下面的代码可以生成安全证书

package test.keystore;

import java.io.BufferedReader;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStream;

import java.security.KeyStore;

import java.security.MessageDigest;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLSocket;

import javax.net.ssl.SSLSocketFactory;

import javax.net.ssl.TrustManager;

import javax.net.ssl.TrustManagerFactory;

import javax.net.ssl.X509TrustManager;

/**

* 安装证书

*

* @author 单红宇(365384722)

* @myblog http://blog.csdn.net/catoop/

* @create 2016年4月14日

*/

public class InstallCert {

// 我们要访问的HTTPS服务，如访问 https://www.shanhy.com

public static final String hostName = www.bttt.la;

public static void main(String args) throws Exception {

args = new String{hostName};

String host;

int port;

char passphrase;

if ((args.length == 1) || (args.length == 2)) {

String c = args.split(:);

host = c;

port = (c.length == 1) ? 443 : Integer.parseInt(c);

String p = (args.length == 1) ? changeit : args;

passphrase = p.toCharArray();

} else {

System.out.println(Usage: java InstallCert host );

return;

}

File file = new File(jssecacerts);

if (file.isFile() == false) {

char SEP = File.separatorChar;

File dir = new File(System.getProperty(java.home) + SEP + lib + SEP + security);

file = new File(dir, jssecacerts);

if (file.isFile() == false) {

file = new File(dir, cacerts);

}

}

System.out.println(Loading KeyStore + file + ...);

InputStream in = new FileInputStream(file);

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

ks.load(in, passphrase);

in.close();

SSLContext context = SSLContext.getInstance(TLS);

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

tmf.init(ks);

X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers();

SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);

context.init(null, new TrustManager { tm }, null);

SSLSocketFactory factory = context.getSocketFactory();

System.out.println(Opening connection to + host + : + port + ...);

SSLSocket socket = (SSLSocket) factory.createSocket(host, port);

socket.setSoTimeout(10000);

try {

System.out.println(Starting SSL handshake...);

socket.startHandshake();

socket.close();

System.out.println();

System.out.println(No errors, certificate is already trusted);

} catch (SSLException e) {

System.out.println();

e.printStackTrace(System.out);

}

X509Certificate chain = tm.chain;

if (chain == null) {

System.out.println(Could not obtain server certificate chain);

return;

}

BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));

System.out.println();

System.out.println(Server sent + chain.length + certificate(s):);

System.out.println();

MessageDigest sha1 = MessageDigest.getInstance(SHA1);

MessageDigest md5 = MessageDigest.getInstance(MD5);

for (int i = 0; i chain.length; i++) {

X509Certificate cert = chain;

System.out.println( + (i + 1) + Subject + cert.getSubjectDN());

System.out.println( Issuer + cert.getIssuerDN());

sha1.update(cert.getEncoded());

System.out.println( sha1 + toHexString(sha1.digest()));

md5.update(cert.getEncoded());

System.out.println( md5 + toHexString(md5.digest()));

System.out.println();

}

System.out.println(Enter certificate to add to trusted keystore or q to quit: );

String line = reader.readLine().trim();

int k;

try {

k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;

} catch (NumberFormatException e) {

System.out.println(KeyStore not changed);

return;

}

X509Certificate cert = chain;

String alias = host + - + (k + 1);

ks.setCertificateEntry(alias, cert);

OutputStream out = new FileOutputStream(jssecacerts);

ks.store(out, passphrase);

out.close();

System.out.println();

System.out.println(cert);

System.out.println();

System.out.println(Added certificate to keystore jssecacerts using alias + alias + );

}

private static final char HEXDIGITS = 0123456789abcdef.toCharArray();

private static String toHexString(byte bytes) {

StringBuilder sb = new StringBuilder(bytes.length * 3);

for (int b : bytes) {

b = 0xff;

sb.append(HEXDIGITS);

sb.append(HEXDIGITS);

sb.append( );

}

return sb.toString();

}

private static class SavingTrustManager implements X509TrustManager {

private final X509TrustManager tm;

private X509Certificate chain;

SavingTrustManager(X509TrustManager tm) {

this.tm = tm;

}

public X509Certificate getAcceptedIssuers() {

throw new UnsupportedOperationException();

}

public void checkClientTrusted(X509Certificate chain, String authType) throws CertificateException {

throw new UnsupportedOperationException();

}

public void checkServerTrusted(X509Certificate chain, String authType) throws CertificateException {

this.chain = chain;

tm.checkServerTrusted(chain, authType);

}

}

}

以上代码运行后可能或出现错误信息，如下图：

然后输入1并回车，也会打印一些信息，然后文件就生成了。

我是在eclipse中运行的，生成的证书是在workspace中的项目目录中

文件名：jssecacerts

复制该文件到%JAVA_HONME%\\jre\\lib\ecurity\\目录中。

jssecacerts 其实是一个证书库，根据上面的代码生成后里面只有一个网站的证书，如果还要加入其它网站的证书，需要要到java keytool命令

keytool -import -alias 别名 -file cer证书路径 -keystore /usr/lib/jdk1.8/jre/lib/security/jssecacerts

执行之后会让输入密码：默认是changeit

查看：

keytool -list -keystore /usr/lib/jdk1.8/jre/lib/security/jssecacerts | findstr /i 别名

在linux 下 findstr命令好像不管用，

只知道是这样用，也不是很明白其中的原理，也希望知道的朋友可以指导一下