由于错误，使用 Java API 创建 pkcs12 失败：java.security.KeyStoreException：不支持 TrustedCertEntry
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/27160189/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Creating pkcs12 using Java API failes due to error: java.security.KeyStoreException: TrustedCertEntry not supported
提问by neutral_sphere
I am trying to create a PKCS12 keystore file using Java API. However as soon as I try to import the certificate I get the exception
我正在尝试使用 Java API 创建一个 PKCS12 密钥库文件。但是，一旦我尝试导入证书，我就会收到异常
java.security.KeyStoreException: TrustedCertEntry not supported
my code is:
我的代码是：
Provider p = Security.getProvider(BouncyCastleProvider.PROVIDER_NAME);
...
KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load(null, keystorePass);
keyStore.setCertificateEntry("certificate", certificate);
keyStore.setKeyEntry("key",privateKey, keypass, certChain);
The same approach works for creating JKS files but failed for PKCS12 files.
相同的方法适用于创建 JKS 文件，但无法用于 PKCS12 文件。
Note: The certificate given to this program as input is created by the server using the CSR generated with the same private key used here. I.e. the public modulus for the given certificate, CSR used to generate it and the given private key are the same.
注意：作为输入提供给该程序的证书是由服务器使用使用此处使用的相同私钥生成的 CSR 创建的。即给定证书的公共模数、用于生成它的 CSR 和给定的私钥是相同的。
The server cert is stored in variable certChain.
服务器证书存储在变量 certChain 中。
Note: I have tried OpenSSL to create the pkcs12 and I was successful, however I need to do the same using Java API.
注意：我已经尝试使用 OpenSSL 创建 pkcs12 并且我成功了，但是我需要使用 Java API 做同样的事情。
Note: I am using JDK 7
注意：我使用的是 JDK 7
回答by dave_thompson_085
Java 7 (and earlier) does not allow a trustedCertentry in a PKCS12 keystore although 8 does, perhaps because PKCS12 was designed and is usually used only for privatekey(s) and the related cert(s) and which Java puts together in the privateKeyentry. You say this cert is the cert for/matching the privatekey, so it mustbe first in the certChain in the "key" entry, and you do notneed a "cert" entry for it.
Java 7（及更早版本）不允许trustedCertPKCS12 密钥库中的条目，尽管 8允许，这可能是因为 PKCS12 被设计并且通常仅用于私钥和相关证书以及 Java 将其放在一起的privateKey条目。你说这个证书是/匹配的专用密钥，所以它的证书必须先在“键”条目certChain，你也不会需要它“认证”条目。
