从ca提取keystore_Java获取受信任的根证书列表的方法

import java.io.File;

import java.io.FileInputStream;

import java.io.IOException;

import java.security.InvalidAlgorithmParameterException;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.NoSuchAlgorithmException;

import java.security.cert.CertificateException;

import java.security.cert.PKIXParameters;

import java.security.cert.TrustAnchor;

import java.security.cert.X509Certificate;

import java.util.Iterator;

public class Demo {

public static void main(String[] args) {

try {

// 加载JDK的cacerts keystore文件

String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar);

FileInputStream is = new FileInputStream(filename);

KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());

String password = "changeit";

keystore.load(is, password.toCharArray());

//此类用于从keystore遍历出受信的CA

PKIXParameters params = new PKIXParameters(keystore);

// 获取包含受信的CA证书的一组信任锚点

Iterator it = params.getTrustAnchors().iterator();

while( it.hasNext() ) {

TrustAnchor ta = (TrustAnchor)it.next();

// 获取证书

X509Certificate cert = ta.getTrustedCert();

System.out.println(cert);

}

} catch (CertificateException e) {

} catch (KeyStoreException e) {

} catch (NoSuchAlgorithmException e) {

} catch (InvalidAlgorithmParameterException e) {

} catch (IOException e) {

}

}

主要方式读取keystore文件，从keystore里读取出受信的CA