一、生成PEM文件
这里以邮件发送接口为例https://api.mailgun.net/v3/，首先运行以下命令：
openssl s_client -host api.mailgun.net -port 443 -prexit -showcerts
执行结果如下：
CONNECTED(00000003) depth=1 C = US, O = "thawte, Inc.", CN = thawte SHA256 SSL CA verify error:num=20:unable to get local issuer certificate --- Certificate chain 0 s:/C=US/ST=Texas/L=San Antonio/O=Rackspace US, Inc/OU=Mailgun/CN=*.mailgun.com i:/C=US/O=thawte, Inc./CN=thawte SHA256 SSL CA -----BEGIN CERTIFICATE----- MIIGRjCCBS6gAwIBAgIQcPBE+lQWtps2UTd0ornMgjANBgkqhkiG9w0BAQsFADBD MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMdGhhd3RlLCBJbmMuMR0wGwYDVQQDExR0 aGF3dGUgU0hBMjU2IFNTTCBDQTAeFw0xNjAyMDkwMDAwMDBaFw0xODA0MDgyMzU5 NTlaMHkxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIEwVUZXhhczEUMBIGA1UEBxQLU2Fu IEFudG9uaW8xGjAYBgNVBAoUEVJhY2tzcGFjZSBVUywgSW5jMRAwDgYDVQQLFAdN YWlsZ3VuMRYwFAYDVQQDFA0qLm1haWxndW4uY29tMIIBIjANBgkqhkiG9w0BAQEF AAOCAQ8AMIIBCgKCAQEAyzQJUmOuQsksJ+ypj6ndmfkmFa39aXZKxIsvVSSmGSqU upFO3awNDo4aaGnjjN8OFwHQozthBfNz04RDKgV0E22gyrrOOpCd88mHokJKeV04 TVc93/MQYAVQQ3Ou7b/GafuFcDu1Z5s+YgN1iMEXR4iMczlFsS1SzWZ03WOFeEGn xR31n6wLoOwcBEvD58v4zANntM9Ajwv0UHpd72nzBpwVFQYwY3vQrfK/5E5nbWJf cixs85Ube9L5ID71d49f9XRctPLvAINkktjvAu627WGg9Vs2KmzfXd+xJTcjZdpH WcW/PohxCZfyIaVP2tf5b7JwJFYp4ZkKt8KH8CR/5QIDAQABo4IC/jCCAvowJQYD VR0RBB4wHIINKi5tYWlsZ3VuLmNvbYILbWFpbGd1bi5jb20wCQYDVR0TBAIwADBu BgNVHSAEZzBlMGMGBmeBDAECAjBZMCYGCCsGAQUFBwIBFhpodHRwczovL3d3dy50 aGF3dGUuY29tL2NwczAvBggrBgEFBQcCAjAjDCFodHRwczovL3d3dy50aGF3dGUu Y29tL3JlcG9zaXRvcnkwDgYDVR0PAQH/BAQDAgWgMB8GA1UdIwQYMBaAFCuaNa4B GDgw4XB6BeARdqPOvZAUMCsGA1UdHwQkMCIwIKAeoByGGmh0dHA6Ly90Zy5zeW1j Yi5jb20vdGcuY3JsMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBXBggr BgEFBQcBAQRLMEkwHwYIKwYBBQUHMAGGE2h0dHA6Ly90Zy5zeW1jZC5jb20wJgYI KwYBBQUHMAKGGmh0dHA6Ly90Zy5zeW1jYi5jb20vdGcuY3J0MIIBfgYKKwYBBAHW eQIEAgSCAW4EggFqAWgAdgDd6x0reg1PpiCLga2BaHB+Lo6dAdVciI09EcTNtuy+ zAAAAVLIMQUYAAAEAwBHMEUCIQDw4Wpn51ujDWjQefvSO+c+nyE3RqkV6dw6XFEN eA8pugIgIxMLVoe+r1/MvLT4j3A9n7VexNSTQi1av1iMMGhnh5IAdgCkuQmQtBhY FIe7E6LMZ3AKPDWYBPkb37jjd80OyA3cEAAAAVLIMQVLAAAEAwBHMEUCIQCBXz+e sY2e3s4yN4gMKxHyg5aeB+5l8CN4/EG9PRDPIwIgb4nJn6xUKjEgLkSOOrfjejS+ HbAHHOZrWs7cAgc774gAdgBo9pj4H2SCvjqM7rkoHUz8cVFdZ5PURNEKZ6y7T0/7 xAAAAVLIMQVHAAAEAwBHMEUCIH5+Rt1+ohQPjiGesEqJomZv8/LnuFE7RCTi1dai Xk8sAiEAqycC8AGehR5pBhWUpGlx3IOXzA2EKda90FLF2Koq9D0wDQYJKoZIhvcN AQELBQADggEBACPqESoobL82TMXdGGbGQoTu03Bk+9lL0uxOSzGP+TJnjrb4b7p4 SvaM/z8XIKmgT3z3BP/wjyTN71BLVbamdLjcfHnNA6AYHE/sv91enmmCExsSN5Yd JWttWO8kk7pa944dOJ1vhPBmd3uGyTX1LuFTPe0++yUJvfv0dwvL/f7VFqM8ZYTO bf9BwQf7OedInr5qQaGHGenOFJStiNalotvmivBnzkrFT8xkK4f3tq73v5iT+Cyl MMLNho6OlLp4YNeUgglcmv2xv+HynkeWZeiIDtLsHceEdiOEP1FlkXT+BWJID2v4 M4CQfAVIzBQ/iNo+Dm9SHcae02JwWSGxeSM= -----END CERTIFICATE----- 1 s:/C=US/O=thawte, Inc./CN=thawte SHA256 SSL CA i:/C=US/O=thawte, Inc./OU=Certification Services Division/OU=(c) 2008 thawte, Inc. - For authorized use only/CN=thawte Primary Root CA - G3 -----BEGIN CERTIFICATE----- MIIEwjCCA6qgAwIBAgIQNjSeGMmcJmm2Vi5s5a1xMjANBgkqhkiG9w0BAQsFADCB rjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDHRoYXd0ZSwgSW5jLjEoMCYGA1UECxMf Q2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjE4MDYGA1UECxMvKGMpIDIw MDggdGhhd3RlLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxJDAiBgNV BAMTG3RoYXd0ZSBQcmltYXJ5IFJvb3QgQ0EgLSBHMzAeFw0xMzA1MjMwMDAwMDBa Fw0yMzA1MjIyMzU5NTlaMEMxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwx0aGF3dGUs IEluYy4xHTAbBgNVBAMTFHRoYXd0ZSBTSEEyNTYgU1NMIENBMIIBIjANBgkqhkiG 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo2Mr1LpdOK6wz7lMON8gffErR3Edi2jzVvmc 2qrlhCbepXEwvPMxI53oO4DIZld1tlcO25P1Jo5wumRSZooqiFxEGE2oony9VmEy kBL5NYdIYLBukGdEAY3nyQ1jaHJyq2M8hrgffa2IJadqiCn7WcZ4cV8suonm04D9 V+y5UV9DMy5+JTukBNFgjLNEM5MMrSq2RKIZO6/EkG97BYeGmyxqnStsd8kAn8nP rO0+G/fD89n4bNSgV8T7KDKqM/Dmupjf5cJOnHS/ikjC8hvwd0BBBwSyOtVMxCmp EUA/AkbwkdXSgYOGE7Mx7UarqId2qZl9vM0xUPSltdylMrOLiwIDAQABo4IBRDCC AUAwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC50aGF3 dGUuY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwQQYDVR0gBDowODA2BgpghkgBhvhF AQc2MCgwJgYIKwYBBQUHAgEWGmh0dHBzOi8vd3d3LnRoYXd0ZS5jb20vY3BzMDcG A1UdHwQwMC4wLKAqoCiGJmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQQ0Et RzMuY3JsMA4GA1UdDwEB/wQEAwIBBjAqBgNVHREEIzAhpB8wHTEbMBkGA1UEAxMS VmVyaVNpZ25NUEtJLTItNDE1MB0GA1UdDgQWBBQrmjWuARg4MOFwegXgEXajzr2Q FDAfBgNVHSMEGDAWgBStbKqUYJzt5P/6Pgp0K2MD97ZZvzANBgkqhkiG9w0BAQsF AAOCAQEAdKZW6K+Tlhn7JvkNsESlzel6SAN0AWwTcbfggpCZYiPj1pmv8McenqgY Idu0lD80VhuZVS+O8EUzMrdywRNbNNP1YOUuGNFcxWrBqodQDBydZCv/G9zVLmEL 57m2kVOG2QMq0T17StorB74p8mBCqZEaDi480X2lExQC+u6LjbbIuD5WgVchJD9l w7TJzlyNRqxT8/lVdMgr/dJ4cPX4EeX0p60g9Z3x7HD2E6zmjI3bP8byeQ6rUvLM G3knzxaz1vPGNoBD7MWU8N2QjfjGUkZW63RHvqbzGa5xTMDh59TP7dQGKCoRPLrZ QW4A54E3k+TaYsYdZ29jtBSG2aZi8A== -----END CERTIFICATE----- --- Server certificate subject=/C=US/ST=Texas/L=San Antonio/O=Rackspace US, Inc/OU=Mailgun/CN=*.mailgun.com issuer=/C=US/O=thawte, Inc./CN=thawte SHA256 SSL CA --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 3342 bytes and written 434 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: E279B2FA33421D0A68D77E6405256671A7E0438D8F61C9A85FB67ABE40B07437 Session-ID-ctx: Master-Key: 9A46CDBA8230B31F0AD744A49AEB97D44346DD26687689C5BF52A1F93BC4F0EFC4A8DFCD1F38DE35FF6007E4823ED0C7 Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1493541740 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) ---
将输出内容保存为pem文件，这里我保存为名为mailgun.pem的文件。
二、将证书导入truststore文件
cp $JAVA_HOME/jre/lib/security/cacerts trustore
本质上keyStore和strustStore文件格式上是一回事，keyStore存的一般是私钥，trustStore存放的是公钥。
导入证书（初始密码是changeit）：
keytool -import -alias gca -file mailgun.pem -keystore truststore
导入成功会有提示。GOOD LUCK
三、参考
https://www.cloudera.com/documentation/enterprise/5-8-x/topics/cm_sg_create_key_trust.html
等