如何獲得Java中受信任根證書的列表？

Question

我希望能夠在Java應用程序中以編程方式訪問所有受信任的根證書。

我在看keystore接口，但我希望獲得JRE隱含的可信根的列表。

這可以在任何地方訪問嗎？

Answer 1

在Example Depot中有一個示例，顯示如何獲取一組根證書並遍歷它們，名爲Listing the Most-Trusted Certificate Authorities (CA) in a Key Store。這是一個稍作修改的版本，可打印出每個證書（在Windows Vista上測試）。

import java.io.File; 
import java.io.FileInputStream; 
import java.io.IOException; 
import java.security.InvalidAlgorithmParameterException; 
import java.security.KeyStore; 
import java.security.KeyStoreException; 
import java.security.NoSuchAlgorithmException; 
import java.security.cert.CertificateException; 
import java.security.cert.PKIXParameters; 
import java.security.cert.TrustAnchor; 
import java.security.cert.X509Certificate; 
import java.util.Iterator; 


public class Main { 

    public static void main(String[] args) { 
     try { 
      // Load the JDK's cacerts keystore file 
      String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar); 
      FileInputStream is = new FileInputStream(filename); 
      KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType()); 
      String password = "changeit"; 
      keystore.load(is, password.toCharArray()); 

      // This class retrieves the most-trusted CAs from the keystore 
      PKIXParameters params = new PKIXParameters(keystore); 

      // Get the set of trust anchors, which contain the most-trusted CA certificates 
      Iterator it = params.getTrustAnchors().iterator(); 
      while(it.hasNext()) { 
       TrustAnchor ta = (TrustAnchor)it.next(); 
       // Get certificate 
       X509Certificate cert = ta.getTrustedCert(); 
       System.out.println(cert); 
      } 
     } catch (CertificateException e) { 
     } catch (KeyStoreException e) { 
     } catch (NoSuchAlgorithmException e) { 
     } catch (InvalidAlgorithmParameterException e) { 
     } catch (IOException e) { 
     } 
    } 
} 

Answer 2

這應該使用系統默認的信任存儲來獲取所有證書更靈活：

TrustManagerFactory trustManagerFactory = 
    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); 
List<Certificate> x509Certificates = new ArrayList<>(); 
trustManagerFactory.init((KeyStore)null);     
Arrays.asList(trustManagerFactory.getTrustManagers()).stream().forEach(t -> { 
        x509Certificates.addAll(Arrays.asList(((X509TrustManager)t).getAcceptedIssuers())); 
       }); 

```