Spring应用启动时访问PFX文件提示SSL密码错误求助

启动Spring应用时，因访问SSL所用的PFX文件密码错误导致启动失败。已使用application.yaml中存储的相同密码，通过IntelliJ插件成功打开该PFX文件，需要排查问题原因。

更新信息 #

• Spring基于Java 21运行，PFX文件由OpenSSL 3.0.2（2022年3月15日版本）生成。

OpenSSL信息 #

openssl pkcs12 -in MyComputer.pfx -info -noout
Enter Import Password:
MAC: sha256, Iteration 2048
MAC length: 32, salt length: 8
PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256
Certificate bag
Certificate bag
PKCS7 Data
Shrouded Keybag: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256

application.yaml配置 #

server:
  port: 8043
  ssl:
    enabled: true
    key-store-type: PKCS12
    key-store: classpath:keystore/${COMPUTERNAME}.pfx
    key-store-password: secure
    key-alias: ${COMPUTERNAME}

启动日志片段 #

Caused by: java.lang.IllegalStateException: Unable to create key store: Could not load store from 'classpath:keystore/XXXXXX.pfx'
    at org.springframework.boot.ssl.jks.JksSslStoreBundle.createKeyStore(JksSslStoreBundle.java:94) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.ssl.jks.JksSslStoreBundle.<init>(JksSslStoreBundle.java:57) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.server.WebServerSslBundle.createJksKeyStoreBundle(WebServerSslBundle.java:90) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.server.WebServerSslBundle.createKeyStore(WebServerSslBundle.java:189) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.server.WebServerSslBundle.createStoreBundle(WebServerSslBundle.java:179) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.server.WebServerSslBundle.get(WebServerSslBundle.java:174) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.getSslBundle(AbstractConfigurableWebServerFactory.java:225) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.customizeSsl(TomcatServletWebServerFactory.java:373) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.customizeConnector(TomcatServletWebServerFactory.java:349) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getWebServer(TomcatServletWebServerFactory.java:210) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.createWebServer(ServletWebServerApplicationContext.java:188) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:162) ~[spring-boot-3.2.5.jar:3.2.5]
    ... 11 common frames omitted
Caused by: java.lang.IllegalStateException: Could not load store from 'classpath:keystore/XXXXXX.pfx'
    at org.springframework.boot.ssl.jks.JksSslStoreBundle.loadKeyStore(JksSslStoreBundle.java:123) ~[spring-boot-3.2.5.jar:3.2.5]
    at org.springframework.boot.ssl.jks.JksSslStoreBundle.createKeyStore(JksSslStoreBundle.java:89) ~[spring-boot-3.2.5.jar:3.2.5]
    ... 22 common frames omitted
Caused by: java.io.IOException: keystore password was incorrect
    at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:2097) ~[na:na]
    at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:228) ~[na:na]
    at java.base/java.security.KeyStore.load(KeyStore.java:1500) ~[na:na]
    at org.springframework.boot.ssl.jks.JksSslStoreBundle.loadKeyStore(JksSslStoreBundle.java:119) ~[spring-boot-3.2.5.jar:3.2.5]
    ... 23 common frames omitted

排查建议 #

• 确认环境变量COMPUTERNAME是否正确解析：启动时打印该变量值，检查应用实际加载的PFX文件名是否和预期一致，避免因变量未正确加载导致读取错误文件。
• 检查密码是否包含YAML特殊字符：如果密码里有#、:、空格等特殊字符，必须用双引号包裹（比如key-store-password: "secure@123#"），否则YAML解析器会错误处理密码内容。
• 验证PFX的密钥库密码和密钥密码是否一致：OpenSSL生成PFX时可能分别设置了密钥库密码和密钥密码，Spring默认用key-store-password作为密钥密码，若两者不同，需要额外添加key-password配置项并设置正确值。
• 重新导出PFX文件：用OpenSSL重新导出时指定兼容Java的参数，示例命令：

  openssl pkcs12 -export -in cert.pem -inkey key.pem -out new.pfx -name ${COMPUTERNAME} -password pass:secure
  

• 测试绝对路径加载：暂时把key-store的路径替换为本地绝对路径（比如file:/C:/projects/keystore/MyComputer.pfx），排除类路径资源加载的问题。

内容的提问来源于stack exchange，提问作者Timothy Vogel