我有一个与 HTTPS RPC 通信的应用程序。
HTTP 服务器正在使用 CAcert 签名的证书。
我正在使用自定义 TrustManager 来验证证书。
- 因为我无法确定，CAcert 是否包含在所有设备的可信 key 存储中。
- 因为我只想允许 CAcert 签署此连接的证书。
但是，我正在关注 Google 的 best practices 。 我唯一改变的是:
- 从静态字节[]而不是文件加载 CAcert 根证书
- 将示例代码加载文件的最后一部分替换为
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());。 UrlConnection 之上有一个 JSONRPC2 API。
测试的设备:
- 使用运行 API18/CM10.2 的 Nexus 4/mako
- 正在使用 API18 模拟器
- 正在使用 API17 模拟器
- 正在使用 API14 模拟器
- 在运行 API10/CM7 的 HTC G2 上无法工作。*
- 在 API8 模拟器上无法工作
在低 API 设备上，它无法在 SSL 握手期间验证证书。
当尝试在 API18 上使用此 TrustManager 加载 https://google.com 时，它按预期失败，因为找不到信任 anchor 。
所以基本上，这段代码应该可以工作，并且所有方法都是 API1...
我知道，UrlConnection 在某些较低的 API 上被破坏了。
如何解决这个问题？
代码:
/**
* Trust only CAcert's CA. CA cert is injected as byte[]. Following best practices from
* https://developer.android.com/training/articles/security-ssl.html#UnknownCa
*/
private static void trustCAcert() {
try {
// Load CAs from an InputStream
CertificateFactory cf = CertificateFactory.getInstance("X.509");
ByteArrayInputStream is = new ByteArrayInputStream(CACERTROOTDER);
Certificate ca;
try {
ca = cf.generateCertificate(is);
Log.d(TAG, "ca=", ((X509Certificate) ca).getSubjectDN());
} finally {
is.close();
}
// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);
// Create an SSLContext that uses our TrustManager
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tmf.getTrustManagers(), null);
HttpsURLConnection.setDefaultSSLSocketFactory(
sslContext.getSocketFactory());
// added for testing only
URL u = new URL(
"https://myremoteapiurlsignedwiththesamecert.com/v1/doc.html");
HttpsURLConnection con = (HttpsURLConnection) u.openConnection();
con.setSSLSocketFactory(sslContext.getSocketFactory());
BufferedReader r = new BufferedReader(
new InputStreamReader(
con.getInputStream())); // the exception is thrown here
// because verification fails
String l;
while ((l = r.readLine()) != null) {
Log.d(TAG, "l: ", l);
}
} catch (IOException e) { // none of the exceptions is thrown during setup
Log.e(TAG, "IOException", e);
} catch (CertificateException e) {
Log.e(TAG, "CertificateException", e);
} catch (NoSuchAlgorithmException e) {
Log.e(TAG, "NoSuchAlgorithmException", e);
} catch (KeyStoreException e) {
Log.e(TAG, "KeyStoreException", e);
} catch (KeyManagementException e) {
Log.e(TAG, "KeyManagementException", e);
}
}
日志:
APIUtils D ca=OID.1.2.840.113549.1.9.1=#1612737570706F7274406361636572742E6F7267, CN=CA Cert Signing Authority, OU=http://www.cacert.org, O=Root CA
E IOException
E javax.net.ssl.SSLException: Not trusted server certificate
E at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
E at org.apache.harmony.luni.internal.net.www.protocol.http.HttpConnection.getSecureSocket(HttpConnection.java:168)
E at org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:399)
E at org.apache.harmony.luni.internal.net.www.protocol.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:1152)
E at org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:253)
E at de.terminbuddy.android.network.APIUtils.trustCAcert(APIUtils.java:294)
E at de.terminbuddy.android.network.APIUtils.initRpcSession(APIUtils.java:243)
E at de.terminbuddy.android.network.APIUtils.runRPC(APIUtils.java:323)
E at de.terminbuddy.android.network.AsyncJSONRPCTask.doInBackground(AsyncJSONRPCTask.java:55)
E at de.terminbuddy.android.network.AsyncJSONRPCTask.doInBackground(AsyncJSONRPCTask.java:17)
E at android.os.AsyncTask$2.call(AsyncTask.java:185)
E at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
E at java.util.concurrent.FutureTask.run(FutureTask.java:137)
E at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1068)
E at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:561)
E at java.lang.Thread.run(Thread.java:1096)
E Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Could not validate certificate signature.
E at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:168)
E at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:366)
E ... 15 more
E Caused by: java.security.cert.CertPathValidatorException: Could not validate certificate signature.
E at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:342)
E at java.security.cert.CertPathValidator.validate(CertPathValidator.java:202)
E at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:164)
E ... 16 more
E Caused by: java.security.SignatureException: Signature was not verified.
E at org.apache.harmony.security.provider.cert.X509CertImpl.fastVerify(X509CertImpl.java:601)
E at org.apache.harmony.security.provider.cert.X509CertImpl.verify(X509CertImpl.java:544)
E at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:337)
E ... 18 more
最佳答案
我找到了解决这个问题的方法:
- CAcert 证书的 CRL 验证似乎存在某种问题(API<14/11)。
- 涉及 API<8 不支持的 SNI。
基本上，我使用此处找到的实现对 API<14 运行自己的检查:Validate X509 certificates using Java APis
private static final byte[] CACERTROOTDER = new byte[]{
48, -126, 7, 61, 48, -126, 5, 37, -96, 3, 2, 1, 2, 2, 1, 0,
// ...
};
/**
* Read x509 certificated file from byte[].
*
* @param bytes certificate in der format
* @return certificate
*/
private static X509Certificate getCertificate(final byte[] bytes)
throws IOException, CertificateException {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate ca;
ByteArrayInputStream is = new ByteArrayInputStream(bytes);
try {
ca = (X509Certificate) cf.generateCertificate(is);
Log.d(TAG, "ca=", ca.getSubjectDN());
} finally {
is.close();
}
return ca;
}
/**
* Trust only CAcert's CA. CA cert is injected as byte[]. Following best practices from
* https://developer.android.com/training/articles/security-ssl.html#UnknownCa
*/
private static void trustCAcert()
throws KeyStoreException, IOException,
CertificateException, NoSuchAlgorithmException,
KeyManagementException {
// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
final KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("CAcert-root", getCertificate(CACERTROOTDER));
// if your HTTPd is not sending the full chain, add class3 cert to the key store
// keyStore.setCertificateEntry("CAcert-class3", getCertificate(CACERTCLASS3DER));
// Create a TrustManager that trusts the CAs in our KeyStore
final TrustManagerFactory tmf = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm());
tmf.init(keyStore);
// Create an SSLContext that uses our TrustManager
SSLContext sslContext = SSLContext.getInstance("TLS");
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
// may work on HC+, but there is no AVD or device to test it
sslContext.init(null, tmf.getTrustManagers(), null);
} else {
// looks like CLR is broken in lower APIs. implement out own checks here :x
// see https://stackoverflow.com/q/18713966/2331953
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
public boolean verify(final String hostname, final SSLSession session) {
try {
// check if hostname matches DN
String dn = session.getPeerCertificateChain()[0].getSubjectDN().toString();
Log.d(TAG, "DN=", dn);
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.GINGERBREAD) {
return dn.equals("CN=" + hostname);
} else {
// no SNI on API<9, but I know the first vhost's hostname
return dn.equals("CN=" + hostname)
|| dn.equals("CN=" + hostname.replace("jsonrpc", "rest"));
}
} catch (Exception e) {
Log.e(TAG, "unexpected exception", e);
return false;
}
}
});
// build our own trust manager
X509TrustManager tm = new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() {
// nothing to do
return new X509Certificate[0];
}
@Override
public void checkClientTrusted(final X509Certificate[] chain,
final String authType)
throws CertificateException {
// nothing to do
}
@Override
public void checkServerTrusted(final X509Certificate[] chain,
final String authType) throws CertificateException {
// nothing to do
Log.d(TAG, "checkServerTrusted(", chain, ")");
X509Certificate cert = chain[0];
cert.checkValidity();
CertificateFactory cf = CertificateFactory.getInstance("X.509");
ArrayList<X509Certificate> list = new ArrayList<X509Certificate>();
list.add(cert);
CertPath cp = cf.generateCertPath(list);
try {
PKIXParameters params = new PKIXParameters(keyStore);
params.setRevocationEnabled(false); // CLR is broken, remember?
CertPathValidator cpv = CertPathValidator
.getInstance(CertPathValidator.getDefaultType());
cpv.validate(cp, params);
} catch (KeyStoreException e) {
Log.d(TAG, "invalid key store", e);
throw new CertificateException(e);
} catch (InvalidAlgorithmParameterException e) {
Log.d(TAG, "invalid algorithm", e);
throw new CertificateException(e);
} catch (NoSuchAlgorithmException e) {
Log.d(TAG, "no such algorithm", e);
throw new CertificateException(e);
} catch (CertPathValidatorException e) {
Log.d(TAG, "verification failed");
throw new CertificateException(e);
}
Log.d(TAG, "verification successful");
}
};
sslContext.init(null, new X509TrustManager[]{tm}, null);
}
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
}
关于android - 较低 Android API 上的 SSL TrustManager 设置，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/18713966/