
回答by Rup
It sounds like getting the more recent keytool might be easiest, but you could also create the certificate with alternate name set using openssl and then import that into keytool.
听起来获取更新的 keytool 可能是最简单的，但您也可以使用 openssl 创建具有备用名称集的证书，然后将其导入 keytool。
回答by Yogi
You can use http://Ssltools.com/managerto create the San cert and export it and then import it into the keystore.
您可以使用http://Ssltools.com/manager创建 San 证书并将其导出，然后将其导入密钥库。
keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore my-keystore.jks -srckeystore cert-and-key.p12 -srcstoretype PKCS12 -srcstorepass cert-and-key-password -alias 1
keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore my-keystore.jks -srckeystore cert-and-key.p12 -srcstoretype PKCS12 -srcstorepass cert-and-key-password -alias 1
