HTTPClient-1.4.2:自定义 SSL 上下文示例所需的说明

2022-01-25 00:00:00 http https ssl ssl-certificate java

这是来自 HttpClient-4.x 文档的自定义 SSL 上下文示例:http://hc.apache.org/httpcomponents-client-ga/examples.html

This is the example for Custom SSL Context from HttpClient-4.x documentation: http://hc.apache.org/httpcomponents-client-ga/examples.html

注意:为简洁起见删除评论.

Note: removing comments for brevity.

package org.apache.http.examples.client;

import java.io.File;
import java.io.FileInputStream;
import java.security.KeyStore;

import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.util.EntityUtils;

/**
 * This example demonstrates how to create secure connections with a custom SSL
 * context.
 */
public class ClientCustomSSL {

    public final static void main(String[] args) throws Exception {
        DefaultHttpClient httpclient = new DefaultHttpClient();
        try {
            KeyStore trustStore  = KeyStore.getInstance(KeyStore.getDefaultType());
            FileInputStream instream = new FileInputStream(new File("my.keystore"));
            try {
                trustStore.load(instream, "nopassword".toCharArray());
            } finally {
                try { instream.close(); } catch (Exception ignore) {}
            }

            SSLSocketFactory socketFactory = new SSLSocketFactory(trustStore);
            Scheme sch = new Scheme("https", 443, socketFactory);
            httpclient.getConnectionManager().getSchemeRegistry().register(sch);

            HttpGet httpget = new HttpGet("https://localhost/");

            System.out.println("executing request" + httpget.getRequestLine());

            HttpResponse response = httpclient.execute(httpget);
            HttpEntity entity = response.getEntity();

            System.out.println("----------------------------------------");
            System.out.println(response.getStatusLine());
            if (entity != null) {
                System.out.println("Response content length: " + entity.getContentLength());
            }
            EntityUtils.consume(entity);

        } finally {
            // When HttpClient instance is no longer needed,
            // shut down the connection manager to ensure
            // immediate deallocation of all system resources
            httpclient.getConnectionManager().shutdown();
        }
    }

}

我假设 my.keystore 是将 CA 根证书导入到的 trustStore 的位置:/Library/Java/Home/lib/security/cacerts 并且此信任库的默认密码是changeit".

I assume my.keystore is the location of the trustStore where CA root certificate is imported to: /Library/Java/Home/lib/security/cacerts and the default password for this truststore is "changeit".

我的问题是:我应该将客户端证书放在哪里才能与服务器通信.我有两种方式的 SSL 设置.

My question is: where should I put my client certificates in order to communicate with server. I've both ways SSL setup.

上面的示例代码没有给出关于客户端证书的任何提示:pem/p12 和密钥文件.

Above example code doesn't give any hint about client certificates: pem/p12 and key files.

任何想法/想法将不胜感激！！！

Any ideas/thoughts would be appreciated !!!

-比安卡

推荐答案

SSLSocketFactory 有几个构造函数.该示例使用的构造函数仅采用自定义 trustStore.您需要使用采用自定义 keyStore(其中包含您的客户端证书)的构造函数之一.

There are several constructors for SSLSocketFactory. The constructor that the example is using takes only a custom trustStore. You need to use one of the constructors that takes a custom keyStore (which contains your client certificates).

如果目标服务器使用自签名证书，您只需要自定义 trustStore.

You only need a custom trustStore if the target server is using a self-signed certificate.

此示例使用自定义 trustStore 和 keyStore 初始化 SSLContext:

This example initializes a SSLContext with a custom trustStore and keyStore:

public static void main(String[] args) throws Exception {

    DefaultHttpClient httpClient = new DefaultHttpClient();

    try {
        SSLContext ctx = SSLContext.getInstance("TLS");
        TrustManager[] trustManagers = getTrustManagers("jks", new FileInputStream(new File("cacerts")), "changeit");
        KeyManager[] keyManagers = getKeyManagers("pkcs12", new FileInputStream(new File("clientCert.pfx")), "password");
        ctx.init(keyManagers, trustManagers, new SecureRandom());
        SSLSocketFactory factory = new SSLSocketFactory(ctx, new StrictHostnameVerifier());

        ClientConnectionManager manager = httpClient.getConnectionManager();
        manager.getSchemeRegistry().register(new Scheme("https", 443, factory));

        //as before
    }
}

protected static KeyManager[] getKeyManagers(String keyStoreType, InputStream keyStoreFile, String keyStorePassword) throws Exception {
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(keyStoreFile, keyStorePassword.toCharArray());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(keyStore, keyStorePassword.toCharArray());
    return kmf.getKeyManagers();
}

protected static TrustManager[] getTrustManagers(String trustStoreType, InputStream trustStoreFile, String trustStorePassword) throws Exception {
    KeyStore trustStore = KeyStore.getInstance(trustStoreType);
    trustStore.load(trustStoreFile, trustStorePassword.toCharArray());
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(trustStore);
    return tmf.getTrustManagers();
}

相关文章