如何获得Java中受信任根证书的列表？

Question

我希望能够在Java应用程序中以编程方式访问所有受信任的根证书。

我在看keystore接口，但我希望获得JRE隐含的可信根的列表。

这可以在任何地方访问吗？

Answer 1

在Example Depot中有一个示例，显示如何获取一组根证书并遍历它们，名为Listing the Most-Trusted Certificate Authorities (CA) in a Key Store。这是一个稍作修改的版本，可打印出每个证书（在Windows Vista上测试）。

import java.io.File; 
import java.io.FileInputStream; 
import java.io.IOException; 
import java.security.InvalidAlgorithmParameterException; 
import java.security.KeyStore; 
import java.security.KeyStoreException; 
import java.security.NoSuchAlgorithmException; 
import java.security.cert.CertificateException; 
import java.security.cert.PKIXParameters; 
import java.security.cert.TrustAnchor; 
import java.security.cert.X509Certificate; 
import java.util.Iterator; 


public class Main { 

    public static void main(String[] args) { 
     try { 
      // Load the JDK's cacerts keystore file 
      String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar); 
      FileInputStream is = new FileInputStream(filename); 
      KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType()); 
      String password = "changeit"; 
      keystore.load(is, password.toCharArray()); 

      // This class retrieves the most-trusted CAs from the keystore 
      PKIXParameters params = new PKIXParameters(keystore); 

      // Get the set of trust anchors, which contain the most-trusted CA certificates 
      Iterator it = params.getTrustAnchors().iterator(); 
      while(it.hasNext()) { 
       TrustAnchor ta = (TrustAnchor)it.next(); 
       // Get certificate 
       X509Certificate cert = ta.getTrustedCert(); 
       System.out.println(cert); 
      } 
     } catch (CertificateException e) { 
     } catch (KeyStoreException e) { 
     } catch (NoSuchAlgorithmException e) { 
     } catch (InvalidAlgorithmParameterException e) { 
     } catch (IOException e) { 
     } 
    } 
} 

Answer 2

这应该使用系统默认的信任存储来获取所有证书更灵活：

TrustManagerFactory trustManagerFactory = 
    TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); 
List<Certificate> x509Certificates = new ArrayList<>(); 
trustManagerFactory.init((KeyStore)null);     
Arrays.asList(trustManagerFactory.getTrustManagers()).stream().forEach(t -> { 
        x509Certificates.addAll(Arrays.asList(((X509TrustManager)t).getAcceptedIssuers())); 
       }); 

```