In addition here's my codes,
-
// The certificate files, to be added to keystore
FileInputStream certFile1 = new FileInputStream("root.cer");
FileInputStream certFile2 = new FileInputStream("cacert.cer");
FileInputStream certFile3 = new FileInputStream("userCert1.cer");
CertificateFactory cf = CertificateFactory.getInstance("X.509");
Certificate[] cert_arry = new Certificate[3];
// Read the 3 certificates into memory
cert_arry[0] = cf.generateCertificate(certFile1);
cert_arry[1] = cf.generateCertificate(certFile2);
cert_arry[2] = cf.generateCertificate(certFile3);
// Read the keystore file, type="jks"
KeyStore ks = KeyStore.getInstance("jks");
ks.load(null, null);
// Add certificates hierachy to keystore
ks.setCertificateEntry("ROOTCACERT", cert_arry[0]);
ks.setCertificateEntry("CACERT", cert_arry[1]);
ks.setCertificateEntry("USERCERT", cert_arry[2]);
// I want to do below, but it won't works.
Certificate[] cert_chain = ks.getCertificateChain("USERCERT");
Thanks.
I don't understand the question and I also don't understand what exactly you're trying to to.
The keytool, and the KeyStore API, have two distinct certificate-importing operations:
(a) import a signed CSR reply in association with an existing private key, in other words associate a signed cert-chain with a private key
(b) import someone else's trusted certificate(s).
You seem to be doing (b). But you can only get a certificate chain for (a) from KeyStore, i.e. a certificate chain starting with a cert for which you have the private key and containing all the certs of the signers. A certificate chain of someone else's public certificates that you trust has no application that I can think of. So I don't understand what the actual task is here.
Hi ejp,
Thanks again for your comments,
I fully understand what you are trying to say. I'll brief what I am now trying to do.
At MHP(DVB Data Broadcasting Spec.) has a getSingers api( see articles on that : http://forum.java.sun.com/thread.jspa?threadID=663130&messageID=3888155) for Certificate Chain information.
Data Broadcating Application usually comes with certificate chain information for Signing aplication's contents. And reciever must store that certificate chain for later use.
This is my real purpose, and I hope to use keystore or any other repository to store certificate chain information .
Sincerely.