Java 使用或不使用 OpenSSL 将 SSL .pem 转换为 .p12

Convert SSL .pem to .p12 with or without OpenSSL

提问by DrDave

I get external .pemfiles that need to be converted to .p12files - I add a username and password in the process. (I need to do this to utilize a third party API.)

我得到.pem需要转换为.p12文件的外部文件- 我在这个过程中添加了用户名和密码。（我需要这样做以利用第三方 API。）

Using openssl, the command is...

使用openssl，命令是...

openssl pkcs12 -export -in xxxx.pem -inkey xxxx.pem -out xxx.p12 -passout pas:newpassword -name "newname"

I can run this from a terminal session and it works perfectly.

我可以从终端会话中运行它，它运行良好。

However, I will need to do this often and have written a Java class that handles this and more (my application is mostly .jspwith Tomcat and Apache). When I try run the same command from Java using Runtime.exec, I get the dreaded "unable to write 'random state'" error ( Using OpenSSL what does "unable to write 'random state'" mean?).

但是，我需要经常这样做，并编写了一个 Java 类来处理这个以及更多（我的应用程序主要.jsp使用 Tomcat 和 Apache）。当我尝试使用从 Java 运行相同的命令时Runtime.exec，出现可怕的“无法写入‘随机状态’”错误（使用 OpenSSL 是什么“无法写入‘随机状态’”是什么意思？）。

I assume that the difference is that, when I run from Java, the user is not "root".

我认为不同之处在于，当我从 Java 运行时，用户不是“root”。

So, is there a better way to convert from pem to .p12 using a Java library rather than executing a command line program (i.e. openssl)?

那么，是否有更好的方法使用 Java 库而不是执行命令行程序（即 openssl）将 pem 转换为 .p12？

Otherwise, I guess I need to do some configuration on my server. I can not find any .mdfile anywhere on the server. The only openssl.cnffile is in a weird directory (/etc/pki/tls). Do I need to create a new openssl.cnffile somewhere else?

否则，我想我需要在我的服务器上做一些配置。我.md在服务器上的任何地方都找不到任何文件。唯一的openssl.cnf文件在一个奇怪的目录 ( /etc/pki/tls) 中。我需要在openssl.cnf其他地方创建一个新文件吗？

回答by Bruno Grieder

In Java, use Bouncycastlebut be warned, learning curve is steep and documentation scarce. I strongly recommend you look at the examples which are available as part of the source distribution

在 Java 中，使用Bouncycastle但要注意，学习曲线陡峭且文档稀缺。我强烈建议您查看作为源代码分发的一部分提供的示例

Start with the PemReader.

从 PemReader 开始。

回答by Muggles Merriweather

This should do what you want to do (using the BouncyCastle PEMReader as suggested above) -- take a PEM-encoded private key + certificate, and output a PKCS#12 file. Uses the same password for the PKCS12 that was used to protect the private key.

这应该做你想做的事情（使用上面建议的 BouncyCastle PEMReader）——采用 PEM 编码的私钥 + 证书，并输出一个 PKCS#12 文件。对用于保护私钥的 PKCS12 使用相同的密码。

public static byte[] pemToPKCS12(final String keyFile, final String cerFile, final String password) throws Exception {
    // Get the private key
    FileReader reader = new FileReader(keyFile);

    PEMReader pem = new PEMReader(reader, new PasswordFinder() {
        @Override public char[] getPassword() {
            return password.toCharArray();
        }
    });

    PrivateKey key = ((KeyPair)pem.readObject()).getPrivate();

    pem.close();
    reader.close();

    // Get the certificate      
    reader = new FileReader(cerFile);
    pem = new PEMReader(reader);

    X509Certificate cert = (X509Certificate)pem.readObject();

    pem.close();
    reader.close();

    // Put them into a PKCS12 keystore and write it to a byte[]
    ByteArrayOutputStream bos = new ByteArrayOutputStream();
    KeyStore ks = KeyStore.getInstance("PKCS12");
    ks.load(null);
    ks.setKeyEntry("alias", (Key)key, password.toCharArray(), new java.security.cert.Certificate[]{cert});
    ks.store(bos, password.toCharArray());
    bos.close();
    return bos.toByteArray();
}

回答by EpicPandaForce

Based on @MugglesMerriweather 's answer, an updated version to v1.51 is the following:

根据@MugglesMerriweather 的回答，v1.51 的更新版本如下：

public static byte[] convertPEMToPKCS12(final String keyFile, final String cerFile,
        final String password)
        throws IOException, CertificateException, KeyStoreException, NoSuchAlgorithmException
    {
        // Get the private key
        FileReader reader = new FileReader(keyFile);

        PEMParser pem = new PEMParser(reader);
        PEMKeyPair pemKeyPair = ((PEMKeyPair)pem.readObject());
        JcaPEMKeyConverter jcaPEMKeyConverter = new JcaPEMKeyConverter().setProvider("SC");
        KeyPair keyPair = jcaPEMKeyConverter.getKeyPair(pemKeyPair);

        PrivateKey key = keyPair.getPrivate();

        pem.close();
        reader.close();

        // Get the certificate
        reader = new FileReader(cerFile);
        pem = new PEMParser(reader);

        X509CertificateHolder certHolder = (X509CertificateHolder) pem.readObject();
        java.security.cert.Certificate X509Certificate =
            new JcaX509CertificateConverter().setProvider("SC")
                .getCertificate(certHolder);

        pem.close();
        reader.close();

        // Put them into a PKCS12 keystore and write it to a byte[]
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        KeyStore ks = KeyStore.getInstance("PKCS12");
        ks.load(null);
        ks.setKeyEntry("alias", (Key) key, password.toCharArray(),
            new java.security.cert.Certificate[]{X509Certificate});
        ks.store(bos, password.toCharArray());
        bos.close();
        return bos.toByteArray();
    }

回答by sascha.arthur

Based on the answers i created a java 7 class, which handles everything for creating a valid SSLContext. Also it creates the necessary chain. TODO: Trustmanager if necessary.

根据答案，我创建了一个 java 7 类，它处理创建有效 SSLContext 的所有内容。它还创建了必要的链。TODO：必要时使用 Trustmanager。

public final class SSL_Context {
    private static SSL_Context instance = new SSL_Context();

public static SSL_Context getInstance() {
    return instance;
}

private SSLContext sslContext = null;
private SSL_Context() {
    try {
        sslContext = generateSSLContext();
    }
    catch (Exception e)
    {
        ErrorLogger.logException(e);
    }
}

final private void dumpKeyStore(KeyStore keyStore)
{
    try {
        // List the aliases
        Enumeration aliases = keyStore.aliases();
        for (; aliases.hasMoreElements(); ) {
            String alias = (String) aliases.nextElement();

            // Does alias refer to a private key?
            boolean a = keyStore.isKeyEntry(alias);

            // Does alias refer to a trusted certificate?
            boolean b = keyStore.isCertificateEntry(alias);
            ErrorLogger.log(alias + " " + a + " " + b, 2);
        }
    } catch (Exception e) {
        ErrorLogger.logException(e);
    }
}


final private KeyStore convertPEMToPKCS12(final String keyAndPubFile, final String chainFile, final String password) {
    try {
        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());

        PrivateKey key;
        Certificate pubCert;

        try (FileReader reader = new FileReader(keyAndPubFile);
             PEMParser pem = new PEMParser(reader)) {
            PEMKeyPair pemKeyPair = ((PEMKeyPair) pem.readObject());
            JcaPEMKeyConverter jcaPEMKeyConverter = new JcaPEMKeyConverter().setProvider("BC");
            KeyPair keyPair = jcaPEMKeyConverter.getKeyPair(pemKeyPair);
            key = keyPair.getPrivate();


            X509CertificateHolder certHolder = (X509CertificateHolder) pem.readObject();
            pubCert = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);
        }

        // Get the certificates
        try (FileReader reader = new FileReader(chainFile);
             PEMParser pem = new PEMParser(reader)) {

            //load all certs
            LinkedList<Certificate> certsll = new LinkedList<>();
            X509CertificateHolder certHolder = (X509CertificateHolder) pem.readObject();
            do {
                Certificate X509Certificate = new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder);
                certsll.add(X509Certificate);
            }
            while ((certHolder = (X509CertificateHolder) pem.readObject()) != null);

            Certificate[] chain = new Certificate[certsll.size()+1];
            chain[0] = pubCert;

            KeyStore ks = KeyStore.getInstance("PKCS12");
            ks.load(null);

            int i = 1;
            for (Certificate cert : certsll) {
                ks.setCertificateEntry("chain" + i, cert);
                chain[i] = ks.getCertificate("chain" + i);
                i++;
            }

            ks.setKeyEntry("cert", key, password.toCharArray(), chain);

            return ks;
        }
    }
    catch (Exception e)
    {
        ErrorLogger.logException(e);
    }
    return null;
}

final private SSLContext generateSSLContext()
{
    String keyStorePassword = "";
    try {
        KeyStore keyStore = convertPEMToPKCS12("ssl/keyandcert.pem", "ssl/ca_bundle.crt", keyStorePassword);
        SSLContext sslContext = SSLContext.getInstance("TLSv1");
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());
        sslContext.init(keyManagerFactory.getKeyManagers(), null, new SecureRandom());
        return sslContext;

    } catch (Exception e) {
        ErrorLogger.logException(e);
    }
    return null;
}

final public SSLContext getContext() {
    return sslContext;
}

final public static void main(String args[])
{
        getInstance().getContext();
}

}

回答by tresf

This solutions is an adaptation of @sascha-arthur's to accomodate for:

此解决方案是@sascha-arthur 的改编版，以适应：

• Handles edge-case where PrivateKey format is not as expected.
• Gracefully handle scenario where public key is not available
• Fixed a few minor redundancies and formatting

• 处理PrivateKey 格式不符合预期的边缘情况。
• 优雅地处理公钥不可用的场景
• 修复了一些小的冗余和格式

The code:

编码：

String alias="myalias";
char[] password = "mypassword".toCharArray();

// Private Key
PEMParser pem = new PEMParser(new FileReader(keyFile));
Object parsedObject = pem.readObject();

PrivateKeyInfo privateKeyInfo = parsedObject instanceof PEMKeyPair ? ((PEMKeyPair)parsedObject).getPrivateKeyInfo() : (PrivateKeyInfo)parsedObject;
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(privateKeyInfo.getEncoded());
KeyFactory factory = KeyFactory.getInstance("RSA");
PrivateKey key = factory.generatePrivate(privateKeySpec);

List<X509Certificate> certs = new ArrayList<>();
X509CertificateHolder certHolder = (X509CertificateHolder)pem.readObject();
if(certHolder != null) {
    certs.add(new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder));
}

// Certificate
pem = new PEMParser(new FileReader(certFile));
while((certHolder = (X509CertificateHolder)pem.readObject()) != null) {
    certs.add(new JcaX509CertificateConverter().setProvider("BC").getCertificate(certHolder));
}

// Keystore
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(null);

for (int i = 0; i < certs.size(); i++) {
    ks.setCertificateEntry(alias + "_" + i, certs.get(i));
}

KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load(null);
keyStore.setKeyEntry(alias, key, password, certs.toArray(new X509Certificate[certs.size()]));

For this to work with a LetsEncrypt certificate, you'll need to use the following files:

要使其与 LetsEncrypt 证书一起使用，您需要使用以下文件：

• privkey.pem
• fullchain.pem

• privkey.pem
• fullchain.pem