我正在尝试configuration在Java 1.8.0_45-b14上运行的jetty-distribution-9.3.1.v20150714后端，并使用由自签名CA证书签名的证书进行SSL固定。
遵循苹果指南 ，我创build了一个自签名的CA证书，然后基于该CA证书创build了一个证书。
结果是ServerCertificate.p12与服务器的证书和一个私钥和一个root.cer文件，将用于钉住。
$ keytool -list -keystore keystore.p12 -storetype pkcs12 server, Jul 27, 2015, PrivateKeyEntry, Certificate fingerprint (SHA1): AA:BB:CC.........11:22:33
我以前曾经用可靠的CA签名过证书，所以后端应该configuration正确的SSL。 该移动应用程序的固定框架是与一个不同的网站自签名testing，它运作良好。
但是该应用程序无法通过该密钥库连接到我的后端： Trust anchor for certification path not found.
我感觉密钥库中缺lessCA证书，所以我试图用keytool -import -alias root -keystore keystore.p12 -storetype pkcs12 -trustcacerts -file root.crt （.crt是base64可读的证书文件），但没有帮助。
# after adding root.crt $ keytool -list -keystore keystore.p12 -storetype pkcs12 server, Jul 27, 2015, PrivateKeyEntry, Certificate fingerprint (SHA1): AA:BB:CC.........11:22:33 root, Jul 27, 2015, trustedCertEntry, Certificate fingerprint (SHA1): FF:DD:EE.........33:22:11 $ openssl s_client -connect example.com:443 CONNECTED(00000003) depth=1 CN = Product CA, C = AU verify error:num=19:self signed certificate in certificate chain --- Certificate chain 0 s:/CN=Product/C=AU i:/CN=Product CA/C=AU 1 s:/CN=Product CA/C=AU i:/CN=Product CA/C=AU --- Server certificate -----BEGIN CERTIFICATE----- MIIDADCCAei.................................. ............................................. ..........BASE64.STUFF....................... ............................................. ................................eTVowuY+erkaf +sIO4w== -----END CERTIFICATE----- subject=/CN=Product/C=AU issuer=/CN=Product CA/C=AU --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: DH, 2048 bits --- SSL handshake has read 2732 bytes and written 636 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : DHE-RSA-AES256-GCM-SHA384 Session-ID: 55B6.........................2B4 Session-ID-ctx: Master-Key: 1C.............................................................................30AF Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1497776932 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- closed
有趣的是， curl https://example.com --cacert server.cer工作得很好…（它不是没有–cacert）
任何想法有什么问题的configuration？