如何编写自动导入证书的脚本

本文目录导读：

1. Linux 系统 (Bash 脚本)
2. Windows 系统 (PowerShell 脚本)
3. 批量导入证书脚本
4. 使用方法
5. 注意事项

我来帮你编写自动导入证书的脚本,针对不同操作系统提供多个版本。

Linux 系统 (Bash 脚本)

#!/bin/bash
# 自动导入证书脚本 - Linux版
# 使用方法: ./import_cert.sh [证书文件路径] [证书别名]
# 配置
CERT_PATH="${1:-./certificate.crt}"
CERT_ALIAS="${2:-mycert}"
KEYSTORE_PATH="${JAVA_HOME}/lib/security/cacerts"
KEYSTORE_PASS="changeit"  # Java默认密码
# 颜色输出
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color
# 检查证书文件
check_cert() {
    if [ ! -f "$CERT_PATH" ]; then
        echo -e "${RED}错误: 证书文件 $CERT_PATH 不存在${NC}"
        exit 1
    fi
    echo -e "${GREEN}✓ 证书文件存在${NC}"
}
# 检查Java环境
check_java() {
    if [ -z "$JAVA_HOME" ]; then
        echo -e "${YELLOW}警告: JAVA_HOME 未设置，尝试查找...${NC}"
        JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
    fi
    if [ -z "$JAVA_HOME" ]; then
        echo -e "${RED}错误: 找不到Java环境${NC}"
        exit 1
    fi
    echo -e "${GREEN}✓ Java路径: $JAVA_HOME${NC}"
}
# 导入证书
import_cert() {
    echo -e "${YELLOW}正在导入证书到信任库...${NC}"
    # 备份原有信任库
    if [ ! -f "${KEYSTORE_PATH}.backup" ]; then
        cp "$KEYSTORE_PATH" "${KEYSTORE_PATH}.backup"
        echo -e "${GREEN}✓ 已备份原信任库${NC}"
    fi
    # 导入证书
    sudo keytool -import -trustcacerts \
        -alias "$CERT_ALIAS" \
        -file "$CERT_PATH" \
        -keystore "$KEYSTORE_PATH" \
        -storepass "$KEYSTORE_PASS" \
        -noprompt
}
# 验证导入
verify_import() {
    echo -e "${YELLOW}验证证书导入...${NC}"
    if keytool -list -keystore "$KEYSTORE_PATH" \
        -storepass "$KEYSTORE_PASS" \
        -alias "$CERT_ALIAS" > /dev/null 2>&1; then
        echo -e "${GREEN}✓ 证书导入成功!${NC}"
        return 0
    else
        echo -e "${RED}✗ 证书导入失败${NC}"
        return 1
    fi
}
# 主函数
main() {
    echo "========================================"
    echo "    自动证书导入脚本 - Linux版本"
    echo "========================================"
    check_cert
    check_java
    import_cert
    verify_import
    echo "========================================"
}
main

Windows 系统 (PowerShell 脚本)

# 自动导入证书脚本 - Windows PowerShell版
param(
    [Parameter(Mandatory=$false)]
    [string]$CertPath = ".\certificate.cer",
    [Parameter(Mandatory=$false)]
    [string]$CertStore = "CurrentUser",
    [Parameter(Mandatory=$false)]
    [string]$StoreLocation = "Root",
    [Parameter(Mandatory=$false)]
    [string]$JavaHome = $env:JAVA_HOME
)
function Write-ColorOutput {
    param(
        [string]$Message,
        [string]$Color = "White"
    )
    Write-Host $Message -ForegroundColor $Color
}
function Check-CertFile {
    if (-not (Test-Path $CertPath)) {
        Write-ColorOutput "错误: 证书文件 $CertPath 不存在" "Red"
        exit 1
    }
    Write-ColorOutput "✓ 证书文件存在" "Green"
}
function Import-ToSystemStore {
    Write-ColorOutput "正在导入到Windows证书存储..." "Yellow"
    try {
        $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
        $cert.Import($CertPath)
        $store = New-Object System.Security.Cryptography.X509Certificates.X509Store($StoreLocation, $CertStore)
        $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
        $store.Add($cert)
        $store.Close()
        Write-ColorOutput "✓ 证书已添加到 $CertStore\$StoreLocation" "Green"
    }
    catch {
        Write-ColorOutput "✗ 导入到系统存储失败: $_" "Red"
    }
}
function Import-ToJavaKeystore {
    param([string]$CertAlias = "mycert")
    if ([string]::IsNullOrEmpty($JavaHome)) {
        Write-ColorOutput "警告: JAVA_HOME 未设置，跳过Java信任库导入" "Yellow"
        return
    }
    $keystorePath = Join-Path $JavaHome "lib\security\cacerts"
    if (-not (Test-Path $keystorePath)) {
        Write-ColorOutput "错误: 找不到Java信任库 $keystorePath" "Red"
        return
    }
    Write-ColorOutput "正在导入到Java信任库..." "Yellow"
    # 备份
    Copy-Item $keystorePath "$keystorePath.backup"
    Write-ColorOutput "✓ 已备份原信任库" "Green"
    # 导入证书
    $keytool = Join-Path $JavaHome "bin\keytool.exe"
    & $keytool -import -trustcacerts `
        -alias $CertAlias `
        -file $CertPath `
        -keystore $keystorePath `
        -storepass "changeit" `
        -noprompt
    if ($LASTEXITCODE -eq 0) {
        Write-ColorOutput "✓ Java信任库导入成功" "Green"
    } else {
        Write-ColorOutput "✗ Java信任库导入失败" "Red"
    }
}
# 主程序
Write-Host "========================================"
Write-Host "    自动证书导入脚本 - Windows版本"
Write-Host "========================================"
Check-CertFile
Import-ToSystemStore
Import-ToJavaKeystore
Write-Host "========================================"
Write-Host "处理完成!" -ForegroundColor Green

批量导入证书脚本

#!/bin/bash
# 批量导入证书脚本
# 用于导入目录下的所有证书
CERT_DIR="./certs"
KEYSTORE_PATH="/etc/ssl/certs/java/cacerts"
KEYSTORE_PASS="changeit"
# 为每个证书生成唯一别名
import_all_certs() {
    if [ ! -d "$CERT_DIR" ]; then
        echo "错误: 证书目录 $CERT_DIR 不存在"
        exit 1
    fi
    count=0
    for cert in "$CERT_DIR"/*.{crt,cer,pem}; do
        if [ -f "$cert" ]; then
            alias="custom-cert-$(basename $cert .${cert##*.})-$(date +%s)"
            echo "正在导入: $cert"
            sudo keytool -import -trustcacerts \
                -alias "$alias" \
                -file "$cert" \
                -keystore "$KEYSTORE_PATH" \
                -storepass "$KEYSTORE_PASS" \
                -noprompt
            if [ $? -eq 0 ]; then
                echo "✓ 成功导入: $cert"
                ((count++))
            else
                echo "✗ 导入失败: $cert"
            fi
        fi
    done
    echo "共导入 $count 个证书"
}
import_all_certs

使用方法

Linux:

# 给脚本执行权限
chmod +x import_cert.sh
# 导入单个证书
./import_cert.sh /path/to/certificate.crt myalias
# 批量导入
./batch_import.sh

Windows:

# 运行PowerShell脚本
.\import_cert.ps1 -CertPath "C:\path\to\certificate.cer"
# 导入到不同存储位置
.\import_cert.ps1 -CertPath "cert.cer" -CertStore "LocalMachine"

注意事项

1. 权限要求: Linux需要sudo权限，Windows可能需要管理员权限
2. 密码安全: 实际使用时应从环境变量读取密码
3. 备份: 脚本已包含备份功能
4. 证书格式: 支持 .crt, .cer, .pem 格式

建议先将脚本在测试环境运行,确认无误后再在生产环境使用。