키 스토어 형식을 변경할 수 없습니다

Question

최신 JRE (버전 1.8.0_151)의 keytool을 사용하여 일부 키 스토어를 만들려고합니다. 나는이 명령 keytool -genkey -alias serverprivate -keystore server.private -keyalg rsa -storepass apassword -keypass apassword을 사용하여 키 스토어를 만들 때 그것은 나에게이 경고 보여줍니다

Warning: 
The JKS keystore uses a proprietary format. It is recommended to migrate 
to PKCS12 which is an industry standard format using "keytool 
-importkeystore -srckeystore server.private -destkeystore server.private 
-deststoretype pkcs12". 

그래서 내가 명령을 입력을, 그리고 당신이 일을 끝낼하고 기존 키 스토어가 server.private_old에 저장된 말한다. 그러나 keytool -list -keystore server.private을 실행하고 암호를 입력하면 PKCS12 대신 JKS로 표시됩니다. 왜 이런거야? getInstance("JKS");

갱신이
를 사용하는 경우 그리고 keytool -genkey -alias serverprivate -keystore server.private -storetype PKCS12 -keyalg rsa를 사용할 때 잘 작동하는 동안

업데이트는
은 자동으로, 내가 자바 KeyStore store = KeyStore.getInstance("pkcs12");를 사용할 때 오류가 발생하기 때문에, 하나 PKCS12로 변경 아니에요 경고를 표시하지 않지만 keytool -list server.private을 사용할 때 여전히 JKS 키 저장소로 표시됩니다.

Answer 1

keytool이 표시하는 것보다는 버그가있는 것 같습니다. 다음 실험을 고려하십시오.

(편집 : bug report filed)

먼저, 내 JDK 버전은 1.8.0_152입니다 : 이제

excalibur:~ ronan$ java -version 
java version "1.8.0_152" 
Java(TM) SE Runtime Environment (build 1.8.0_152-b16) 
Java HotSpot(TM) 64-Bit Server VM (build 25.152-b16, mixed mode) 

, 당신은 지정된 키 스토어 생성 : 이제

excalibur:~ ronan$ keytool -genkey -alias serverprivate -keystore server.private -keyalg rsa -storepass apassword -keypass apassword 
What is your first and last name? 
    [Unknown]: Art Vandelay 
What is the name of your organizational unit? 
    [Unknown]: Export/Import 
What is the name of your organization? 
    [Unknown]: Vandelay Industries 
What is the name of your City or Locality? 
    [Unknown]: New York 
What is the name of your State or Province? 
    [Unknown]: New York 
What is the two-letter country code for this unit? 
    [Unknown]: US 
Is CN=Art Vandelay, OU=Export/Import, O=Vandelay Industries, L=New York, ST=New York, C=US correct? 
    [no]: yes 


Warning: 
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore server.private -destkeystore server.private -deststoretype pkcs12". 

을, 주어진 지침에 따라 :

excalibur:~ ronan$ keytool -importkeystore -srckeystore server.private -destkeystore server.private -deststoretype pkcs12 
Enter source keystore password: 
Entry for alias serverprivate successfully imported. 
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled 

Warning: 
Migrated "server.private" to Non JKS/JCEKS. The JKS keystore is backed up as "server.private.old". 

그러나 keytool을 사용하여 나열하면 여전히 JKS가 나와 있습니다.

excalibur:~ ronan$ keytool -list -keystore server.private 
Enter keystore password: 
Keystore type: JKS 
Keystore provider: SUN 

Your keystore contains 1 entry 

serverprivate, Dec 4, 2017, PrivateKeyEntry, 
Certificate fingerprint (SHA1): 16:E8:C6:12:7A:F1:7A:B8:64:98:EC:12:C4:07:9E:67:06:BD:DD:BD 

그러나 openssl은 pkcs12로 잘 해석 할 수 있습니다.

excalibur:~ ronan$ openssl pkcs12 -in server.private 
Enter Import Password: 
MAC verified OK 
Bag Attributes 
    friendlyName: serverprivate 
    localKeyID: 54 69 6D 65 20 31 35 31 32 34 31 33 32 30 38 31 38 32 
Key Attributes: <No Attributes> 
Enter PEM pass phrase: 
Bag Attributes 
    friendlyName: serverprivate 
    localKeyID: 54 69 6D 65 20 31 35 31 32 34 31 33 32 30 38 31 38 32 
subject=/C=US/ST=New York/L=New York/O=Vandelay Industries/OU=Export/Import/CN=Art Vandelay 
issuer=/C=US/ST=New York/L=New York/O=Vandelay Industries/OU=Export/Import/CN=Art Vandelay 
-----BEGIN CERTIFICATE----- 
MIIDoTCCAomgAwIBAgIEKSoRITANBgkqhkiG9w0BAQsFADCBgDELMAkGA1UEBhMC 
VVMxETAPBgNVBAgTCE5ldyBZb3JrMREwDwYDVQQHEwhOZXcgWW9yazEcMBoGA1UE 
ChMTVmFuZGVsYXkgSW5kdXN0cmllczEWMBQGA1UECxMNRXhwb3J0L0ltcG9ydDEV 
MBMGA1UEAxMMQXJ0IFZhbmRlbGF5MB4XDTE3MTIwNDE4NDM1NVoXDTE4MDMwNDE4 
NDM1NVowgYAxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhOZXcgWW9yazERMA8GA1UE 
BxMITmV3IFlvcmsxHDAaBgNVBAoTE1ZhbmRlbGF5IEluZHVzdHJpZXMxFjAUBgNV 
BAsTDUV4cG9ydC9JbXBvcnQxFTATBgNVBAMTDEFydCBWYW5kZWxheTCCASIwDQYJ 
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAIwVIy24Hws6ffaEQGhYEyaw2JC4UPLH 
wtSXpJaZf3lrdtbktbLC+zKJ93fFVfoukX5vpnZKxv+f724duAszkVWN3bBrnAwb 
6sh445tXiRhT2eS+z0rHtXwiPWUKOAPOxGUP1Lhfl5ZCPR4bmohyh/daSX1ppT3P 
k6//lf1y2RdsS5hZ5Ltx9dr99/txsv4a1D8uuPDHIf8dvWfOqGb7ywIAlrbh5JsA 
4IWjMVFMpDQ2WM/C+v48y2W7AdgxGD0J/nNC6t4QfAgwhvVyXbiu9IbAR+ivn59E 
VqC83qv4bBkffB3yYk6WSHSl7YloJueWalVAoudf4uHeaNZBLCvbNsMCAwEAAaMh 
MB8wHQYDVR0OBBYEFNOc6gJkUFCSgyHCDFGJmZwtPLgIMA0GCSqGSIb3DQEBCwUA 
A4IBAQAVyc6j9U+va5U02MxsjDE6LWDPg+0FaqpTAQlU6xhVrZlKWuX+Dup4PF6S 
s4oqhInb7XcGOjbLkVTnuEY5mwfHnyGqNhmyyUwJOVrWZJWBZADvhdcZi0w/jclg 
jAb7dP1VssR4Ozgsd1XkGxnS7P8e344xpjQd1krPc1Od7qhFSF6FufTDvgEcrmx/ 
qrHpLpwoYPTyuv+NtD+7KlWINqWq5PT1olydd6ki8O+bTsgDuy8rnvqd/jJ7dsuv 
VLNc+IDEEMO26hS8d1WkppTTuLrayE07LCV8df68WHv6KumDSc5Mb0zOUdLqZUDQ 
Wmxbt0kEAAG6jgbpACBpGEqtAtTs 
-----END CERTIFICATE----- 

다음 자바 스 니펫은이를 구문 분석 할 수도 있습니다.

import java.io.FileInputStream; 
import java.security.KeyStore; 
import java.util.Collections; 

public class Main { 
    public static void main(String[] args) throws Exception { 
     KeyStore pkcs12 = KeyStore.getInstance("PKCS12"); 
     pkcs12.load(new FileInputStream("../../../server.private"), "apassword".toCharArray()); 
     for (String alias : Collections.list(pkcs12.aliases())) { 
      System.out.println(alias); 
     } 
    } 
} 

및 출력은

serverprivate