Java调用https协议的webService

Java调用https协议的webService

背景：项目中遇到需要兼容http和https的情况，且需要调用多个https的服务，故将解决方案做个记录，供以后查看

两种情况：
1、仅调用一个https协议的webService接口
2、调用多个https协议的webService接口

1、调用接口前准备操作-生成证书到本地

InstallCert.java

import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;  
 /**
  * 
  */
public class InstallCert {  
	
	public static String defaultPassPhrase = "changeit";
	public static char SEP = File.separatorChar; 
	public static String certPath = "/usr/local/security/";
	public static String certName = "jssecacerts";

	public static void main(String[] args) throws Exception
    {
        args = new String[]{"1.1.1.1:8080"};
        getCert(args);
    }
  
    public static void getCert(String args) throws Exception {
    String host;  
    int port;  
    String[] c = args.split(":");  
    if(c.length == 1) {
    	System.out.println("please input like this: 1.1.1.1:8080 or www.baidu.com:443 ...");  
    	return ;
    }
    host = c[0];  
    port = Integer.parseInt(c[1]);  
    char[] passphrase = defaultPassPhrase.toCharArray();  
  
    File file = new File(certName);  
    if (file.isFile() == false) {  
        File dir = new File(System.getProperty("java.home") + SEP  
            + "lib" + SEP + "security");  
        file = new File(dir, "cacerts");  
    }  
    System.out.println("Loading KeyStore " + file + "...");  
    InputStream in = new FileInputStream(file);  
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());  
    ks.load(in, passphrase);  
    in.close();  
  
    SSLContext context = SSLContext.getInstance("TLS");  
    TrustManagerFactory tmf =  
        TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());  
    tmf.init(ks);  
    X509TrustManager defaultTrustManager = (X509TrustManager)tmf.getTrustManagers()[0];  
    SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);  
    context.init(null, new TrustManager[] {tm}, null);  
    SSLSocketFactory factory = context.getSocketFactory();  
  
    System.out.println("Opening connection to " + host + ":" + port + "...");  
    SSLSocket socket = (SSLSocket)factory.createSocket(host, port);  
    socket.setSoTimeout(10000);  
    try {  
        System.out.println("Starting SSL handshake...");  
        socket.startHandshake();  
        socket.close();  
        System.out.println();  
        System.out.println("No errors, certificate is already trusted");  
    } catch (SSLException e) {  
        System.out.println();  
        e.printStackTrace(System.out);  
    }  
  
    X509Certificate[] chain = tm.chain;  
    if (chain == null) {  
        System.out.println("Could not obtain server certificate chain");  
        return;  
    }  
  
    System.out.println();  
    System.out.println("Server sent " + chain.length + " certificate(s):");  
    System.out.println();  
    MessageDigest sha1 = MessageDigest.getInstance("SHA1");  
    MessageDigest md5 = MessageDigest.getInstance("MD5");  
    for (int i = 0; i < chain.length; i++) {  
        X509Certificate cert = chain[i];  
        System.out.println  
            (" " + (i + 1) + " Subject " + cert.getSubjectDN());  
        System.out.println("   Issuer  " + cert.getIssuerDN());  
        sha1.update(cert.getEncoded());  
        System.out.println("   sha1    " + toHexString(sha1.digest()));  
        md5.update(cert.getEncoded());  
        System.out.println("   md5     " + toHexString(md5.digest()));  
        System.out.println();  
    }  
  
    int k = 0;  
    X509Certificate cert = chain[k];  
    String alias = host + "-" + (k + 1);  
    ks.setCertificateEntry(alias, cert);  
  
    File outFile = new File(certPath+host);
    outFile.mkdirs();
    OutputStream out = new FileOutputStream(outFile.getAbsoluteFile()+""+SEP+certName);  
    ks.store(out, passphrase);  
    out.close();  
  
    System.out.println();  
    System.out.println(cert);  
    System.out.println();  
    System.out.println  
        ("Added certificate to keystore 'jssecacerts' using alias '"  
        + alias + "'");  
    }  
  
    private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();  
  
    private static String toHexString(byte[] bytes) {  
    StringBuilder sb = new StringBuilder(bytes.length * 3);  
    for (int b : bytes) {  
        b &= 0xff;  
        sb.append(HEXDIGITS[b >> 4]);  
        sb.append(HEXDIGITS[b & 15]);  
        sb.append(' ');  
    }  
    return sb.toString();  
    }  
  
    private static class SavingTrustManager implements X509TrustManager {  
  
    private final X509TrustManager tm;  
    private X509Certificate[] chain;  
  
    SavingTrustManager(X509TrustManager tm) {  
        this.tm = tm;  
    }  
  
    public X509Certificate[] getAcceptedIssuers() {  
        throw new UnsupportedOperationException();  
    }  
  
    public void checkClientTrusted(X509Certificate[] chain, String authType)  
        throws CertificateException {  
        throw new UnsupportedOperationException();  
    }  
  
    public void checkServerTrusted(X509Certificate[] chain, String authType)  
        throws CertificateException {  
        this.chain = chain;  
        tm.checkServerTrusted(chain, authType);  
    }  
    }  
  
}  

2、仅调用一个https协议的webService接口

根据1中生成的证书文件路径，在调用webService接口的文件里，配置如下静态代码块即可：

	/*
     * 设置证书。
     */
    static{
        //第二个参数为证书的路径
        System.setProperty("javax.net.ssl.trustStore", "/usr/local/security/jssecacerts");
        System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
    }

3、调用多个https协议的webService接口（未验证）

（1）先通过InstallCert.java类生成所有需要的证书，然后通过以下代码将其合并成一个

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.security.KeyStore;
import java.util.Enumeration;
 
public class KeyStoreMerger {
 
    public static void main(String[] args) {
        try {
            // 加载第一个jssecacerts文件
            KeyStore keystore1 = KeyStore.getInstance(KeyStore.getDefaultType());
            FileInputStream fis1 = new FileInputStream("jssecacerts1.jks");
            keystore1.load(fis1, "changeit".toCharArray());
            fis1.close();
 
            // 加载第二个jssecacerts文件
            KeyStore keystore2 = KeyStore.getInstance(KeyStore.getDefaultType());
            FileInputStream fis2 = new FileInputStream("jssecacerts2.jks");
            keystore2.load(fis2, "changeit".toCharArray());
            fis2.close();
 
            // 遍历第二个keystore的条目，并添加到第一个keystore中
            Enumeration<String> enumeration = keystore2.aliases();
            while (enumeration.hasMoreElements()) {
                String alias = enumeration.nextElement();
                if (keystore1.getCertificate(alias) == null) {
                    keystore1.setCertificateEntry(alias, keystore2.getCertificate(alias));
                }
            }
 
            // 保存合并后的keystore到新文件
            FileOutputStream fos = new FileOutputStream("merged_jssecacerts.jks");
            keystore1.store(fos, "changeit".toCharArray());
            fos.close();
 
            System.out.println("Merged jssecacerts successfully.");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

（2）、在调用webService的接口里添加静态代码块

	/*
     * 设置证书。
     */
    static{
        //第二个参数为证书的路径
        System.setProperty("javax.net.ssl.trustStore", "/usr/local/security/merged_jssecacerts.jks");
        System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
    }

4、跳过https证书认证

在接口交互非常安全的情况下，想要绕过认证，那么可以在系统启动加载类时进行SSLContext设置（将如下静态代码块放在启动时加载的类里即可，无需再增加其他代码）

import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import javax.net.ssl.SSLContext;
import javax.net.ssl.X509TrustManager;
import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;

/**
	 * 绕过认证
	 * 创建https链接的SSLSocketFactory
	 * 
	 * @return
	 * @throws Exception
	 */
	static {

		javax.net.ssl.TrustManager[] trustMyCerts = { new X509TrustManager() {

			@Override
			public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType)
					throws java.security.cert.CertificateException {
			}

			@Override
			public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType)
					throws java.security.cert.CertificateException {
			}

			@Override
			public java.security.cert.X509Certificate[] getAcceptedIssuers() {
				return null;
			}
		} };

		javax.net.ssl.SSLContext sslContext = null;
		try {
			sslContext = javax.net.ssl.SSLContext.getInstance("TLS");
			sslContext.init(null, trustMyCerts, null);
			SSLContext.setDefault(sslContext);
		} catch (NoSuchAlgorithmException e) {
			e.printStackTrace();
		} catch (KeyManagementException e) {
			e.printStackTrace();
		}
	}