java 删除证书,如何从Java密钥库中的证书链中仅删除一个证书

I have a Tomcat server with a certificate chain for HTTPS stored in a Java keystore. The chain includes the self-signed root CA certificate. Although this is apparently okay by the TLS spec, some validation services warn about it, and it's probably better to leave it off.

How can I edit the keystore to remove just the self-signed root CA certificate, but leave the rest of the chain and the private key intact?

解决方案

First, convert the keystore from JKS to PKCS12 (this and other commands will require password entry):

keytool -importkeystore -srckeystore old.jks -destkeystore old.p12 -deststoretype pkcs12

Next, export a PEM file with key and certs from the PKCS12 file:

openssl pkcs12 -in old.p12 -out pemfile.pem -nodes

Now simply use a text editor to edit pemfile.pem and remove the offending certificate (and its preceding "Bag Attributes").

Next, load the edited PEM file into a new PKCS12 file. You'll need to give the cert/key the appropriate keystore alias, e.g. "tomcat", at this point.

openssl pkcs12 -export -in pemfile.pem -name tomcat -out new.p12

Finally, convert back from PKCS12 to JKS:

keytool -importkeystore -srckeystore new.p12 -destkeystore new.jks -srcstoretype pkcs12

The file new.jks is what you want.