使用keytool和openssl自动化密钥库

Question

我有这个脚本：

PASSWORD=password123
openssl genrsa -out client2.key 2048
openssl req -new -key client2.key -out client2.csr -subj "/C=/ST=/L=/O=/OU=/CN=/emailAddress=" -passin pass:$PASSWORD -passout pass:$PASSWORD
openssl x509 -req -in client2.csr -CA ./ca/ca.crt -CAkey ./ca/ca.key -CAcreateserial -out client2.crt -days 1825 -sha256
openssl pkcs12 -export -out bundle.p12 -in client2.crt -inkey client2.key -password pass:$PASSWORD
keytool -keystore truststore.jks -import -file ./ca/ca.crt -alias cacert -storepass $PASSWORD -keypass $PASSWORD -noprompt
keytool -destkeystore keystore.jks -importkeystore -srckeystore bundle.p12 -srcstoretype PKCS12 -srcstorepass $PASSWORD -destkeypass $PASSWORD -deststorepass $PASSWORD -srckeypass $PASSWORD

问题是最后一个命令，它返回：

密钥工具错误：java.io.io异常：密钥库密码不正确

不明白为什么，因为所有密码都是一样的。

Answer 1

在尝试手动运行导入命令时，如下所示。。。

keytool -v -importkeystore -srckeystore bundle.p12 -srcstoretype pkcs12 
-destkeystore keystore.jks -deststoretype JKS -deststorepass password123 
-srcstorepass password123

我收到以下异常：

Importing keystore bundle.p12 to keystore.jks...
keytool error: java.io.IOException: keystore password was incorrect
java.io.IOException: keystore password was incorrect
at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2159)
at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:221)
at java.base/java.security.KeyStore.load(KeyStore.java:1473)
at java.base/sun.security.tools.keytool.Main.loadSourceKeyStore(Main.java:2318)
at java.base/sun.security.tools.keytool.Main.doCommands(Main.java:1233)
at java.base/sun.security.tools.keytool.Main.run(Main.java:415)
at java.base/sun.security.tools.keytool.Main.main(Main.java:408)
Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: java.security.cert.CertificateParsingException: Empty subject DN not allowed in v1 certificate

这表明你的部分问题可能是在你的剧本中你没有为这个主题提供任何价值。如果我解决了这个问题：

openssl req -new -key client2.key -out client2.csr -subj "/CN=example-client" 
-passin pass:$PASSWORD -passout pass:$PASSWORD

手动导入命令工作没有问题：

$ keytool -v -importkeystore -srckeystore bundle.p12 -srcstoretype pkcs12 
-destkeystore keystore.jks -deststoretype JKS -deststorepass password123 
-srcstorepass password123
Importing keystore bundle.p12 to keystore.jks...
Entry for alias 1 successfully imported.
Import command completed:  1 entries successfully imported, 0 entries failed or cancelled
[Storing keystore.jks]

但是脚本中的命令——不同之处在于它包含CCD_ 1和CCD_ 2-仍然失败：

Importing keystore bundle.p12 to keystore.jks...
keytool error: java.lang.Exception: if alias not specified, destalias and srckeypass must not be specified

如果从脚本中删除-srckeypass选项，其工作方式如下预期。