java SSL和cert keystore

Question

我的java程序如何知道我的包含證書的密鑰庫在哪裏？或者，我該如何告訴我的Java程序在哪裏尋找密鑰庫？

以某種方式指定密鑰庫之後，如何指定用於驗證服務器到客戶端的證書？

Answer 1

System.setProperty("javax.net.ssl.trustStore",path_to_your_cacerts_file); 

Answer 2

SSL屬性通過系統屬性在JVM級別設置。這意味着您可以在運行程序時設置它們（java -D ....）或者您可以通過執行System.setProperty將它們設置爲代碼。

你必須設置的特定按鍵均低於：

所有的

javax.net.ssl.keyStore- Location of the Java keystore file containing an application process's own certificate and private key. On Windows, the specified pathname must use forward slashes, /, in place of backslashes.

javax.net.ssl.keyStorePassword - Password to access the private key from the keystore file specified by javax.net.ssl.keyStore. This password is used twice: To unlock the keystore file (store password), and To decrypt the private key stored in the keystore (key password).

javax.net.ssl.trustStore - Location of the Java keystore file containing the collection of CA certificates trusted by this application process (trust store). On Windows, the specified pathname must use forward slashes, / , in place of backslashes, \ .

If a trust store location is not specified using this property, the SunJSSE implementation searches for and uses a keystore file in the following locations (in order):

1. $JAVA_HOME/lib/security/jssecacerts
2. $JAVA_HOME/lib/security/cacerts

javax.net.ssl.trustStorePassword - Password to unlock the keystore file (store password) specified by javax.net.ssl.trustStore .

javax.net.ssl.trustStoreType - (Optional) For Java keystore file format, this property has the value jks (or JKS). You do not normally specify this property, because its default value is already jks.

javax.net.debug - To switch on logging for the SSL/TLS layer, set this property to ssl.

Answer 3

首先，是2種密鑰庫。

個人和一般

的應用程序將使用在啓動或系統默認指定的一個。

如果JRE或JDK正在運行，或者您檢查了個人或「全局」文件夾，它將會是不同的文件夾。

他們太

總之加密，路徑將是這樣的：

$JAVA_HOME/lib/security/cacerts爲「一般的」，誰擁有所有的CA爲機關，是非常重要的。

Answer 4

您也可以通過以下

-Djavax.net.ssl.trustStore = /家庭/用戶/ SSL /我-cacerts的-Djavax.net.ssl -D性質。就像提到在運行時路徑。的keyStore = /家庭/用戶/ SSL/server_keystore.jks

在我的Apache火花的應用程序，我用來提供使用--conf選項，並在extrajavaoptions證書和密鑰庫的路徑火花提交如下

--conf'spark.driver.extraJavaOptions = -Djavax.net.ssl.trustStore =/home/user/SSL/my-cacerts -Djavax.net.ssl.keyStore =/home /user/SSL/server_keystore.jks'