blocks|key|5008652|text|如果密钥库是PKCS12类型(.pfx)，则必须使用-storetype+PKCS12指定它(为了可读性，添加了换行符)：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5008653|keytool+-list+-v+-keystore+<path+to+keystore.pfx>+\
++++-storepass+<password>+\
++++-storetype+PKCS12|code-block|syntax|javascript|5008654|entityMap^0|F|4|Q|H|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]|$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|S|8|@]|D|@]|E|$]]]|L|$]]

If the keystore is PKCS12 type (<code>.pfx</code>) you have to specify it with <code>-storetype PKCS12</code> (line breaks added for readability):

<pre class="lang-sh prettyprint-override"><code>keytool -list -v -keystore &lt;path to keystore.pfx&gt; \
 -storepass &lt;password&gt; \
 -storetype PKCS12
</code></pre>

blocks|key|4525989|text|您也可以使用openssl来完成相同的任务：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4525990|$+openssl+pkcs12+-nokeys+-info+\
++++-in+</path/to/file.pfx>+\
++++-passin+pass:<pfx's+password>

MAC+Iteration+2048
MAC+verified+OK
PKCS7+Encrypted+data:+pbeWithSHA1And40BitRC2-CBC,+Iteration+2048
Certificate+bag
Bag+Attributes
++++localKeyID:+XX+XX+XX+XX+XX+XX+XX+XX+XX+XX+XX+XX+XX+48+54+A0+47+88+1D+90
++++friendlyName:+jedis-server
subject=/C=US/ST=NC/L=Raleigh/O=XXX+Security/OU=XXX/CN=something1
issuer=/C=US/ST=NC/L=Raleigh/O=XXX+Security/OU=XXXX/CN=something1
-----BEGIN+CERTIFICATE-----
...
...
...
-----END+CERTIFICATE-----
PKCS7+Data
Shrouded+Keybag:+pbeWithSHA1And3-KeyTripleDES-CBC,+Iteration+2048|code-block|syntax|javascript|4525991|entityMap|0|LINK|mutability|MUTABLE|url|https://www.openssl.org/^0|6|7|6|7|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@$9|V|A|W|1|X]]|E|$]]|$1|F|3|G|5|H|7|Y|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Z|8|@]|D|@]|E|$]]]|L|$M|$5|N|O|P|E|$Q|R]]]]

You can also use <a href="https://www.openssl.org/" rel="noreferrer"><code>openssl</code></a> to accomplish the same thing:

<pre><code>$ openssl pkcs12 -nokeys -info \
 -in &lt;/path/to/file.pfx&gt; \
 -passin pass:&lt;pfx's password&gt;

MAC Iteration 2048
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
Bag Attributes
 localKeyID: XX XX XX XX XX XX XX XX XX XX XX XX XX 48 54 A0 47 88 1D 90
 friendlyName: jedis-server
subject=/C=US/ST=NC/L=Raleigh/O=XXX Security/OU=XXX/CN=something1
issuer=/C=US/ST=NC/L=Raleigh/O=XXX Security/OU=XXXX/CN=something1
-----BEGIN CERTIFICATE-----
...
...
...
-----END CERTIFICATE-----
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
</code></pre>

blocks|key|5008877|text|问题和所有答案中缺少的是，您可能需要密码短语才能从PKCS#12+(.pfx)密钥库读取公共数据。是否需要口令取决于PKCS#12文件是如何创建的。你可以检查文件的ASN1结构(通过asn1解析器运行它，openssl或者certutil也可以做到这一点)，如果PKCS#7数据(例如OID前缀1.2.840.113549.1.7)被列为“加密的”或者带有密码规范，或者如果数据在ASN1树中的位置在加密的节点之下，你将无法在不知道密码的情况下读取它。这意味着您的'openssl+pkcs12‘命令将失败并返回错误(输出取决于版本)。对于那些想知道为什么在不知道密码的情况下对PKCS#12的证书感兴趣的人。假设您有许多密钥库和许多密码短语，并且您在组织它们方面非常糟糕，并且您不想测试所有组合，文件中的证书可以帮助您找出它可能是哪个密码。或者，您正在开发迁移/更新密钥库的软件，并且需要预先决定基于所包含的certicate启动哪个过程，而无需用户交互。因此，根据PKCS#12结构的不同，后面的示例不需要密码短语。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5008878|我只是想补充一下，因为我自己并没有找到答案，也没有花很多时间去弄清楚。|5008879|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

What is missing in the question and all the answers is that you might need the passphrase to read public data from the PKCS#12 (.pfx) keystore. If you need a passphrase or not depends on how the PKCS#12 file was created. You can check the ASN1 structure of the file (by running it through a ASN1 parser, openssl or certutil can do this too), if the PKCS#7 data (e.g. OID prefix 1.2.840.113549.1.7) is listed as 'encrypted' or with a cipher-spec or if the location of the data in the asn1 tree is below an encrypted node, you won't be able to read it without knowledge of the passphrase. It means your 'openssl pkcs12' command will fail with errors (output depends on the version).
For those wondering why you might be interested in the certificate of a PKCS#12 without knowledge of the passphrase. Imagine you have many keystores and many phassphrases and you are really bad at keeping them organized and you don't want to test all combinations, the certificate inside the file could help you find out which password it might be. Or you are developing software to migrate/renew a keystore and you need to decide in advance which procedure to initiate based on the contained certicate without user interaction. 
So the latter examples work without passphrase depending on the PKCS#12 structure.

Just wanted to add that, because I didn't find an answer myself and spend a lot of time to figure it out.

blocks|key|352114|text|openssl+pkcs12+-info+-in+keystore_file|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|352115|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>openssl pkcs12 -info -in keystore_file
</code></pre>

blocks|key|5008899|text|您可以使用keytool列出条目(证书详细信息)，甚至不需要提及存储类型。此外，.p12和.pfx都是PKCS#12文件。假设您有密钥库文件cert.pfx或cert.p12，然后可以使用以下命令列出内容。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5008900|keytool+-list+-v+-keystore+cert.pfx+-storepass+<password>|code-block|syntax|javascript|5008901|或|BOLD|5008902|keytool+-list+-v+-keystore+cert.p12+-storepass+<password>

+Keystore+type:+PKCS12
+Keystore+provider:+SunJSSE

+Your+keystore+contains+1+entry
+Alias+name:+1
+Creation+date:+Jul+11,+2020
+Entry+type:+PrivateKeyEntry
+Certificate+chain+length:+2|5008903|entityMap^0|14|4|19|4|1F|7|1Y|8|27|8|0|0|0|1|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|C]|$9|W|A|X|B|C]|$9|Y|A|Z|B|C]|$9|10|A|11|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|12|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|13|8|@$9|14|A|15|B|M]]|D|@]|E|$]]|$1|N|3|O|5|H|7|16|8|@]|D|@]|E|$I|J]]|$1|P|3|-4|5|6|7|17|8|@]|D|@]|E|$]]]|Q|$]]

You can list down the entries (certificates details) with the keytool and even you don't need to mention the store type. Also, the <code>.p12</code> and <code>.pfx</code> are both <code>PKCS#12</code> files. Assume that you've the keystore file <code>cert.pfx</code> or <code>cert.p12</code> then you can use the following command to list down the content.
<pre><code>keytool -list -v -keystore cert.pfx -storepass &lt;password&gt;
</code></pre>
or
<pre><code>keytool -list -v -keystore cert.p12 -storepass &lt;password&gt;

 Keystore type: PKCS12
 Keystore provider: SunJSSE

 Your keystore contains 1 entry
 Alias name: 1
 Creation date: Jul 11, 2020
 Entry type: PrivateKeyEntry
 Certificate chain length: 2
</code></pre>

I wanted to list the certificates stored in a PKCS12 keystore. 

The keystore has the extension <code>.pfx</code>

How to list the certificates stored in a PKCS12 keystore with keytool?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我想列出存储在PKCS12密钥库中的证书。密钥库的扩展名为.pfx

问如何使用keytool列出PKCS12密钥库中存储的证书？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何使用keytool列出PKCS12密钥库中存储的证书？EN