在一个应用中，如何针对不同的外部客户系统，使用不同的数字证书？

最新推荐文章于 2022-08-04 12:03:48 发布

Jeffrey-Gao

最新推荐文章于 2022-08-04 12:03:48 发布

阅读量950

点赞数

分类专栏： Security 文章标签： security webservice ssl java

Security 专栏收录该内容

7 篇文章 0 订阅

订阅专栏

问题：

在项目中要向不同的外部应用通过https连接访问webservice，
但是Java中用System.setProperty("javax.net.ssl.keyStore",...), 多个证书无法同时设置，会有冲突，请问这个该怎么处理

解决：

使用 KeyStoreManager 和 TrustManager 就可以了

实际上就是通过 KeyStoreManager, TrustManager 创建 SSLContext 对象，再通过 SSLContext 对象创建 SSLSocketFactory 对象，并将 SSLSocketFactory 对象赋给 HttpsURLConnection 对象。
KeyStoreManager 管理着双向认证中的客户端证书库
TrustManager 管理着双向认证中服务端证书信任库，相当于浏览器中我知道该证书非 CA 签发，但我需要继续操作。

import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.net.URL;

import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSocketFactory;

public class Test {

    public static void main(String[] args) throws Exception {

        // System.setProperty("javax.net.debug", "all");

        URL url = new URL("https://www.xxxx.com");

        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();

        connection.setSSLSocketFactory(getSSLSocketFactory());

        InputStream in = connection.getInputStream();
        byte[] bys = new byte[8192];
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        for (int p = 0; (p = in.read(bys)) != -1;) {
            baos.write(bys, 0, p);
        }
        String str = new String(baos.toByteArray());
        System.out.println(str);
    }

    private static SSLSocketFactory getSSLSocketFactory() {
        MyKeyManager keyManager = new MyKeyManager(KeyStoreType.PKCS12, "d:/key.p12", "123456".toCharArray());
        MyTrustManager trustManager = new MyTrustManager("d:/trust.keystore", "123456".toCharArray());
        MySSLContext context = new MySSLContext("TLS", keyManager, trustManager);
        return context.getSSLContext().getSocketFactory();
    }
}

import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;

public class MySSLContext {

    private String protocol;
    private MyKeyManager keyManager;
    private MyTrustManager trustManager;

    public MySSLContext(String protocol, MyKeyManager keyManager, MyTrustManager trustManager) {
        this.protocol = protocol;
        this.keyManager = keyManager;
        this.trustManager = trustManager;
    }

    public MySSLContext(String protocol, MyTrustManager trustManager) {
        this(protocol, null, trustManager);
    }

    public MySSLContext(String protocol, MyKeyManager keyManager) {
        this(protocol, keyManager, null);
    }

    public SSLContext getSSLContext() {
        try {
            SSLContext context = SSLContext.getInstance(protocol);
            context.init(getKeyManagers(), getTrustManagers(), null);
            return context;
        } catch (Exception e) {
            throw new IllegalStateException("error, protocol: " + protocol, e);
        }
    }

    private KeyManager[] getKeyManagers() {
        if (keyManager == null) {
            return null;
        }
        return keyManager.getKeyManagers();
    }

    private TrustManager[] getTrustManagers() {
        if (trustManager == null) {
            return null;
        }
        return trustManager.getTrustManagers();
    }
}

import java.security.KeyStore;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;

public class MyKeyManager {

    private KeyStore ks;
    private char[] password;

    public MyKeyManager(String keyStore, char[] password) {
        this(KeyStoreType.JKS, keyStore, password);
    }

    public MyKeyManager(KeyStoreType type, String keyStore, char[] password) {
        this.password = password;
        this.ks = MyKeyStoreUtil.loadKeyStore(type, keyStore, password);
    }

    public KeyManager[] getKeyManagers() {
        try {
            KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
            kmf.init(ks, password);
            return kmf.getKeyManagers();
        } catch (Exception e) {
            throw new KeyStoreRuntimeException("cannot get KeyManagers", e);
        }
    }
}

import java.security.KeyStore;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;

public class MyTrustManager {

    private KeyStore ks;

    public MyTrustManager(String keyStore, char[] password) {
        this(KeyStoreType.JKS, keyStore, password);
    }

    public MyTrustManager(KeyStoreType type, String keyStore, char[] password) {
        this.ks = MyKeyStoreUtil.loadKeyStore(type, keyStore, password);
    }

    public TrustManager[] getTrustManagers() {
        return new TrustManager[]{ new ClientTrustManager() };
    }

    private class ClientTrustManager implements X509TrustManager {
        private X509TrustManager sunJSSEX509TrustManager;

        public ClientTrustManager() {
            loadTrust();
        }

        private void loadTrust() {
            try {
                TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                tmf.init(ks);
                TrustManager tms[] = tmf.getTrustManagers();
                for (int i = 0; i < tms.length; i++) {
                    if (tms[i] instanceof X509TrustManager) {
                        sunJSSEX509TrustManager = (X509TrustManager) tms[i];
                        return;
                    }
                }
            } catch (Exception e) {
                throw new KeyStoreRuntimeException(e);
            }
        }

        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            sunJSSEX509TrustManager.checkClientTrusted(chain, authType);
        }

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            sunJSSEX509TrustManager.checkServerTrusted(chain, authType);
        }

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return sunJSSEX509TrustManager.getAcceptedIssuers();
        }
    }
}

import java.io.FileInputStream;
import java.io.InputStream;
import java.security.KeyStore;
import java.security.KeyStoreException;

public class MyKeyStoreUtil {

    private MyKeyStoreUtil() {
    }

    public static KeyStore loadKeyStore(KeyStoreType type, String keyStore, char[] password) {
        if (type == null) {
            type = KeyStoreType.JKS;
        }
        InputStream in = null;
        try {
            try {
                KeyStore ks = type.getKeyStore();
                in = new FileInputStream(keyStore);
                ks.load(in, password);
                return ks;
            } finally {
                if (in != null) {
                    in.close();
                }
            }
        } catch (Exception e) {
            throw new KeyStoreRuntimeException("type: " + type +
                    ", keyStore: " + keyStore, e);
        }
    }

    public static enum KeyStoreType {
        JKS {
            @Override
            public KeyStore getKeyStore() throws KeyStoreException {
                return getKeyStore("JKS");
            }
        },

        PKCS12 {
            @Override
            public KeyStore getKeyStore() throws KeyStoreException {
                return getKeyStore("PKCS12");
            }
        };

        public abstract KeyStore getKeyStore() throws KeyStoreException ;

        private static KeyStore getKeyStore(String type) throws KeyStoreException {
            return KeyStore.getInstance(type);
        }
    }

    public static class KeyStoreRuntimeException extends RuntimeException {

        private static final long serialVersionUID = 1L;

        public KeyStoreRuntimeException(String message, Throwable cause) {
            super(message, cause);
        }

        public KeyStoreRuntimeException(Throwable cause) {
            super(cause);
        }
    }
}