1. Overview
1.概述
In this quick tutorial, we’ll provide an overview of the differences between a Java keystore and a Java truststore.
在这个快速教程中，我们将概述Java密钥库和Java信任库之间的区别。
2. Concepts
2.概念
In most cases, we use a keystore and a truststore when our application needs to communicate over SSL/TLS.
在大多数情况下，当我们的应用程序需要通过SSL/TLS进行通信时，我们使用一个密钥库和一个信任库。
Usually, these are password-protected files that sit on the same file system as our running application. The default format used for these files was JKS until Java 8.
通常，这些都是受密码保护的文件，与我们正在运行的应用程序位于同一个文件系统中。这些文件的默认格式是JKS，直到Java 8。
Since Java 9, the default keystore format is PKCS12. The biggest difference between JKS and PKCS12 is that JKS is a format specific to Java, while PKCS12 is a standardized and language-neutral way of storing encrypted private keys and certificates.
从Java 9开始，默认的密钥库格式是PKCS12。JKS和PKCS12之间最大的区别是，JKS是Java特有的格式，而PKCS12是一种标准化的、不分语言的加密私钥和证书的存储方式。
3. Java KeyStore
3.Java KeyStore
A Java keystore stores private key entries, certificates with public keys, or just secret keys that we may use for various cryptographic purposes. It stores each by an alias for ease of lookup.
Java密钥库存储了我们可能用于各种加密目的的私钥条目、带有公钥的证书或只是秘密密钥。它用一个别名来存储每个条目，以方便查找。
Generally speaking, keystores hold keys that our application owns, which we can use to prove the integrity of a message and the authenticity of the sender, say by signing payloads.
一般来说，钥匙库持有我们的应用程序拥有的钥匙，我们可以用它来证明信息的完整性和发送者的真实性，比如说通过签署有效载荷。
Usually, we’ll use a keystore when we’re a server and want to use HTTPS. During an SSL handshake, the server looks up the private key from the keystore, and presents its corresponding public key and certificate to the client.
通常情况下，当我们是一个服务器并想使用HTTPS时，我们会使用一个密钥库。在SSL握手过程中，服务器从钥匙库中查找私钥，并将其相应的公钥和证书交给客户端。
Similarly, if the client also needs to authenticate itself, a situation called mutual authentication, then the client also has a keystore and also presents its public key and certificate.
同样，如果客户端也需要认证自己，这种情况称为相互认证，那么客户端也有一个密钥库，也会出示其公钥和证书。
There’s no default keystore, so if we want to use an encrypted channel, we’ll have to set javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword. If our keystore format is different than the default, we could use javax.net.ssl.keyStoreType to customize it.
没有默认的keystore，所以如果我们想使用加密通道，我们必须设置javax.net.ssl.keyStore和javax.net.ssl.keyStorePassword.如果我们的keystore格式与默认不同，我们可以使用javax.net.ssl.keyStoreType来定制它。
Of course, we can use these keys to service other needs as well. Private keys can sign or decrypt data, and public keys can verify or encrypt data. Secret keys can perform these functions as well. A keystore is a place that we can hold onto these keys.
当然，我们也可以用这些钥匙为其他需求服务。私钥可以签署或解密数据，公钥可以验证或加密数据。秘密密钥也可以执行这些功能。钥匙库是一个我们可以保存这些钥匙的地方。
We can also interact with the keystore programmatically.
我们还可以以编程方式与钥匙库互动。
4. Java TrustStore
4.Java TrustStore
A truststore is the opposite. While a keystore typically holds onto certificates that identify us, a truststore holds onto certificates that identify others.
信任库则正好相反。钥匙库通常持有识别我们的证书，而信托库则持有识别他人的证书。
In Java, we use it to trust the third party we’re about to communicate with.
在Java中，我们用它来信任我们即将与之通信的第三方。。
Take our earlier example. If a client talks to a Java-based server over HTTPS, the server will look up the associated key from its keystore and present the public key and certificate to the client.
以我们前面的例子为例。如果一个客户通过HTTPS与一个基于Java的服务器交谈，服务器将从其密钥库中查找相关的密钥，并将公钥和证书呈现给客户。
We, the client, then look up the associated certificate in our truststore. If the certificate or Certificate Authorities presented by the external server isn’t in our truststore, we’ll get an SSLHandshakeException, and the connection won’t be set up successfully.
我们，客户端，然后在我们的信任库中查找相关的证书。如果外部服务器提交的证书或证书授权机构不在我们的信任库中，我们将得到一个SSLHandshakeException，并且连接将不会被成功建立。
Java has bundled a truststore called cacerts, and it resides in the $JAVA_HOME/jre/lib/security directory.
Java捆绑了一个名为cacerts的信任库，它位于$JAVA_HOME/jre/lib/security目录。
It contains default, trusted Certificate Authorities:
它包含默认的、受信任的证书颁发机构。
$ keytool -list -keystore cacerts
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 92 entries
verisignclass2g2ca [jdk], 2018-06-13, trustedCertEntry,
Certificate fingerprint (SHA1): B3:EA:C4:47:76:C9:C8:1C:EA:F2:9D:95:B6:CC:A0:08:1B:67:EC:9DWe can see here that the truststore contains 92 trusted certificate entries and one of the entries is the verisignclass2gca entry. This means that the JVM will automatically trust certificates signed by verisignclass2g2ca.
我们在这里可以看到，信任商店包含92个受信任的证书条目，其中一个条目是verisignclass2gca条目。这意味着JVM将自动信任由verisignclass2g2ca签署的证书。
We can override the default truststore location via the javax.net.ssl.trustStore property. Similarly, we can set javax.net.ssl.trustStorePassword and javax.net.ssl.trustStoreType to specify the truststore’s password and type.
我们可以通过javax.net.ssl.trustStore属性覆盖默认的truststore位置。同样，我们可以设置javax.net.ssl.trustStorePassword和javax.net.ssl.trustStoreType来指定信任仓库的密码和类型。
5. Conclusion
5.总结
In this article, we discussed the main differences between the Java keystore and the Java truststore, along with their purposes.
在这篇文章中，我们讨论了Java keystore和Java truststore的主要区别，以及它们的用途。
We also learned how the defaults can be overridden with system properties.
我们还学习了如何用系统属性来覆盖默认值。
To dive deeper into encrypted communication in Java, we can have a look at the following SSL guide or the JSSE Reference Guide.