在我的情况下，我有一个pem文件，其中包含两个证书和一个用于相互SSL身份验证的加密私钥。所以我的pem文件看起来像这样：

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----

Proc-Type: 4,ENCRYPTED

DEK-Info: DES-EDE3-CBC,C8BF220FC76AA5F9

...

-----END RSA PRIVATE KEY-----

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

这是我所做的

将文件分为三个单独的文件，以便每个文件仅包含一个条目，---BEGIN..以---END..行开头和结尾。让我们假设我们现在有三个文件：cert1.pem，cert2.pem，和pkey.pem。

pkey.pem使用openssl和以下语法转换为DER格式：

openssl pkcs8 -topk8 -nocrypt-输入pkey.pem-通知PEM-输出pkey.der-输出DER

请注意，如果私钥是加密的，则需要提供密码(从原始pem文件的供应商处获取)以转换为DER格式， openssl将要求您提供如下密码：“输入密码pkey.pem：”。

如果转换成功，您将获得一个名为的新文件pkey.der。

创建一个新的Java密钥库并导入私钥和证书：

String keypass = "password";  // this is a new password, you need to come up with to protect your java key store file

String defaultalias = "importkey";

KeyStore ks = KeyStore.getInstance("JKS", "SUN");

// this section does not make much sense to me,

// but I will leave it intact as this is how it was in the original example I found on internet:

ks.load( null, keypass.toCharArray());

ks.store( new FileOutputStream ( "mykeystore"  ), keypass.toCharArray());

ks.load( new FileInputStream ( "mykeystore" ),    keypass.toCharArray());

// end of section..

// read the key file from disk and create a PrivateKey

FileInputStream fis = new FileInputStream("pkey.der");

DataInputStream dis = new DataInputStream(fis);

byte[] bytes = new byte[dis.available()];

dis.readFully(bytes);

ByteArrayInputStream bais = new ByteArrayInputStream(bytes);

byte[] key = new byte[bais.available()];

KeyFactory kf = KeyFactory.getInstance("RSA");

bais.read(key, 0, bais.available());

bais.close();

PKCS8EncodedKeySpec keysp = new PKCS8EncodedKeySpec ( key );

PrivateKey ff = kf.generatePrivate (keysp);

// read the certificates from the files and load them into the key store:

Collection  col_crt1 = CertificateFactory.getInstance("X509").generateCertificates(new FileInputStream("cert1.pem"));

Collection  col_crt2 = CertificateFactory.getInstance("X509").generateCertificates(new FileInputStream("cert2.pem"));

Certificate crt1 = (Certificate) col_crt1.iterator().next();

Certificate crt2 = (Certificate) col_crt2.iterator().next();

Certificate[] chain = new Certificate[] { crt1, crt2 };

String alias1 = ((X509Certificate) crt1).getSubjectX500Principal().getName();

String alias2 = ((X509Certificate) crt2).getSubjectX500Principal().getName();

ks.setCertificateEntry(alias1, crt1);

ks.setCertificateEntry(alias2, crt2);

// store the private key

ks.setKeyEntry(defaultalias, ff, keypass.toCharArray(), chain );

// save the key store to a file

ks.store(new FileOutputStream ( "mykeystore" ),keypass.toCharArray());

(可选)验证新密钥库的内容：

$ keytool -list -keystore mykeystore -storepass password

密钥库类型：JKS密钥库提供者：SUN

您的密钥库包含3个条目：

cn = ...，ou = ...，o = ..，2014年9月2日，trustCertEntry，证书指纹(SHA1)：2C：B8：...

importkey，2014年9月2日，PrivateKeyEntry，证书指纹(SHA1)：9C：B0：...

cn = ...，o = ....，2014年9月2日，trustCertEntry，证书指纹(SHA1)：83:63：...

(可选)针对SSL服务器测试新密钥存储中的证书和私钥：(您可能希望将调试作为VM选项启用：-Djavax.net.debug = all)

char[] passw = "password".toCharArray();

KeyStore ks = KeyStore.getInstance("JKS", "SUN");

ks.load(new FileInputStream ( "mykeystore" ), passw );

KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");

kmf.init(ks, passw);

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

tmf.init(ks);

TrustManager[] tm = tmf.getTrustManagers();

SSLContext sclx = SSLContext.getInstance("TLS");

sclx.init( kmf.getKeyManagers(), tm, null);

SSLSocketFactory factory = sclx.getSocketFactory();

SSLSocket socket = (SSLSocket) factory.createSocket( "192.168.1.111", 443 );

socket.startHandshake();

//if no exceptions are thrown in the startHandshake method, then everything is fine..

如果打算使用它，最后向HttpsURLConnection注册您的证书：

char[] passw = "password".toCharArray();

KeyStore ks = KeyStore.getInstance("JKS", "SUN");

ks.load(new FileInputStream ( "mykeystore" ), passw );

KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");

kmf.init(ks, passw);

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

tmf.init(ks);

TrustManager[] tm = tmf.getTrustManagers();

SSLContext sclx = SSLContext.getInstance("TLS");

sclx.init( kmf.getKeyManagers(), tm, null);

HostnameVerifier hv = new HostnameVerifier()

{

public boolean verify(String urlHostName, SSLSession session)

{

if (!urlHostName.equalsIgnoreCase(session.getPeerHost()))

{

System.out.println("Warning: URL host '" + urlHostName + "' is different to SSLSession host '" + session.getPeerHost() + "'.");

}

return true;

}

};

HttpsURLConnection.setDefaultSSLSocketFactory( sclx.getSocketFactory() );

HttpsURLConnection.setDefaultHostnameVerifier(hv);