环境准备
- java环境
- tomcat web容器
- chrome浏览器
- eclipse、maven等编写代码
keytool
java内置生成证书秘钥工具- 其他配置,如tomcat环境配置、hosts配置等
HTTPS原理
核心是引入第三方验证将核心key影藏在网络传输中
单向验证:客户端验证服务器的证书,服务器不验证客户端的证书。
秘钥和证书
生成服务器端的keystore.
- 生成jks格式服务器端的keystore文件,keypass与storepass需一致,因tomcat server.xml中仅一处keystorePass ,生成文件为
serverKeystore.jks
keytool -genkey -alias server -keystore serverKeystore.jks -keypass 123456 -storepass 123456 -keyalg RSA -keysize 512 -validity 365 -v -dname "CN = test.com,O = ABC BANK,DC = Server Https,DC = ABC,OU = Firefly Technology And Operation"
其中test.com
为访问域名,需要配置host文件
127.0.0.1 test.com
- 从keystore中导出别名为server的服务端证书
server.cer
keytool -export -alias server -keystore serverKeystore.jks -storepass 123456 -file server.cer
- 将server.cer导入客户端的信任证书库
clientTruststore.jks
keytool -import -alias trustServer -file server.cer -keystore clientTruststore.jks -storepass 123456
生成以后三个文件,其中serverKeystore.jks
配置在服务端, server.cer
为浏览器配置需要使用,clientTruststore.jks
为httpclient 需要使用
配置tomcat中server.xml,并测试是否配置成功
添加如下配置文件,配置keystore文件位置和密码
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="C:/tmp/https/apache-tomcat-7.0.94/conf/temp/serverKeystore.jks" keystorePass="123456" />
windows下,双击startup.bat批处理文件,启动tomcat测试
输入测试地址:https://test.com:8443/
点击高级,继续前往访问
其中,这一步是从服务器下载了证书,点击证书 server.cer
,查看
是我们生成的证书
证书是无效,因为证书都需要指定组织机构颁发,这里可以使用,因为属于RSA算法里面的非对称解密使用
httpclient 单向认证
通过maven配置依赖的库
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.5.6</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpmime</artifactId>
<version>4.5.6</version>
</dependency>
直接去官网找到对应的ssl例子:地址,所有平时也不要问别人代码应该怎么写,官网的例子就是最好的,直接去官网查看。这里我稍等改一下clientTruststore.jks
相关的,具体代码如下
import java.io.File;
import javax.net.ssl.SSLContext;
import org.apache.http.HttpEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import org.apache.http.util.EntityUtils;
/**
* This example demonstrates how to create secure connections with a custom SSL
* context.
*/
public class ClientCustomSSL {
public final static void main(String[] args) throws Exception {
// Trust own CA and all self-signed certs
SSLContext sslcontext = SSLContexts.custom()
.loadTrustMaterial(new File("C:/tmp/https/apache-tomcat-7.0.94/conf/temp/clientTruststore.jks"), "123456".toCharArray(),
new TrustSelfSignedStrategy())
.build();
// Allow TLSv1 protocol only
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
sslcontext,
new String[] { "TLSv1" },
null,
SSLConnectionSocketFactory.getDefaultHostnameVerifier());
CloseableHttpClient httpclient = HttpClients.custom()
.setSSLSocketFactory(sslsf)
.build();
try {
HttpGet httpget = new HttpGet("https://test.com:8443/");
System.out.println("Executing request " + httpget.getRequestLine());
CloseableHttpResponse response = httpclient.execute(httpget);
try {
HttpEntity entity = response.getEntity();
System.out.println("----------------------------------------");
System.out.println(response.getStatusLine());
EntityUtils.consume(entity);
} finally {
response.close();
}
} finally {
httpclient.close();
}
}
}
测试通过