PKCS#12 : DerInputStream.getLength() exception

问题:

I generate a certificate using the keytool command:

keytool -genkeypair -alias myRSAKey -keyalg RSA -keysize 1024 -keystore test.p12 -storepass test -storetype pkcs12

Then if I try to load it using java security API, after getting the file as a byte[] :

KeyStore ks = KeyStore.getInstance("PKCS12");
try{
   ks.load(new ByteArrayInputStream(data), "test".toCharArray())
} catch (Exception e){
   ...
}

I get a DerInputStream.getLength(): lengthTag=127, too big exception.

What is wrong?

回答1:

I had this problem and I've searched the depths of google and still couldn't find the answer. After some days battling with a terrible quality legacy code, I found what was causing this error.

KeyStore.load(InputStream is, String pass);

this method takes an InputStream and if there's any problem with such InputStream, this exception is thrown, some problems that I've encountered:

• The InputStream points to the wrong / blank / just created file
• The InputStream is already open or something else is holding the resource
• The InputStream was already used and read, thus the position of the next byte of InputStream is it's end

The last one was the responsible for my problem. The code was creating an InputStream from a certificate, and proceeding to use it in two KeyStore.load() calls, the first one was successful, the second one always got me this error.

回答2:

Probably the certificate you create has an extra character at the end which is misinterpreted to be another certificate. Use one or more blank lines at the end.

Refer: Java Certificate Parsing

回答3:

For others with a similar problem:

"keystore load: DerInputStream.getLength(): lengthTag=109, too big."

For me solution was to remove the param: -storetype pkcs12 since the standard type is jks

回答4:

Specify the type of certificate in the code for eg:

System.setProperty("javax.net.ssl.trustStoreType", "jks");
System.setProperty("javax.net.ssl.keyStoreType", "pkcs12"); 

回答5:

You are doing something wrong.
I tried your command and then loaded the p12 just fine.
The following code works:

 FileInputStream fin = new FileInputStream("..\\test.p12");
 KeyStore ks = KeyStore.getInstance("PKCS12");
 ks.load(fin, "123456".toCharArray());
 System.out.println(ks.getCertificate("myrsakey"));

I was wondering if you put the command as is you get an error from keytool that the password must be at least 6 characters.
You did not get that error? What version of java are you using?
Note:if you need to create certificates you can also look into this tool.
http://sourceforge.net/projects/certhelper/

回答6:

I had the same issue.

My solution is to replace PKCS12 with jceks in the line below because I was apparently using the wrong type.

KeyStore clientStore = KeyStore.getInstance("PKCS12");

回答7:

This happened to me because I had copy and pasted the .p12 file locally on my windows 10 machine. No clue how/why this is a problem, but when I clone a project that has .p12 files and point my code to them, the files work. However, copy and pasting the files in windows file explorer to somewhere else on the harddrive causes this error!!!!