如何将SSL证书与私钥加载到Java KeyStore并使用Apache HttpClient发起HTTPS POST请求

我拥有一个证书文件（.crt）和一个私钥文件，需要通过编程方式将这些文件加载到Java KeyStore中，并使用Apache HttpClient发起安全的HTTP POST请求。

• 证书格式：标准的BEGIN CERTIFICATE开头，后跟Base64编码字符串。
• 私钥格式：BEGIN RSA PRIVATE KEY开头，后跟Base64编码字符串。

我已搜索相关解决方案，但大多指向外部工具或不符合我的特定场景。以下是我尝试的代码，但未能成功：

KeyStore KeyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(null, null);
try (FileOutputStream fos = new FileOutputStream("keyStore.jks"))
{
    keyStore.store(fos, null);
}

KeyStore ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream("keyStore.jks"), null);

byte[] data = amazonS3Configuration
        .downloadFile(KeyFilePath + "/"
                + CertificatePath);
ByteArrayInputStream targetStream = new ByteArrayInputStream(data);
Certificate certificate =
        CertificateFactory.getInstance("X.509").generateCertificate(targetStream);
ks.setCertificateEntry("clientCertificate", certificate);
ks.store(new FileOutputStream("keyStore.jks"), null);

Security.addProvider(new BouncyCastleProvider());

//storing private key
byte[] privateKeyData = amazonS3Configuration
        .downloadFile(soapKeyFilePath + "/"
                + KeyFilePath);

KeyFactory keyFactory = KeyFactory.getInstance("RSA","BC");
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(privateKeyData);
PrivateKey privateKey = keyFactory.generatePrivate(privateKeySpec);
System.out.println("Private Key: " + privateKey);
ks.setKeyEntry("privateKey", privateKey, null, null);

我需要以下方面的指导或代码示例：

1. 将证书和私钥从文件加载到Java KeyStore中。
2. 配置用于安全通信的SSLContext。
3. 使用Apache HttpClient通过该SSLContext发起HTTP POST请求。

解决方案 #

一、加载证书和私钥到KeyStore #

你的核心问题是私钥格式不匹配：BEGIN RSA PRIVATE KEY属于PKCS#1格式，而PKCS8EncodedKeySpec需要PKCS#8格式的私钥。此外无需提前创建磁盘JKS文件，直接在内存中操作更高效。

import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

import java.io.ByteArrayInputStream;
import java.io.StringReader;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;

// 提前注册BouncyCastle提供者
static {
    Security.addProvider(new BouncyCastleProvider());
}

public static KeyStore loadKeyStore(byte[] certBytes, byte[] privateKeyBytes) throws Exception {
    // 1. 加载X.509证书
    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
    Certificate cert = certFactory.generateCertificate(new ByteArrayInputStream(certBytes));

    // 2. 解析PKCS#1格式的RSA私钥
    String privateKeyPem = new String(privateKeyBytes);
    PEMParser pemParser = new PEMParser(new StringReader(privateKeyPem));
    Object pemObject = pemParser.readObject();
    JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
    PrivateKey privateKey = converter.getPrivateKey((PrivateKeyInfo) pemObject);

    // 3. 初始化内存KeyStore并添加私钥和证书链
    KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
    keyStore.load(null, null);
    // 私钥条目需关联对应证书链，密码可自定义
    keyStore.setKeyEntry("client-identity", privateKey, "custom-pass".toCharArray(), new Certificate[]{cert});

    return keyStore;
}

二、配置SSLContext #

通过KeyStore构建密钥管理器，进而创建用于HTTPS通信的SSLContext：

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;

public static SSLContext createSSLContext(KeyStore keyStore) throws Exception {
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(keyStore, "custom-pass".toCharArray()); // 与KeyStore设置的密码保持一致

    SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
    // 信任管理器使用默认，若需自定义信任服务器证书可传入自定义TrustManager数组
    sslContext.init(kmf.getKeyManagers(), null, null);

    return sslContext;
}

三、使用Apache HttpClient发起HTTPS POST请求 #

以下示例基于HttpClient 5.x版本（4.x版本API略有差异）：

import org.apache.hc.client5.http.classic.methods.HttpPost;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.CloseableHttpResponse;
import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
import org.apache.hc.core5.http.HttpEntity;
import org.apache.hc.core5.http.io.entity.EntityUtils;
import org.apache.hc.core5.http.io.entity.StringEntity;

public static void sendHttpsPost(SSLContext sslContext, String url, String requestBody) throws Exception {
    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext);

    CloseableHttpClient httpClient = HttpClients.custom()
            .setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
                    .setSSLSocketFactory(sslSocketFactory)
                    .build())
            .build();

    try {
        HttpPost httpPost = new HttpPost(url);
        // 根据实际请求格式设置Content-Type
        httpPost.setEntity(new StringEntity(requestBody, "UTF-8"));
        httpPost.setHeader("Content-Type", "application/json");

        try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
            HttpEntity entity = response.getEntity();
            if (entity != null) {
                String responseBody = EntityUtils.toString(entity);
                System.out.println("响应内容：" + responseBody);
                EntityUtils.consume(entity);
            }
        }
    } finally {
        httpClient.close();
    }
}

关键依赖说明 #

确保引入BouncyCastle依赖（Maven示例）：

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.70</version>
</dependency>
<dependency>
    <groupId>org.apache.httpcomponents.client5</groupId>
    <artifactId>httpclient5</artifactId>
    <version>5.2.1</version>
</dependency>

内容的提问来源于stack exchange，提问作者Mahesh kanade