tomcat + httpclient SSL单向认证https

环境准备

• java环境
• tomcat web容器
• chrome浏览器
• eclipse、maven等编写代码
• keytool java内置生成证书秘钥工具
• 其他配置，如tomcat环境配置、hosts配置等

HTTPS原理

核心是引入第三方验证将核心key影藏在网络传输中

单向验证：客户端验证服务器的证书，服务器不验证客户端的证书。

秘钥和证书

生成服务器端的keystore.

1. 生成jks格式服务器端的keystore文件，keypass与storepass需一致，因tomcat server.xml中仅一处keystorePass ，生成文件为serverKeystore.jks

keytool -genkey -alias server -keystore serverKeystore.jks -keypass 123456 -storepass 123456 -keyalg RSA  -keysize 512 -validity 365 -v -dname "CN = test.com,O = ABC BANK,DC = Server Https,DC = ABC,OU = Firefly Technology And Operation"

其中test.com为访问域名，需要配置host文件

127.0.0.1 test.com

2. 从keystore中导出别名为server的服务端证书 server.cer

keytool -export -alias server -keystore serverKeystore.jks -storepass 123456 -file server.cer

3. 将server.cer导入客户端的信任证书库clientTruststore.jks

keytool -import -alias trustServer -file server.cer -keystore clientTruststore.jks -storepass 123456

生成以后三个文件，其中serverKeystore.jks配置在服务端， server.cer为浏览器配置需要使用，clientTruststore.jks为httpclient 需要使用

配置tomcat中server.xml，并测试是否配置成功

添加如下配置文件，配置keystore文件位置和密码

	<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"  
                 maxThreads="150" scheme="https" secure="true"  
             clientAuth="false" sslProtocol="TLS"   
             keystoreFile="C:/tmp/https/apache-tomcat-7.0.94/conf/temp/serverKeystore.jks" keystorePass="123456"  />  

windows下，双击startup.bat批处理文件，启动tomcat测试

输入测试地址：https://test.com:8443/

点击高级，继续前往访问

其中，这一步是从服务器下载了证书，点击证书 server.cer，查看

是我们生成的证书

证书是无效，因为证书都需要指定组织机构颁发，这里可以使用，因为属于RSA算法里面的非对称解密使用

httpclient 单向认证

通过maven配置依赖的库

		<dependency>
			<groupId>org.apache.httpcomponents</groupId>
			<artifactId>httpclient</artifactId>
			<version>4.5.6</version>
		</dependency>
		<dependency>
			<groupId>org.apache.httpcomponents</groupId>
			<artifactId>httpmime</artifactId>
			<version>4.5.6</version>
		</dependency>

直接去官网找到对应的ssl例子：地址，所有平时也不要问别人代码应该怎么写，官网的例子就是最好的，直接去官网查看。这里我稍等改一下clientTruststore.jks相关的，具体代码如下

import java.io.File;

import javax.net.ssl.SSLContext;

import org.apache.http.HttpEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import org.apache.http.util.EntityUtils;

/**
 * This example demonstrates how to create secure connections with a custom SSL
 * context.
 */
public class ClientCustomSSL {

    public final static void main(String[] args) throws Exception {
        // Trust own CA and all self-signed certs
        SSLContext sslcontext = SSLContexts.custom()
                .loadTrustMaterial(new File("C:/tmp/https/apache-tomcat-7.0.94/conf/temp/clientTruststore.jks"), "123456".toCharArray(),
                        new TrustSelfSignedStrategy())
                .build();
        // Allow TLSv1 protocol only
        SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
                sslcontext,
                new String[] { "TLSv1" },
                null,
                SSLConnectionSocketFactory.getDefaultHostnameVerifier());
        CloseableHttpClient httpclient = HttpClients.custom()
                .setSSLSocketFactory(sslsf)
                .build();
        try {

            HttpGet httpget = new HttpGet("https://test.com:8443/");

            System.out.println("Executing request " + httpget.getRequestLine());

            CloseableHttpResponse response = httpclient.execute(httpget);
            try {
                HttpEntity entity = response.getEntity();

                System.out.println("----------------------------------------");
                System.out.println(response.getStatusLine());
                EntityUtils.consume(entity);
            } finally {
                response.close();
            }
        } finally {
            httpclient.close();
        }
    }

}

测试通过

keetook参考