Java加密技术（九）

关键字: ssl

在 Java加密技术（八）中，我们模拟了一个基于 RSA非对称加密网络的安全通信。现在我们深度了解一下现有的安全网络通信——SSL。
我们需要构建一个由CA机构签发的有效证书，这里我们使用上文中生成的自签名证书 zlex.cer
这里，我们将证书导入到我们的密钥库。

Shell代码

1. keytool-import-aliaswww.zlex.org-filed:/zlex.cer-keystored:/zlex.keystore

keytool -import -alias www.zlex.org -file d:/zlex.cer -keystore d:/zlex.keystore

其中
-import表示 导入
-alias指定别名，这里是 www.zlex.org
-file指定算法，这里是 d:/zlex.cer
-keystore指定存储位置，这里是 d:/zlex.keystore
在这里我使用的密码为 654321

控制台输出：

Console代码

1. 输入keystore密码：
2. 再次输入新密码:
3. 所有者:CN=www.zlex.org,OU=zlex,O=zlex,L=BJ,ST=BJ,C=CN
4. 签发人:CN=www.zlex.org,OU=zlex,O=zlex,L=BJ,ST=BJ,C=CN
5. 序列号:4a1e48df
6. 有效期:ThuMay2816:18:39CST2009至WedAug2616:18:39CST2009
7. 证书指纹:
8. MD5:19:CA:E6:36:E2:DF:AD:96:31:97:2F:A9:AD:FC:37:6A
9. SHA1:49:88:30:59:29:45:F1:69:CA:97:A9:6D:8A:CF:08:D2:C3:D5:C0:C4
10. 签名算法名称:SHA1withRSA
11. 版本:3
12. 信任这个认证？[否]：y
13. 认证已添加至keystore中

输入keystore密码：
再次输入新密码:
所有者:CN=www.zlex.org, OU=zlex, O=zlex, L=BJ, ST=BJ, C=CN
签发人:CN=www.zlex.org, OU=zlex, O=zlex, L=BJ, ST=BJ, C=CN
序列号:4a1e48df
有效期: Thu May 28 16:18:39 CST 2009 至Wed Aug 26 16:18:39 CST 2009
证书指纹:
         MD5:19:CA:E6:36:E2:DF:AD:96:31:97:2F:A9:AD:FC:37:6A
         SHA1:49:88:30:59:29:45:F1:69:CA:97:A9:6D:8A:CF:08:D2:C3:D5:C0:C4
         签名算法名称:SHA1withRSA
         版本: 3
信任这个认证？ [否]：  y
认证已添加至keystore中

OK，最复杂的准备工作已经完成。
接下来我们将域名 www.zlex.org定位到本机上。打开 C:\Windows\System32\drivers\etc\hosts文件，将 www.zlex.org绑定在本机上。在文件末尾追加 127.0.0.1 www.zlex.org。现在通过地址栏访问 http://www.zlex.org，或者通过 ping命令，如果能够定位到本机，域名映射就搞定了。
现在，配置tomcat。先将 zlex.keystore拷贝到tomcat的conf目录下，然后配置 server.xml。将如下内容加入配置文件

Xml代码

1. <Connector
2. SSLEnabled="true"
3. URIEncoding="UTF-8"
4. clientAuth="false"
5. keystoreFile="conf/zlex.keystore"
6. keystorePass="123456"
7. maxThreads="150"
8. port="443"
9. protocol="HTTP/1.1"
10. scheme="https"
11. secure="true"
12. sslProtocol="TLS"/>

		<Connector
			SSLEnabled="true"
			URIEncoding="UTF-8"
			clientAuth="false"
			keystoreFile="conf/zlex.keystore"
			keystorePass="123456"
			maxThreads="150"
			port="443"
			protocol="HTTP/1.1"
			scheme="https"
			secure="true"
			sslProtocol="TLS" />

注意 clientAuth="false"测试阶段，置为 false，正式使用时建议使用 true。现在启动tomcat，访问 https://www.zlex.org/。
显然，证书未能通过认证，这个时候你可以选择安装证书（上文中的 zlex.cer文件就是证书），作为 受信任的根证书颁发机构导入，再次重启浏览器（IE，其他浏览器对于域名www.zlex.org不支持本地方式访问），访问 https://www.zlex.org/，你会看到地址栏中会有个小锁 ，就说明安装成功。所有的浏览器联网操作已经在 RSA加密解密系统的保护之下了。但似乎我们感受不到。
这个时候很多人开始怀疑，如果我们要手工做一个这样的https的访问是不是需要把浏览器的这些个功能都实现呢？不需要！

接着上篇内容，给出如下代码实现：

Java代码

1. importjava.io.FileInputStream;
2. importjava.security.KeyStore;
3. importjava.security.PrivateKey;
4. importjava.security.PublicKey;
5. importjava.security.Signature;
6. importjava.security.cert.Certificate;
7. importjava.security.cert.CertificateFactory;
8. importjava.security.cert.X509Certificate;
9. importjava.util.Date;
11. importjavax.crypto.Cipher;
12. importjavax.net.ssl.HttpsURLConnection;
13. importjavax.net.ssl.KeyManagerFactory;
14. importjavax.net.ssl.SSLContext;
15. importjavax.net.ssl.SSLSocketFactory;
16. importjavax.net.ssl.TrustManagerFactory;
18. /**
19. *证书组件
20. *
21. *@author梁栋
22. *@version1.0
23. *@since1.0
24. */
25. publicabstractclassCertificateCoderextendsCoder{
27. /**
28. *Java密钥库(JavaKeyStore，JKS)KEY_STORE
29. */
30. publicstaticfinalStringKEY_STORE="JKS";
32. publicstaticfinalStringX509="X.509";
33. publicstaticfinalStringSunX509="SunX509";
34. publicstaticfinalStringSSL="SSL";
36. /**
37. *由KeyStore获得私钥
38. *
39. *@paramkeyStorePath
40. *@paramalias
41. *@parampassword
42. *@return
43. *@throwsException
44. */
45. privatestaticPrivateKeygetPrivateKey(StringkeyStorePath,Stringalias,
46. Stringpassword)throwsException{
47. KeyStoreks=getKeyStore(keyStorePath,password);
48. PrivateKeykey=(PrivateKey)ks.getKey(alias,password.toCharArray());
49. returnkey;
50. }
52. /**
53. *由Certificate获得公钥
54. *
55. *@paramcertificatePath
56. *@return
57. *@throwsException
58. */
59. privatestaticPublicKeygetPublicKey(StringcertificatePath)
60. throwsException{
61. Certificatecertificate=getCertificate(certificatePath);
62. PublicKeykey=certificate.getPublicKey();
63. returnkey;
64. }
66. /**
67. *获得Certificate
68. *
69. *@paramcertificatePath
70. *@return
71. *@throwsException
72. */
73. privatestaticCertificategetCertificate(StringcertificatePath)
74. throwsException{
75. CertificateFactorycertificateFactory=CertificateFactory
76. .getInstance(X509);
77. FileInputStreamin=newFileInputStream(certificatePath);
79. Certificatecertificate=certificateFactory.generateCertificate(in);
80. in.close();
82. returncertificate;
83. }
85. /**
86. *获得Certificate
87. *
88. *@paramkeyStorePath
89. *@paramalias
90. *@parampassword
91. *@return
92. *@throwsException
93. */
94. privatestaticCertificategetCertificate(StringkeyStorePath,
95. Stringalias,Stringpassword)throwsException{
96. KeyStoreks=getKeyStore(keyStorePath,password);
97. Certificatecertificate=ks.getCertificate(alias);
99. returncertificate;
100. }
102. /**
103. *获得KeyStore
104. *
105. *@paramkeyStorePath
106. *@parampassword
107. *@return
108. *@throwsException
109. */
110. privatestaticKeyStoregetKeyStore(StringkeyStorePath,Stringpassword)
111. throwsException{
112. FileInputStreamis=newFileInputStream(keyStorePath);
113. KeyStoreks=KeyStore.getInstance(KEY_STORE);
114. ks.load(is,password.toCharArray());
115. is.close();
116. returnks;
117. }
119. /**
120. *私钥加密
121. *
122. *@paramdata
123. *@paramkeyStorePath
124. *@paramalias
125. *@parampassword
126. *@return
127. *@throwsException
128. */
129. publicstaticbyte[]encryptByPrivateKey(byte[]data,StringkeyStorePath,
130. Stringalias,Stringpassword)throwsException{
131. //取得私钥
132. PrivateKeyprivateKey=getPrivateKey(keyStorePath,alias,password);
134. //对数据加密
135. Ciphercipher=Cipher.getInstance(privateKey.getAlgorithm());
136. cipher.init(Cipher.ENCRYPT_MODE,privateKey);
138. returncipher.doFinal(data);
140. }
142. /**
143. *私钥解密
144. *
145. *@paramdata
146. *@paramkeyStorePath
147. *@paramalias
148. *@parampassword
149. *@return
150. *@throwsException
151. */
152. publicstaticbyte[]decryptByPrivateKey(byte[]data,StringkeyStorePath,
153. Stringalias,Stringpassword)throwsException{
154. //取得私钥
155. PrivateKeyprivateKey=getPrivateKey(keyStorePath,alias,password);
157. //对数据加密
158. Ciphercipher=Cipher.getInstance(privateKey.getAlgorithm());
159. cipher.init(Cipher.DECRYPT_MODE,privateKey);
161. returncipher.doFinal(data);
163. }
165. /**
166. *公钥加密
167. *
168. *@paramdata
169. *@paramcertificatePath
170. *@return
171. *@throwsException
172. */
173. publicstaticbyte[]encryptByPublicKey(byte[]data,StringcertificatePath)
174. throwsException{
176. //取得公钥
177. PublicKeypublicKey=getPublicKey(certificatePath);
178. //对数据加密
179. Ciphercipher=Cipher.getInstance(publicKey.getAlgorithm());
180. cipher.init(Cipher.ENCRYPT_MODE,publicKey);
182. returncipher.doFinal(data);
184. }
186. /**
187. *公钥解密
188. *
189. *@paramdata
190. *@paramcertificatePath
191. *@return
192. *@throwsException
193. */
194. publicstaticbyte[]decryptByPublicKey(byte[]data,StringcertificatePath)
195. throwsException{
196. //取得公钥
197. PublicKeypublicKey=getPublicKey(certificatePath);
199. //对数据加密
200. Ciphercipher=Cipher.getInstance(publicKey.getAlgorithm());
201. cipher.init(Cipher.DECRYPT_MODE,publicKey);
203. returncipher.doFinal(data);
205. }
207. /**
208. *验证Certificate
209. *
210. *@paramcertificatePath
211. *@return
212. */
213. publicstaticbooleanverifyCertificate(StringcertificatePath){
214. returnverifyCertificate(newDate(),certificatePath);
215. }
217. /**
218. *验证Certificate是否过期或无效
219. *
220. *@paramdate
221. *@paramcertificatePath
222. *@return
223. */
224. publicstaticbooleanverifyCertificate(Datedate,StringcertificatePath){
225. booleanstatus=true;
226. try{
227. //取得证书
228. Certificatecertificate=getCertificate(certificatePath);
229. //验证证书是否过期或无效
230. status=verifyCertificate(date,certificate);
231. }catch(Exceptione){
232. status=false;
233. }
234. returnstatus;
235. }
237. /**
238. *验证证书是否过期或无效
239. *
240. *@paramdate
241. *@paramcertificate
242. *@return
243. */
244. privatestaticbooleanverifyCertificate(Datedate,Certificatecertificate){
245. booleanstatus=true;
246. try{
247. X509Certificatex509Certificate=(X509Certificate)certificate;
248. x509Certificate.checkValidity(date);
249. }catch(Exceptione){
250. status=false;
251. }
252. returnstatus;
253. }
255. /**
256. *签名
257. *
258. *@paramkeyStorePath
259. *@paramalias
260. *@parampassword
261. *
262. *@return
263. *@throwsException
264. */
265. publicstaticStringsign(byte[]sign,StringkeyStorePath,Stringalias,
266. Stringpassword)throwsException{
267. //获得证书
268. X509Certificatex509Certificate=(X509Certificate)getCertificate(
269. keyStorePath,alias,password);
270. //获取私钥
271. KeyStoreks=getKeyStore(keyStorePath,password);
272. //取得私钥
273. PrivateKeyprivateKey=(PrivateKey)ks.getKey(alias,password
274. .toCharArray());
276. //构建签名
277. Signaturesignature=Signature.getInstance(x509Certificate
278. .getSigAlgName());
279. signature.initSign(privateKey);
280. signature.update(sign);
281. returnencryptBASE64(signature.sign());
282. }
284. /**
285. *验证签名
286. *
287. *@paramdata
288. *@paramsign
289. *@paramcertificatePath
290. *@return
291. *@throwsException
292. */
293. publicstaticbooleanverify(byte[]data,Stringsign,
294. StringcertificatePath)throwsException{
295. //获得证书
296. X509Certificatex509Certificate=(X509Certificate)getCertificate(certificatePath);
297. //获得公钥
298. PublicKeypublicKey=x509Certificate.getPublicKey();
299. //构建签名
300. Signaturesignature=Signature.getInstance(x509Certificate
301. .getSigAlgName());
302. signature.initVerify(publicKey);
303. signature.update(data);
305. returnsignature.verify(decryptBASE64(sign));
307. }
309. /**
310. *验证Certificate
311. *
312. *@paramkeyStorePath
313. *@paramalias
314. *@parampassword
315. *@return
316. */
317. publicstaticbooleanverifyCertificate(Datedate,StringkeyStorePath,
318. Stringalias,Stringpassword){
319. booleanstatus=true;
320. try{
321. Certificatecertificate=getCertificate(keyStorePath,alias,
322. password);
323. status=verifyCertificate(date,certificate);
324. }catch(Exceptione){
325. status=false;
326. }
327. returnstatus;
328. }
330. /**
331. *验证Certificate
332. *
333. *@paramkeyStorePath
334. *@paramalias
335. *@parampassword
336. *@return
337. */
338. publicstaticbooleanverifyCertificate(StringkeyStorePath,Stringalias,
339. Stringpassword){
340. returnverifyCertificate(newDate(),keyStorePath,alias,password);
341. }
343. /**
344. *获得SSLSocektFactory
345. *
346. *@parampassword
347. *密码
348. *@paramkeyStorePath
349. *密钥库路径
350. *
351. *@paramtrustKeyStorePath
352. *信任库路径
353. *@return
354. *@throwsException
355. */
356. privatestaticSSLSocketFactorygetSSLSocketFactory(Stringpassword,
357. StringkeyStorePath,StringtrustKeyStorePath)throwsException{
358. //初始化密钥库
359. KeyManagerFactorykeyManagerFactory=KeyManagerFactory
360. .getInstance(SunX509);
361. KeyStorekeyStore=getKeyStore(keyStorePath,password);
362. keyManagerFactory.init(keyStore,password.toCharArray());
364. //初始化信任库
365. TrustManagerFactorytrustManagerFactory=TrustManagerFactory
366. .getInstance(SunX509);
367. KeyStoretrustkeyStore=getKeyStore(trustKeyStorePath,password);
368. trustManagerFactory.init(trustkeyStore);
370. //初始化SSL上下文
371. SSLContextctx=SSLContext.getInstance(SSL);
372. ctx.init(keyManagerFactory.getKeyManagers(),trustManagerFactory
373. .getTrustManagers(),null);
374. SSLSocketFactorysf=ctx.getSocketFactory();
376. returnsf;
377. }
379. /**
380. *为HttpsURLConnection配置SSLSocketFactory
381. *
382. *@paramconn
383. *HttpsURLConnection
384. *@parampassword
385. *密码
386. *@paramkeyStorePath
387. *密钥库路径
388. *
389. *@paramtrustKeyStorePath
390. *信任库路径
391. *@throwsException
392. */
393. publicstaticvoidconfigSSLSocketFactory(HttpsURLConnectionconn,
394. Stringpassword,StringkeyStorePath,StringtrustKeyStorePath)
395. throwsException{
396. conn.setSSLSocketFactory(getSSLSocketFactory(password,keyStorePath,
397. trustKeyStorePath));
398. }
399. }

import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Date;

import javax.crypto.Cipher;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManagerFactory;

/**
 * 证书组件
 * 
 * @author 梁栋
 * @version 1.0
 * @since 1.0
 */
public abstract class CertificateCoder extends Coder {

	/**
	 * Java密钥库(Java Key Store，JKS)KEY_STORE
	 */
	public static final String KEY_STORE = "JKS";

	public static final String X509 = "X.509";
	public static final String SunX509 = "SunX509";
	public static final String SSL = "SSL";

	/**
	 * 由KeyStore获得私钥
	 * 
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * @return
	 * @throws Exception
	 */
	private static PrivateKey getPrivateKey(String keyStorePath, String alias,
			String password) throws Exception {
		KeyStore ks = getKeyStore(keyStorePath, password);
		PrivateKey key = (PrivateKey) ks.getKey(alias, password.toCharArray());
		return key;
	}

	/**
	 * 由Certificate获得公钥
	 * 
	 * @param certificatePath
	 * @return
	 * @throws Exception
	 */
	private static PublicKey getPublicKey(String certificatePath)
			throws Exception {
		Certificate certificate = getCertificate(certificatePath);
		PublicKey key = certificate.getPublicKey();
		return key;
	}

	/**
	 * 获得Certificate
	 * 
	 * @param certificatePath
	 * @return
	 * @throws Exception
	 */
	private static Certificate getCertificate(String certificatePath)
			throws Exception {
		CertificateFactory certificateFactory = CertificateFactory
				.getInstance(X509);
		FileInputStream in = new FileInputStream(certificatePath);

		Certificate certificate = certificateFactory.generateCertificate(in);
		in.close();

		return certificate;
	}

	/**
	 * 获得Certificate
	 * 
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * @return
	 * @throws Exception
	 */
	private static Certificate getCertificate(String keyStorePath,
			String alias, String password) throws Exception {
		KeyStore ks = getKeyStore(keyStorePath, password);
		Certificate certificate = ks.getCertificate(alias);

		return certificate;
	}

	/**
	 * 获得KeyStore
	 * 
	 * @param keyStorePath
	 * @param password
	 * @return
	 * @throws Exception
	 */
	private static KeyStore getKeyStore(String keyStorePath, String password)
			throws Exception {
		FileInputStream is = new FileInputStream(keyStorePath);
		KeyStore ks = KeyStore.getInstance(KEY_STORE);
		ks.load(is, password.toCharArray());
		is.close();
		return ks;
	}

	/**
	 * 私钥加密
	 * 
	 * @param data
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * @return
	 * @throws Exception
	 */
	public static byte[] encryptByPrivateKey(byte[] data, String keyStorePath,
			String alias, String password) throws Exception {
		// 取得私钥
		PrivateKey privateKey = getPrivateKey(keyStorePath, alias, password);

		// 对数据加密
		Cipher cipher = Cipher.getInstance(privateKey.getAlgorithm());
		cipher.init(Cipher.ENCRYPT_MODE, privateKey);

		return cipher.doFinal(data);

	}

	/**
	 * 私钥解密
	 * 
	 * @param data
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * @return
	 * @throws Exception
	 */
	public static byte[] decryptByPrivateKey(byte[] data, String keyStorePath,
			String alias, String password) throws Exception {
		// 取得私钥
		PrivateKey privateKey = getPrivateKey(keyStorePath, alias, password);

		// 对数据加密
		Cipher cipher = Cipher.getInstance(privateKey.getAlgorithm());
		cipher.init(Cipher.DECRYPT_MODE, privateKey);

		return cipher.doFinal(data);

	}

	/**
	 * 公钥加密
	 * 
	 * @param data
	 * @param certificatePath
	 * @return
	 * @throws Exception
	 */
	public static byte[] encryptByPublicKey(byte[] data, String certificatePath)
			throws Exception {

		// 取得公钥
		PublicKey publicKey = getPublicKey(certificatePath);
		// 对数据加密
		Cipher cipher = Cipher.getInstance(publicKey.getAlgorithm());
		cipher.init(Cipher.ENCRYPT_MODE, publicKey);

		return cipher.doFinal(data);

	}

	/**
	 * 公钥解密
	 * 
	 * @param data
	 * @param certificatePath
	 * @return
	 * @throws Exception
	 */
	public static byte[] decryptByPublicKey(byte[] data, String certificatePath)
			throws Exception {
		// 取得公钥
		PublicKey publicKey = getPublicKey(certificatePath);

		// 对数据加密
		Cipher cipher = Cipher.getInstance(publicKey.getAlgorithm());
		cipher.init(Cipher.DECRYPT_MODE, publicKey);

		return cipher.doFinal(data);

	}

	/**
	 * 验证Certificate
	 * 
	 * @param certificatePath
	 * @return
	 */
	public static boolean verifyCertificate(String certificatePath) {
		return verifyCertificate(new Date(), certificatePath);
	}

	/**
	 * 验证Certificate是否过期或无效
	 * 
	 * @param date
	 * @param certificatePath
	 * @return
	 */
	public static boolean verifyCertificate(Date date, String certificatePath) {
		boolean status = true;
		try {
			// 取得证书
			Certificate certificate = getCertificate(certificatePath);
			// 验证证书是否过期或无效
			status = verifyCertificate(date, certificate);
		} catch (Exception e) {
			status = false;
		}
		return status;
	}

	/**
	 * 验证证书是否过期或无效
	 * 
	 * @param date
	 * @param certificate
	 * @return
	 */
	private static boolean verifyCertificate(Date date, Certificate certificate) {
		boolean status = true;
		try {
			X509Certificate x509Certificate = (X509Certificate) certificate;
			x509Certificate.checkValidity(date);
		} catch (Exception e) {
			status = false;
		}
		return status;
	}

	/**
	 * 签名
	 * 
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * 
	 * @return
	 * @throws Exception
	 */
	public static String sign(byte[] sign, String keyStorePath, String alias,
			String password) throws Exception {
		// 获得证书
		X509Certificate x509Certificate = (X509Certificate) getCertificate(
				keyStorePath, alias, password);
		// 获取私钥
		KeyStore ks = getKeyStore(keyStorePath, password);
		// 取得私钥
		PrivateKey privateKey = (PrivateKey) ks.getKey(alias, password
				.toCharArray());

		// 构建签名
		Signature signature = Signature.getInstance(x509Certificate
				.getSigAlgName());
		signature.initSign(privateKey);
		signature.update(sign);
		return encryptBASE64(signature.sign());
	}

	/**
	 * 验证签名
	 * 
	 * @param data
	 * @param sign
	 * @param certificatePath
	 * @return
	 * @throws Exception
	 */
	public static boolean verify(byte[] data, String sign,
			String certificatePath) throws Exception {
		// 获得证书
		X509Certificate x509Certificate = (X509Certificate) getCertificate(certificatePath);
		// 获得公钥
		PublicKey publicKey = x509Certificate.getPublicKey();
		// 构建签名
		Signature signature = Signature.getInstance(x509Certificate
				.getSigAlgName());
		signature.initVerify(publicKey);
		signature.update(data);

		return signature.verify(decryptBASE64(sign));

	}

	/**
	 * 验证Certificate
	 * 
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * @return
	 */
	public static boolean verifyCertificate(Date date, String keyStorePath,
			String alias, String password) {
		boolean status = true;
		try {
			Certificate certificate = getCertificate(keyStorePath, alias,
					password);
			status = verifyCertificate(date, certificate);
		} catch (Exception e) {
			status = false;
		}
		return status;
	}

	/**
	 * 验证Certificate
	 * 
	 * @param keyStorePath
	 * @param alias
	 * @param password
	 * @return
	 */
	public static boolean verifyCertificate(String keyStorePath, String alias,
			String password) {
		return verifyCertificate(new Date(), keyStorePath, alias, password);
	}

	/**
	 * 获得SSLSocektFactory
	 * 
	 * @param password
	 *            密码
	 * @param keyStorePath
	 *            密钥库路径
	 * 
	 * @param trustKeyStorePath
	 *            信任库路径
	 * @return
	 * @throws Exception
	 */
	private static SSLSocketFactory getSSLSocketFactory(String password,
			String keyStorePath, String trustKeyStorePath) throws Exception {
		// 初始化密钥库
		KeyManagerFactory keyManagerFactory = KeyManagerFactory
				.getInstance(SunX509);
		KeyStore keyStore = getKeyStore(keyStorePath, password);
		keyManagerFactory.init(keyStore, password.toCharArray());

		// 初始化信任库
		TrustManagerFactory trustManagerFactory = TrustManagerFactory
				.getInstance(SunX509);
		KeyStore trustkeyStore = getKeyStore(trustKeyStorePath, password);
		trustManagerFactory.init(trustkeyStore);

		// 初始化SSL上下文
		SSLContext ctx = SSLContext.getInstance(SSL);
		ctx.init(keyManagerFactory.getKeyManagers(), trustManagerFactory
				.getTrustManagers(), null);
		SSLSocketFactory sf = ctx.getSocketFactory();

		return sf;
	}

	/**
	 * 为HttpsURLConnection配置SSLSocketFactory
	 * 
	 * @param conn
	 *            HttpsURLConnection
	 * @param password
	 *            密码
	 * @param keyStorePath
	 *            密钥库路径
	 * 
	 * @param trustKeyStorePath
	 *            信任库路径
	 * @throws Exception
	 */
	public static void configSSLSocketFactory(HttpsURLConnection conn,
			String password, String keyStorePath, String trustKeyStorePath)
			throw