证书双向认证

最新推荐文章于 2024-09-14 18:33:04 发布
最新推荐文章于 2024-09-14 18:33:04 发布
阅读量874 收藏 1
点赞数
文章标签： 运维 json java
原文链接：https://my.oschina.net/yidao620c/blog/3102222
版权

服务端

Nginx配置

server {
    listen       8800 ssl;
    server_name  127.0.0.1;
    ssl_certificate /usr/local/NSP/nginx/certificate/nginx.crt;
    ssl_certificate_key /usr/local/NSP/nginx/certificate/nginx.key;
    ssl_password_file /usr/local/NSP/nginx/certificate/fifo;
    ssl_protocols       TLSv1.2;
    ssl_ciphers         "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES256-SHA:HIGH:!MEDIUM:!LOW:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@STRENGTH";
    ssl_prefer_server_ciphers on;
    ssl_dhparam ./ssl/dh2048.pem;

    root /usr/local/NSP/nginx/html/deployui;

    location /GatewayService/ {
        proxy_pass https://10.31.31.112:18006/GatewayService/;

        #如果证书里面配置了common name，且和proxy_pass中的ip不匹配,设置此参数为common name
        proxy_ssl_name server.xncoding.com;
        proxy_ssl_protocols TLSv1.1  TLSv1.2;
        proxy_ssl_certificate /usr/local/NSP/nginx/certificate/nginx.crt;
        proxy_ssl_certificate_key /usr/local/NSP/nginx/certificate/nginx.key;
        proxy_ssl_password_file /usr/local/NSP/nginx/certificate/fifo;
        proxy_ssl_trusted_certificate /usr/local/NSP/nginx/certificate/root.crt;
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 2;

        proxy_connect_timeout 600s;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        default_type application/json;
        proxy_intercept_errors off;
        break;
    }
}

Tomcat配置

注意下面的truststoreAlgorithm="SunX509" 是在tomcat8.5版本之后必须要添加的配置

<Connector port="9443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled ="true" sslProtocol ="TLS" maxThreads="150"
        acceptCount="100" maxHttpHeaderSize="8192" maxKeepAliveRequests="100"
        scheme="https" secure="true"
        keystoreFile="conf/server.p12"
        keystorePass="222222"
        keystoreType="PKCS12"
        clientAuth="true"
        truststoreFile="conf/root.p12"
        truststorePass="333333"
        truststoreType="PKCS12"
        truststoreAlgorithm="SunX509"
    ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
        maxPostSize="10240" connectionTimeout="20000"
        allowTrace="false" xpoweredBy="false"
        server="WebServer"
        URIEncoding="UTF-8" sslEnabledProtocols="TLSv1.2,TLSv1.1"/>

SpringBoot配置

server:
  ssl:
    enabled: true
    key-store: /cert/server.p12
    key-store-password: 222222
    key-store-type: PKCS12
    trust-store: /cert/root.p12
    trust-store-password: 333333
    trust-store-type: PKCS12
    client-auth: need

客户端

客户端RestTemplate

maven依赖
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-commons</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey.contribs</groupId>
            <artifactId>jersey-apache-client4</artifactId>
            <version>1.19.1</version>
        </dependency>
        <dependency>
            <groupId>com.netflix.eureka</groupId>
            <artifactId>eureka-client</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-autoconfigure</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <scope>provided</scope>
        </dependency>
    </dependencies>
HttpClientProperties类
@Component
@ConfigurationProperties(prefix = "dc.security.https.httpclient")
public class HttpClientProperties {
    /**
     * 是否开启服务端证书校验
     */
    private boolean enabled = true;
    /**
     * 是否开启客户端证书发送
     */
    private boolean clientCert = false;
    /**
     * 是否支持客户端负载均衡
     */
    private boolean loadBalanced = true;
    /**
     * 是否支持eureka注册发现
     */
    private boolean eureka = true;
    /**
     * CA根证书密钥库文件
     */
    private String caRootCertKeyStore;
    /**
     * CA根证书密钥库密码
     */
    private String caRootCertPassword;
    /**
     * 客户端证书库文件
     */
    private String clientCertKeyStore;
    /**
     * 客户端证书库密码
     */
    private String clientCertPassword;
    /**
     * 建立连接的超时时间
     */
    private int connectTimeout = 20000;
    /**
     * 连接不够用的等待时间
     */
    private int requestTimeout = 20000;
    /**
     * 每次请求等待返回的超时时间
     */
    private int socketTimeout = 30000;
    /**
     * 每个主机最大连接数
     */
    private int defaultMaxPerRoute = 100;
    /**
     * 最大连接数
     */
    private int maxTotalConnections = 300;
    /**
     * 连接保持活跃的时间（Keep-Alive）
     */
    private int defaultKeepAliveTimeMillis = 20000;
    /**
     * 空闲连接的生存时间
     */
    private int closeIdleConnectionWaitTimeSecs = 30;
}
X509Util工具类
public class X509Util {

    public static X509TrustManager getX509TrustManager(HttpClientProperties properties) {
        try (FileInputStream rootKeyStore = new FileInputStream(properties.getCaRootCertKeyStore())){
            // 加载服务端信任根证书库
            KeyStore trustKeyStore = KeyStore.getInstance("PKCS12");
            trustKeyStore.load(rootKeyStore, properties.getCaRootCertPassword().toCharArray());
            // 初始化服务端信任证书管理器
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(trustKeyStore);
            TrustManager[] trustManagers = tmf.getTrustManagers();
            return (X509TrustManager) trustManagers[0];
        } catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException e) {
            throw new RuntimeException("init trustManager error", e);
        }
    }

    public static KeyManager[] getX509KeyManagers(HttpClientProperties properties) {
        try (FileInputStream clientKeystore = new FileInputStream(properties.getClientCertKeyStore())) {
            // 加载客户端证书库
            KeyStore clientKeyStore = KeyStore.getInstance("PKCS12");
            clientKeyStore.load(clientKeystore, properties.getClientCertPassword().toCharArray());
            KeyManagerFactory keyManagerFactory = KeyManagerFactory
                .getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(clientKeyStore, properties.getClientCertPassword().toCharArray());
            return keyManagerFactory.getKeyManagers();
        } catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException | UnrecoverableKeyException e) {
            throw new RuntimeException("init keyManagers error", e);
        }
    }
}
ICrlService服务类
public interface ICrlService {

    /**
     * 实现此方法查询证书吊销列表
     *
     * @return 证书吊销序列号集合
     */
    Set<String> getCrlList();
}
AbstractUserInfoInterceptor
public abstract class AbstractUserInfoInterceptor implements HttpRequestInterceptor {

    private static final Logger _logger = LoggerFactory.getLogger(AbstractUserInfoInterceptor.class);

    /**
     * 内部微服务之间调用增加的用户信息头
     */
    private static final String HEADER_ACCESS_USER = "access-user";

    public void process(HttpRequest request, HttpContext context) {
        _logger.debug("ClientIPInterceptor start to handle...");
        request.addHeader(HEADER_ACCESS_USER, loadUserInfo());
    }

    /**
     * 加载用户信息
     *
     * @return 用户信息
     */
    protected abstract String loadUserInfo();
}
AbstractClientIPInterceptor
public abstract class AbstractClientIPInterceptor implements HttpRequestInterceptor {

    private static final Logger _logger = LoggerFactory.getLogger(AbstractClientIPInterceptor.class);

    /**
     * 内部微服务之间调用增加的IP地址头
     */
    private static final String HEADER_X_REMOTE_USER_IP = "X-Remote-User-IP";

    public void process(HttpRequest request, HttpContext context) {
        _logger.debug("ClientIPInterceptor start to handle...");
        request.addHeader(HEADER_X_REMOTE_USER_IP, loadRemoteClientIp());
    }

    /**
     * 加载用户真实IP地址
     *
     * @return 用户真实IP地址
     */
    protected abstract String loadRemoteClientIp();
}
SecurityEurekaClientConfig
@Configuration
@EnableConfigurationProperties({HttpClientProperties.class})
@ConditionalOnProperty(value = "dc.security.https.httpclient.eureka", havingValue = "true", matchIfMissing = true)
public class SecurityEurekaClientConfig {

    private static final Logger logger = LoggerFactory.getLogger(SecurityEurekaClientConfig.class);

    @Autowired
    private HttpClientProperties properties;

    @Bean
    public DiscoveryClient.DiscoveryClientOptionalArgs discoveryClientOptionalArgs() throws Exception {
        logger.info("DiscoveryClient.DiscoveryClientOptionalArgs init ...");
        EurekaJerseyClientImpl.EurekaJerseyClientBuilder builder = new EurekaJerseyClientImpl.EurekaJerseyClientBuilder();
        builder.withClientName("eureka-client");
        builder.withCustomSSL(sslContextEureka());
        builder.withMaxTotalConnections(10);
        builder.withMaxConnectionsPerHost(10);
        DiscoveryClient.DiscoveryClientOptionalArgs args = new DiscoveryClient.DiscoveryClientOptionalArgs();
        args.setEurekaJerseyClient(builder.build());
        return args;
    }

    private SSLContext sslContextEureka() throws Exception {
        // 加载服务端信任Keystore
        X509TrustManager origTrustmanager = getX509TrustManager(properties);
        TrustManager[] wrappedTrustManagers = new TrustManager[]{
            new X509TrustManager() {
                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    logger.info(">>>>>>>>>>>>>> sslContextEureka getAcceptedIssuers 00000000000000000 start ...");
                    return origTrustmanager.getAcceptedIssuers();
                }

                @Override
                public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    logger.info(">>>>>>>>>>>>>> sslContextEureka checkClientTrusted 111111111111 start ...");
                }

                @Override
                public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    logger.info(">>>>>>>>>>>>>> sslContextEureka checkServerTrusted 222222222222222 start ...");
                }
            }
        };

        try {
            SSLContext sslContext = SSLContext.getInstance("TLS");
            if (properties.isClientCert()) { // 如果开启客户端证书校验，则需要发送客户端证书
                sslContext.init(getX509KeyManagers(properties), wrappedTrustManagers, new java.security.SecureRandom());
            } else { // 否则不需要发送客户端证书
                sslContext.init(null, wrappedTrustManagers, new java.security.SecureRandom());
            }
            return sslContext;
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            throw new RuntimeException("eureka init sslContext error");
        }
    }
}
主配置类SecurityHttpClientConfig
@Configuration
@ConditionalOnProperty(value = "dc.security.https.httpclient.enabled", havingValue = "true")
@EnableScheduling
@EnableConfigurationProperties({HttpClientProperties.class})
public class SecurityHttpClientConfig {

    private static final Logger logger = LoggerFactory.getLogger(SecurityHttpClientConfig.class);

    @Autowired
    private HttpClientProperties properties;
    @Autowired
    private ICrlService crlService;
    @Autowired
    protected ApplicationContext context;

    @Bean
    @ConditionalOnMissingBean(RestTemplate.class)
    @ConditionalOnProperty(value = "dc.security.https.httpclient.load-balanced", havingValue = "false")
    public RestTemplate restTemplateSimple(RestTemplateBuilder restTemplateBuilder) {
        logger.info("simple RestTemplate");
        return restTemplateBuilder.build();
    }

    @Bean
    @LoadBalanced
    @ConditionalOnMissingBean(RestTemplate.class)
    @ConditionalOnProperty(value = "dc.security.https.httpclient.load-balanced", havingValue = "true", matchIfMissing = true)
    public RestTemplate restTemplateLoadBalanced(RestTemplateBuilder restTemplateBuilder) {
        logger.info("loadBalanced RestTemplate");
        return restTemplateBuilder.build();
    }

    @Bean
    @DependsOn(value = {"customRestTemplateCustomizer"})
    public RestTemplateBuilder restTemplateBuilder(
        MappingJackson2HttpMessageConverter jackson2HttpMessageConverter, SSLContext sslContext) {
        RestTemplateBuilder builder = new RestTemplateBuilder(customRestTemplateCustomizer(sslContext));

        List<HttpMessageConverter<?>> messageConverters = new ArrayList<>();
        StringHttpMessageConverter stringHttpMessageConverter = new StringHttpMessageConverter(StandardCharsets.UTF_8);
        FormHttpMessageConverter formMessageConverter = new FormHttpMessageConverter();
        messageConverters.add(stringHttpMessageConverter);
        messageConverters.add(jackson2HttpMessageConverter);
        messageConverters.add(formMessageConverter);
        builder.messageConverters(messageConverters);

        return builder;
    }

    @Bean
    public RestTemplateCustomizer customRestTemplateCustomizer(SSLContext sslContext) {
        return restTemplate -> {
            HttpComponentsClientHttpRequestFactory rf = new HttpComponentsClientHttpRequestFactory();
            rf.setHttpClient(httpClient(sslContext));
            restTemplate.setRequestFactory(rf);
        };
    }

    @Bean
    public SSLContext sslContext() {
        // 加载服务端信任Keystore
        X509TrustManager origTrustmanager = getX509TrustManager(properties);
        TrustManager[] wrappedTrustManagers = new TrustManager[]{
            new X509TrustManager() {
                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    logger.info(">>>>>>>>>>>>>> getAcceptedIssuers 00000000000000000 start ...");
                    return origTrustmanager.getAcceptedIssuers();
                }

                @Override
                public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    logger.info(">>>>>>>>>>>>>> checkClientTrusted 111111111111 start ...");
                    origTrustmanager.checkClientTrusted(certs, authType);
                }

                @Override
                public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    logger.info(">>>>>>>>>>>>>> checkServerTrusted 222222222222222 start ...");
                    try {
                        //Original trust checking
                        origTrustmanager.checkServerTrusted(certs, authType);

                        //Check revocation with each cert
                        //from docs: CertificateException - if the certificate chain is not trusted by this TrustManager.
                        for (X509Certificate cert : certs) {
                            String certSerial = cert.getSerialNumber().toString(16).toUpperCase();
                            if (crlService.getCrlList().contains(certSerial)) {
                                logger.error("cert serial={} is in crl list, bad", certSerial);
                                throw new CertificateException();
                            }
                        }
                    } catch (CertificateExpiredException e) {
                        logger.error("cert expired error");
                        throw new CertificateExpiredException();
                    }
                }
            }
        };

        try {
            SSLContext sslContext = SSLContext.getInstance("TLS");
            if (properties.isClientCert()) { // 如果开启客户端证书校验，则需要发送客户端证书
                sslContext.init(getX509KeyManagers(properties), wrappedTrustManagers, new java.security.SecureRandom());
            } else { // 否则不需要发送客户端证书
                sslContext.init(null, wrappedTrustManagers, new java.security.SecureRandom());
            }
            return sslContext;
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            throw new RuntimeException("init sslContext error");
        }
    }

    @Bean
    public PoolingHttpClientConnectionManager poolingConnectionManager(SSLContext sslContext) {
        SSLConnectionSocketFactory sslsf;
        try {
            HostnameVerifier hostnameVerifier = (s, sslSession) -> {
                try {
                    Certificate[] certs = sslSession.getPeerCertificates();
                    X509Certificate x509 = (X509Certificate) certs[0];
                } catch (SSLPeerUnverifiedException e) {
                    logger.error("hostnameVerifier error", e);
                    return false;
                }
                return true;
            };
            sslsf = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);
        } catch (Exception e) {
            logger.error("Pooling Connection Manager Initialisation failure");
            throw new RuntimeException("Pooling Connection Manager Initialisation failure", e);
        }
        Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder
            .<ConnectionSocketFactory>create()
            .register("https", sslsf)
            .register("http", new PlainConnectionSocketFactory())
            .build();

        PoolingHttpClientConnectionManager poolingConnectionManager = new PoolingHttpClientConnectionManager(
            socketFactoryRegistry);
        poolingConnectionManager.setMaxTotal(properties.getMaxTotalConnections());  //最大连接数
        poolingConnectionManager.setDefaultMaxPerRoute(properties.getDefaultMaxPerRoute());  //同路由并发数
        return poolingConnectionManager;
    }

    @Bean
    public ConnectionKeepAliveStrategy connectionKeepAliveStrategy() {
        return (response, httpContext) -> {
            HeaderElementIterator it = new BasicHeaderElementIterator
                (response.headerIterator(HTTP.CONN_KEEP_ALIVE));
            while (it.hasNext()) {
                HeaderElement he = it.nextElement();
                String param = he.getName();
                String value = he.getValue();
                if (value != null && param.equalsIgnoreCase("timeout")) {
                    return Long.parseLong(value) * 1000;
                }
            }
            return properties.getDefaultKeepAliveTimeMillis();
        };
    }

    private CloseableHttpClient httpClient(SSLContext sslContext) {
        RequestConfig requestConfig = RequestConfig.custom()
            .setConnectionRequestTimeout(properties.getRequestTimeout())
            .setConnectTimeout(properties.getConnectTimeout())
            .setSocketTimeout(properties.getSocketTimeout()).build();

        HttpClientBuilder httpClientBuilder = HttpClients.custom()
            .setDefaultRequestConfig(requestConfig)
            .setConnectionManager(poolingConnectionManager(sslContext))
            .setKeepAliveStrategy(connectionKeepAliveStrategy())
            .setRetryHandler(new DefaultHttpRequestRetryHandler(3, true));

        // 增加请求拦截器
        Map<String, HttpRequestInterceptor> interceptorMap = context.getBeansOfType(HttpRequestInterceptor.class);
        if (interceptorMap.size() > 0) {
            for (HttpRequestInterceptor interceptor : interceptorMap.values()) {
                httpClientBuilder.addInterceptorLast(interceptor);
            }
        }
        return httpClientBuilder.build();
    }

    /**
     * You can't set an idle connection timeout in the config for Apache HTTP Client. The reason is that there is a
     * performance overhead in doing so.
     * <properties>
     * The documentation clearly states why, and gives an example of an idle connection monitor implementation you can
     * copy. Essentially this is another thread that you run to periodically call closeIdleConnections on
     * HttpClientConnectionManager
     * <properties>
     * http://hc.apache.org/httpcomponents-client-ga/tutorial/html/connmgmt.html
     *
     * @return 线程
     */
    @Bean
    public Runnable idleConnectionMonitor() {
        return new Runnable() {
            @Override
            @Scheduled(fixedDelay = 10000)
            public void run() {
                try {
                    PoolingHttpClientConnectionManager connectionManager = poolingConnectionManager(sslContext());
                    logger.trace("run IdleConnectionMonitor - Closing expired and idle connections...");
                    connectionManager.closeExpiredConnections();
                    connectionManager
                        .closeIdleConnections(properties.getCloseIdleConnectionWaitTimeSecs(), TimeUnit.SECONDS);
                } catch (Exception e) {
                    logger.error("run IdleConnectionMonitor - Exception occurred. msg={}, e={}", e.getMessage(), e);
                }
            }
        };
    }

    @Bean
    @ConditionalOnMissingBean(TaskScheduler.class)
    public TaskScheduler taskScheduler() {
        ThreadPoolTaskScheduler scheduler = new ThreadPoolTaskScheduler();
        scheduler.setThreadNamePrefix("poolScheduler");
        scheduler.setPoolSize(10);
        return scheduler;
    }

    @Bean
    @ConditionalOnMissingBean(ICrlService.class)
    public ICrlService crlService() {
        return HashSet::new;
    }
}

客户端配置

dc:
  security:
    https:
      httpclient:
        enabled: true
        ca-root-cert-key-store: /cert/root.p12  #根证书库
        ca-root-cert-password: 333333 #根证书库密码
        client-cert: true #开启客户端证书
        client-cert-key-store: /cert/server.p12 #客户端证书库
        client-cert-password: 222222 #客户端证书库密码

转载于:https://my.oschina.net/yidao620c/blog/3102222

chenzhi5174
关注
iOS https证书双向认证的实现机制
Z1591090的博客
01-19 5966
文章目录原理单向认证流程双向认证流程证书生成生成自签名根证书生成自签名服务器端证书生成自签名客户端证书AFNetworking对于证书的校验机制 原理 双向认证，顾名思义，客户端和服务器端都需要验证对方的身份，在建立Https连接的过程中，握手的流程比单向认证多了几步。 单向认证的过程，客户端从服务器端下载服务器端公钥证书进行验证，然后建立安全通信通道。 双向通信流程，客户端除了需要从服务器端下载...
https请求封装类 双向认证
09-30
https请求封装类 双向认证 httpclient
RestTemplate HTTPS双向认证
CleanCode的博客
05-15 458
生客户端p12格式证书(client.key+client.crt+rootca.crt -> client.p12)服务端p12格式证书(server.key+server.crt+root.crt -> server.p12)创建(java的信任库)导出server的公钥。导出client的公钥。
SSL证书安装、配置和问题定位指南
最新发布
分享有趣的、贴近生活的CS知识
09-14 631
在运维或者实际的部署、开发，可能涉及到ssl证书相关的问题，尤其前端有些能力（摄像头、webrtc）等需要在安全的上下文才能使用，cookie的跨iframe生效也需要。关于如何生成和部署证书，很多文字都有介绍，本文只做简单的介绍，但额外加了tls证书测试，便于测试部署的证书是否生效，以免调试时定位不到问题。
JAVA使用RestTemplate类实现SSL双向/单向认证（国际）
qq_47275692的博客
03-28 3830
双向/单向认证、国际、SSL
【原创】SpringBoot实现使用httpclient配合restTemplate验证服务器与服务器之间调用接口的TLS/SSL证书双向认证（精简版，附真实项目代码）
HD243608836的博客
07-13 1813
我的项目是服务器与服务器之间调接口，调用是需要ssl证书双向认证的。 yml中配置： ## 证书双向认证配置（本系统作为客户端） client: ssl: abs: # jks与pkcs12（即pfx）都可以。type不区分大小写 # path: ssl/abs/abs@aaa.abc.com.jks # type: JKS path: ssl/abs/abs@aaa.abc.com.pfx type: PKCS
（四）Eureka Server用户认证（双节点为例）
yan17864307817的博客
04-20 245
1.添加依赖 在microservice-discovery-eureka的pom.xml中添加依赖： <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security...
iis证书双向认证配置文档.doc
07-20
【IIS证书双向认证配置】涉及的是在Windows Server 2003系统上，使用IIS 6.0进行SSL安全设置的过程。该配置主要包括五个关键步骤：服务器证书请求文件CSR的生成，证书的安装，SSL安全配置，证书的导出与导入，以及...
Netty双向认证以及白名单证书验证
02-27
本篇文章将深入探讨如何利用Netty实现HTTPS的双向认证（也称为SSL/TLS的客户端身份验证）以及白名单证书验证。 首先，我们需要理解HTTPS的工作原理。HTTPS基于HTTP协议，通过SSL/TLS层提供加密传输和服务器身份验证...
VS2010开发的WCFX509证书双向认证源代码
06-07
【标题】"VS2010开发的WCFX509证书双向认证源代码"涉及的核心技术点主要集中在Windows Communication Foundation（WCF）服务、X509数字证书以及客户端和服务端的双向身份验证。这里我们将深入探讨这些概念及其在实际...
Java安全通信：HTTPS与SSL
springk的专栏
03-19 1272
转自：http://www.cnblogs.com/devinzhang/archive/2012/02/28/2371631.html 1. HTTPS概念         1）简介            HTTPS（全称：Hypertext Transfer Protocol over Secure Socket Layer），是以安全为目标的HTTP通道，简单讲是HTTP的安全版
sun.security.x509.CertAndKeyGen;找不到
weixin_30262255的博客
04-24 2487
导入已有项目编译时出错，报： importsun.security.x509.CertAndKeyGen;找不到 而这个包属于sun公司的jar包。不是项目本身的问题，而是开发环境的问题。 最后原因：我使用的是jdk8，而该项目需要jdk7. jdk版本不一致导致。 反思： 当进到一个新的项目组时，最好将所用开发软件的版本和项目组调整为一致。 转载于:https://www.c...
Spring-Data-Redis 和 Redisson TLS加密 连接
MK 乘风破浪~的博客
03-18 2696
Spring-Data-Redis 和 Redisson TLS/SSL 连接 config.useSingleServer().setAddress("rediss://" + host + ":" + port).setPassword(password);
SpringBoot https双向认证操作
u013187531的博客
05-12 1713
一、构建证书 1、生成TrustStore(信任库)-----trustKeys.p12 ##keytool -genkeypair -alias [alias] -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore [名称] -validity [过期天数] keytool -genkeypair -alias trustkeys -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore trustK
配置SSL绕过https证书请求
周洲 （Julie）
05-19 2167
postman 验证接口时候，如果是https请求，会报错：Self-signed SSL certificates are being blocked，可以点击右上角settings,把on改成off。 在用httpclient请求的时候如何绕过证书呢？ 需要创建一个CloseableHttpClient对象。 创建HTTPpost/get对象，setHeader。 创建String...
07-HTTPS双向认证及Java案例
River的博客
11-21 2588
HTTPS双向认证的Java案例代码
TLS双向认证配置（nginx+apache）
weixing100200的专栏
01-07 1398
client 访问apache，apache配置双向认证参数： #Mutual TLS authentication SSLVerifyClient require SSLVerifyDepth 2 深度，客户端证书到根证书的深度 SSLCACertificateFile /etc/pki/tls/certs/abcgkmangcn/rootca.crt （客户端证书对应的根证书） nignx+...
https证书双向认证
07-27
HTTPS证书双向认证是一种安全通信协议，在客户端和服务器之间建立安全连接时使用。它通过使用公钥加密技术和数字证书来验证服务器和客户端的身份。 在传统的单向认证中，只有服务器需要验证其身份，并且客户端可以验证服务器的证书。而双向认证要求客户端也要提供一个证书，以供服务器验证其身份。 具体的认证过程如下： 1. 客户端向服务器发送连接请求。 2. 服务器返回自己的数字证书给客户端，其中包含了服务器的公钥。 3. 客户端验证服务器的数字证书的有效性和合法性，以确保连接的安全性。 4. 客户端使用服务器的公钥加密随机生成的对称密钥，并将其发送给服务器。 5. 服务器使用私钥解密客户端发送的对称密钥，并使用该对称密钥加密后续通信。 6. 双方使用对称密钥进行加密通信，保证数据的私密性和完整性。 通过双向认证，可以有效防止中间人攻击和伪装攻击，提高通信的安全性。常见的应用场景包括网银系统、电子商务平台等需要高度安全性的系统。
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值