在 Java 证书中导入根证书和中间证书的正确方法

Question

我的公司有自己的ROOT证书。他们使用此证书签署了intermediate证书。

然后，我们为server证书颁发了CSR，并用intermediate证书进行了签名。

导入 Java cacerts 文件中的ROOT证书和intermediate的正确方法是什么，以便能够与具有intermediate签名的证书server服务器建立 SSL 连接？

我使用 OpenSSL 在服务器上测试证书链：

openssl s_client -showcerts -connect host:443
CONNECTED(00000003)
depth=0 C = COUNTRYCODE, ST = myCountry, O = myOrganization, CN = myServer, emailAddress = myMail
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = COUNTRYCODE, ST = myCountry, O = myOrganization, CN = myServer, emailAddress = myMail
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = COUNTRYCODE, ST = myCountry, O = myOrganization, CN = myServer, emailAddress = myMail
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=COUNTRYCODE/ST=myCountry/O=myOrganization/CN=myServer/emailAddress=myMail
   i:/CN=INTERMEDIATECERT
-----BEGIN CERTIFICATE-----
MIIFr...
-----END CERTIFICATE-----
---
Server certificate
subject=/C=COUNTRYCODE/ST=myCountry/O=myOrganization/CN=myServer/emailAddress=myMail
issuer=/CN=INTERMEDIATECERT
---
No client certificate CA names sent
---
SSL handshake has read 1601 bytes and written 589 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA

Answer 1

您只需在信任库中导入根证书。

 keytool -import -trustcacerts -keystore path/to/cacerts -storepass changeit  -alias aliasName -file path/to/certificate.cer

握手期间的 SSL 服务器应提供证书和中间项。客户端的 TrustManager 将验证证书链，直到找到根

注意：建议使用自己的信任库，而不是修改证书