1. Overview

1.概述

A KeyStore, as the name suggests, is basically a repository of certificates, public and private keys. Moreover, JDK distributions are shipped with an executable to help manage them, the keytool.

顾名思义，KeyStore基本上是一个证书、公钥和私钥的存储库。此外，JDK 发行版附带了一个可执行文件来帮助管理它们，即 keytool.。

On the other hand, certificates can have many extensions, but we need to keep in mind that a .cer file contains public X.509 keys and thus it can be used only for identity verification.

另一方面，证书可以有许多扩展名，但我们需要记住，.cer文件包含公开的X.509密钥，因此它只能用于身份验证。

In this short article, we’ll take a look at how to import a .cer file into a Java KeyStore.

在这篇短文中，我们将看看如何将.cer文件导入到Java KeyStore中。

2. Importing a Certificate

2.导入证书

Without further ado, let’s now import the Baeldung public certificate file inside a sample KeyStore.

闲话少说，现在让我们把Baeldung的公共证书文件导入到样本的KeyStore中。

The keytool has many options but the one we’re interested in is importcert which is as straightforward as its name. Since there are usually different entries inside a KeyStore, we’ll have to use the alias argument to assign it a unique name:

keytool有许多选项，但我们感兴趣的是importcert，它和它的名字一样简单明了。由于一个KeyStore里面通常有不同的条目，我们必须使用alias参数来给它指定一个唯一的名字。

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore
> Enter keystore password:
...
> Trust this certificate? [no]:  y
> Certificate was added to keystore

Although the command prompts for a password and a confirmation, we can bypass them by adding the storepass and noprompt arguments. This comes especially handy when running keytool from a script:

虽然该命令提示密码和确认，但我们可以通过添加storepass和noprompt参数绕过它们。这在从脚本中运行keytool时特别方便。

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storepass pass123 -noprompt
> Certificate was added to keystore

Furthermore, if the KeyStore doesn’t exist, it’ll be automatically generated. In this case, we can set the format through the storetype argument. If not specified, the KeyStore format defaults to JKS if we’re using Java 8 or older. From Java 9 on it defaults to PKCS12:

此外，如果KeyStore不存在，它将被自动生成。在这种情况下，我们可以通过storetype参数设置格式。如果没有指定，如果我们使用的是Java 8或更高版本，KeyStore格式默认为JKS。从Java 9开始，它默认为PKCS12。

> keytool -importcert -alias baeldung_public_cert -file baeldung.cer -keystore sample_keystore -storetype PKCS12
> Enter keystore password:
> Re-enter new password:
...
> Trust this certificate? [no]: y
> Certificate was added to keystore

Here we’ve created a PKCS12 KeyStore. The main difference between JKS and PKCS12 is that JKS is a Java-specific format, while PKCS12 is a standardized way of storing keys and certificates

这里我们创建了一个PKCS12 KeyStore。JKS和PKCS12的主要区别在于，JKS是一种Java特有的格式，而PKCS12是一种存储钥匙和证书的标准化方式。

In case we need, we can also perform these operations programmatically.

如果我们需要，我们也可以通过编程执行这些操作。

3. Conclusion

3.结论

In this tutorial, we went through how to import a .cer file inside a KeyStore. In order to do that, we used the keytool’s importcert option.

在本教程中，我们学习了如何将.cer文件导入钥匙库中。为了做到这一点，我们使用了 keytool 的 importcert 选项。