1 前言

一个问题，一篇文章，一出故事。
今天的KeyCloak遇到CA自签名证书不信任问题，因此需要在KeyCloak上安装证书服务器的根证书。
于是整理当前章节，当前章节演示如何导出证书服务器的根证书。

2 最佳实践

2.1 查看当前CA基本信息

C:\>certutil

可见如下显示，

Entry 0: (Local)
  Name:                         "cmdschool Trust Community CN Root CA"
  Organizational Unit:          ""
  Organization:                 ""
  Locality:                     ""
  State:                        ""
  Country/region:               ""
  Config:                       "cmdschoolROOTCA\cmdschool Trust Community CN Root CA"
  Exchange Certificate:         ""
  Signature Certificate:        "cmdschoolROOTCA_cmdschool Trust Community CN Root CA.crt"
  Description:                  ""
  Server:                       "cmdschoolROOTCA"
  Authority:                    "cmdschool Trust Community CN Root CA"
  Sanitized Name:               "cmdschool Trust Community CN Root CA"
  Short Name:                   "cmdschool Trust Community CN Root CA"
  Sanitized Short Name:         "cmdschool Trust Community CN Root CA"
  Flags:                        "12"
  Web Enrollment Servers:       ""
CertUtil: -dump command completed successfully.

如上所示，关键的信息如下：
– CA 服务器主机名：”cmdschoolROOTCA”
– CA 名称：”cmdschool Trust Community CN Root CA”
– Config 字符串：”cmdschoolROOTCA\cmdschool Trust Community CN Root CA”

2.2 导出根 CA 公钥证书

C:\>certutil -config "cmdschoolROOTCA\cmdschool Trust Community CN Root CA" -f -ca.cert C:\root.cer

可见如下显示，

CA cert[2]: 3 -- Valid
CA cert[2]:
-----BEGIN CERTIFICATE-----
MIIFVDCGAzygAwIBAgIQRlAsSWmo04VIt7vsGWaN+DANmgkqhkiG9w0BAQ0FADAp
#...
Th3+QmnD7ee5ojKbYXheAkinr46pZs+X
-----END CERTIFICATE-----

CertUtil: -ca.cert command completed successfully.

2.3 将证书转为PEM格式

C:\>certutil -encode C:\root.cer C:\root.pem

可见如下显示，

Input Length = 1368
Output Length = 1938
CertUtil: -encode command completed successfully.