我正在尝试使用 Java 建立到 Web 服务的双向 TSL 连接,我获得了一个带有私钥的 pfx 证书和一个包含 3 个证书的证书链。这是使用 spring 框架的 java 代码:
@Bean
public Client weatherClient(Jaxb2Marshaller marshaller) throws Exception {
Client client = new Client();
client.setDefaultUri(".....");
client.setMarshaller(marshaller);
client.setUnmarshaller(marshaller);
KeyStore ks = KeyStore.getInstance("PKCS12");
ks.load(keyStore.getInputStream(), keyStorePassword.toCharArray());
LOGGER.info("Loaded keystore: " + keyStore.getURI().toString());
System.out.println("Loaded keystore: " + keyStore.getURI().toString());
keyStore.getInputStream().close();
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());//KeyManagerFactory.getDefaultAlgorithm()
keyManagerFactory.init(ks, keyStorePassword.toCharArray());
KeyStore ts = KeyStore.getInstance("PKCS12");
ts.load(trustStore.getInputStream(), trustStorePassword.toCharArray());//
LOGGER.info("Loaded trustStore: " + trustStore.getURI().toString());
System.out.println("Loaded trustStore: " + trustStore.getURI().toString());
trustStore.getInputStream().close();
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(ts);
HttpsUrlConnectionMessageSender messageSender = new HttpsUrlConnectionMessageSender();
messageSender.setKeyManagers(keyManagerFactory.getKeyManagers());
messageSender.setTrustManagers(trustManagerFactory.getTrustManagers());
client.setMessageSender(messageSender);
return client;
}
到目前为止,我得到了一个 ClientHello 和一个发送证书的 ServerHello,并且我得到了一个 Found 可信证书。然后有一个没有找到任何证书的证书请求
*** CertificateRequest
Cert Types: RSA, DSS
Cert Authorities:
<CN=Thawte SSL CA, O="Thawte, Inc.", C=US>
....
....
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
***
我已将证书单独添加到 lib/security/cacerts. 似乎第一次证书交换是从 cacerts keystore 发生的,因为如果这是唯一添加证书的地方,我会得到相同的行为。看起来请求正在寻找证书链但无法找到它,即使我已经将带有私钥和证书链的 pkcs12 导入到 KeyStore 对象中。任何帮助将不胜感激
更新
我在 ClientKeyExchange 之后遇到握手失败 我认为这是由于上述警告,但我对此可能是错误的。
*** ClientKeyExchange, RSA PreMasterSecret, TLSv1
main, WRITE: TLSv1 Handshake, length = 269
SESSION KEYGEN:
PreMaster Secret:
....
....
0000: B0 E2 38 5E 40 4E 7C C5 ..8^@N..
Server write IV:
0000: 44 40 45 E1 82 45 15 9B D@E..E..
main, WRITE: TLSv1 Change Cipher Spec, length = 1
*** Finished
verify_data: { 109, 220, 225, 98, 98, 233, 48, 215, 61, 50, 58, 207 }
***
main, WRITE: TLSv1 Handshake, length = 40
main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1 ALERT: fatal, handshake_failure
%% Invalidated: [Session-1, SSL_RSA_WITH_3DES_EDE_CBC_SHA]
更新
如果我将 keystore 添加为变量 -Djavax.net.ssl.keyStore=
,则相互身份验证有效
但是没有将 keystore 添加为变量,我得到以下结果。找到代码中指定的 keystore 和信任库,并在调试中显示证书链和信任库
***
found key for : devcert
chain [0] = [
[
Version: V3 ......
***
adding as trusted cert:
Subject:
然后会显示一个空的 keystore ,并将 JVM cacerts 用作受信任的证书。
keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trustStore is: /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts
trustStore type is : jks
trustStore provider is :
init truststore
adding as trusted cert:
Subject: CN=ubuntu
然后就是server hello *** 服务器你好,TLSv1 找到了哪个证书
***
Found trusted certificate:
but the Certificate Request does find a matching certificate as above, unless it is added as a variable
*** CertificateRequest
Cert Types: RSA, DSS
Cert Authorities:
<CN=Thawte SSL CA, O="Thawte, Inc.", C=US>
....
....
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
***
将 keystore 添加为变量的行为 -Djavax.net.ssl.keyStore=
*** ServerHelloDone
matching alias: devcert
*** Certificate chain
chain [0] = [
[
Version: V3
我想使用程序代码中的 keystore 和信任库,因为希望以后能够动态更改它
最佳答案
您不应该得到私钥。这已经是一个重大的安全漏洞。实际问题是证书不是由 CertificateRequest
消息中提到的 CA 签署的,或者它不是消息中提到的类型。
关于java - 握手失败客户端 key 交换,使用证书链,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/41014325/