archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-26 22:34:27 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8192988: keytool should support -storepasswd for pkcs12 keystores

Browse source 
Reviewed-by: mullan
This commit is contained in:
Weijun Wang 2017-12-14 20:19:34 +08:00
parent d7e6bad25c
commit b01627c0e4
4 changed files with 308 additions and 129 deletions
Download patch file Download diff file Expand all files Collapse all files

37
src/java.base/share/classes/sun/security/tools/keytool/Main.java
View file

@ -1058,11 +1058,6 @@ public final class Main {
System.err.println(form.format(source));
keyPass = storePass;
}
if (newPass != null && !Arrays.equals(storePass, newPass)) {
Object[] source = {"-new"};
System.err.println(form.format(source));
newPass = storePass;
}
if (destKeyPass != null && !Arrays.equals(storePass, destKeyPass)) {
Object[] source = {"-destkeypass"};
System.err.println(form.format(source));
@ -1243,10 +1238,7 @@ public final class Main {
doSelfCert(alias, dname, sigAlgName);
kssave = true;
} else if (command == STOREPASSWD) {
storePassNew = newPass;
if (storePassNew == null) {
storePassNew = getNewPasswd("keystore password", storePass);
}
doChangeStorePasswd();
kssave = true;
} else if (command == GENCERT) {
if (alias == null) {
@ -2258,8 +2250,9 @@ public final class Main {
newPass = destKeyPass;
pp = new PasswordProtection(destKeyPass);
} else if (objs.snd != null) {
newPass = objs.snd;
pp = new PasswordProtection(objs.snd);
newPass = P12KEYSTORE.equalsIgnoreCase(storetype) ?
storePass : objs.snd;
pp = new PasswordProtection(newPass);
}
try {
@ -2762,6 +2755,28 @@ public final class Main {
}
}
}
private void doChangeStorePasswd() throws Exception {
storePassNew = newPass;
if (storePassNew == null) {
storePassNew = getNewPasswd("keystore password", storePass);
}
if (P12KEYSTORE.equalsIgnoreCase(storetype)) {
// When storetype is PKCS12, we need to change all keypass as well
for (String alias : Collections.list(keyStore.aliases())) {
if (!keyStore.isCertificateEntry(alias)) {
// keyPass should be either null or same with storePass,
// but keep it in case one day we want to "normalize"
// a PKCS12 keystore having different passwords.
Pair<Entry, char[]> objs
= recoverEntry(keyStore, alias, storePass, keyPass);
keyStore.setEntry(alias, objs.fst,
new PasswordProtection(storePassNew));
}
}
}
}
/**
* Creates a self-signed certificate, and stores it as a single-element
* certificate chain.