公钥获取

最新推荐文章于 2024-04-07 15:31:53 发布

李庆伟

最新推荐文章于 2024-04-07 15:31:53 发布

阅读量602

点赞数

分类专栏：公钥获取文章标签：网络数据库 java

本文链接：https://blog.csdn.net/rimet711/article/details/84520395

版权

公钥获取专栏收录该内容

1 篇文章 0 订阅

订阅专栏

如何从网站导出公钥，参见：

/*
 * Copyright 2006 Sun Microsystems, Inc.  All Rights Reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *   - Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *
 *   - Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 *
 *   - Neither the name of Sun Microsystems nor the names of its
 *     contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

import java.io.BufferedReader;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;

public class InstallCert {

	public static void main(String[] args) throws Exception {
		String host;
		int port;
		char[] passphrase;
		if ((args.length == 1) || (args.length == 2)) {
			String[] c = args[0].split(":");
			host = c[0];
			port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
			String p = (args.length == 1) ? "changeit" : args[1];
			passphrase = p.toCharArray();
		} else {
			System.out
					.println("Usage: java InstallCert <host>[:port] [passphrase]");
			return;
		}

		File file = new File("jssecacerts");
		if (file.isFile() == false) {
			char SEP = File.separatorChar;
			File dir = new File(System.getProperty("java.home") + SEP + "lib"
					+ SEP + "security");
			file = new File(dir, "jssecacerts");
			if (file.isFile() == false) {
				file = new File(dir, "cacerts");
			}
		}
		System.out.println("Loading KeyStore " + file + "...");
		InputStream in = new FileInputStream(file);
		KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
		ks.load(in, passphrase);
		in.close();

		SSLContext context = SSLContext.getInstance("TLS");
		TrustManagerFactory tmf = TrustManagerFactory
				.getInstance(TrustManagerFactory.getDefaultAlgorithm());
		tmf.init(ks);
		X509TrustManager defaultTrustManager = (X509TrustManager) tmf
				.getTrustManagers()[0];
		SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
		context.init(null, new TrustManager[] { tm }, null);
		SSLSocketFactory factory = context.getSocketFactory();

		System.out
				.println("Opening connection to " + host + ":" + port + "...");
		SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
		socket.setSoTimeout(10000);
		try {
			System.out.println("Starting SSL handshake...");
			socket.startHandshake();
			socket.close();
			System.out.println();
			System.out.println("No errors, certificate is already trusted");
		} catch (SSLException e) {
			System.out.println();
			e.printStackTrace(System.out);
		}

		X509Certificate[] chain = tm.chain;
		if (chain == null) {
			System.out.println("Could not obtain server certificate chain");
			return;
		}

		BufferedReader reader = new BufferedReader(new InputStreamReader(
				System.in));

		System.out.println();
		System.out.println("Server sent " + chain.length + " certificate(s):");
		System.out.println();
		MessageDigest sha1 = MessageDigest.getInstance("SHA1");
		MessageDigest md5 = MessageDigest.getInstance("MD5");
		for (int i = 0; i < chain.length; i++) {
			X509Certificate cert = chain[i];
			System.out.println(" " + (i + 1) + " Subject "
					+ cert.getSubjectDN());
			System.out.println("   Issuer  " + cert.getIssuerDN());
			sha1.update(cert.getEncoded());
			System.out.println("   sha1    " + toHexString(sha1.digest()));
			md5.update(cert.getEncoded());
			System.out.println("   md5     " + toHexString(md5.digest()));
			System.out.println();
		}

		System.out
				.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
		String line = reader.readLine().trim();
		int k;
		try {
			k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
		} catch (NumberFormatException e) {
			System.out.println("KeyStore not changed");
			return;
		}

		X509Certificate cert = chain[k];
		String alias = host + "-" + (k + 1);
		ks.setCertificateEntry(alias, cert);

		OutputStream out = new FileOutputStream("证书名称");
		ks.store(out, passphrase);
		out.close();

		System.out.println();
		System.out.println(cert);
		System.out.println();
		System.out
				.println("Added certificate to keystore 'jssecacerts' using alias '"
						+ alias + "'");
	}

	private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

	private static String toHexString(byte[] bytes) {
		StringBuilder sb = new StringBuilder(bytes.length * 3);
		for (int b : bytes) {
			b &= 0xff;
			sb.append(HEXDIGITS[b >> 4]);
			sb.append(HEXDIGITS[b & 15]);
			sb.append(' ');
		}
		return sb.toString();
	}

	private static class SavingTrustManager implements X509TrustManager {

		private final X509TrustManager tm;
		private X509Certificate[] chain;

		SavingTrustManager(X509TrustManager tm) {
			this.tm = tm;
		}

		public X509Certificate[] getAcceptedIssuers() {
			throw new UnsupportedOperationException();
		}

		public void checkClientTrusted(X509Certificate[] chain, String authType)
				throws CertificateException {
			throw new UnsupportedOperationException();
		}

		public void checkServerTrusted(X509Certificate[] chain, String authType)
				throws CertificateException {
			this.chain = chain;
			tm.checkServerTrusted(chain, authType);
		}
	}

}

编译InstallCert.java，然后执行：java InstallCert hostname，比如：
java InstallCert www.twitter.com

Loading KeyStore D:\jdk1.6.0_24\jre\lib\security\jssecacerts...
Opening connection to www.baidu.com:443...
Starting SSL handshake...

No errors, certificate is already trusted

Server sent 3 certificate(s):

 1 Subject CN=*.icbccs.com.cn, OU=Terms of use at www.verisign.com/rpa (c)05, OU
=信息科技部, O=xxx有限公司, L=北京, ST=北京, C=CN
   Issuer  CN=VeriSign Class 3 Secure Server CA - G3, OU=Terms of use at https:/
/www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

   sha1    a9 97 30 cb 39 4d 5a ca 15 fc 89 4f d3 23 04 36 cf 61 be 19
   md5     4a 8b cb 7f 17 e1 d5 50 c4 12 c8 bb bf 77 8b eb

 2 Subject CN=VeriSign Class 3 Secure Server CA - G3, OU=Terms of use at https:/
/www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

   Issuer  CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="
(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O
="VeriSign, Inc.", C=US
   sha1    5d eb 8f 33 9e 26 4c 19 f6 68 6f 5f 8f 32 b5 4a 4c 46 b4 76
   md5     3c 48 42 0d ff 58 1a 38 86 bc fd 41 d4 8a 41 de

 3 Subject CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="
(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O
="VeriSign, Inc.", C=US
   Issuer  OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc."
, C=US
   sha1    32 f3 08 82 62 2b 87 cf 88 56 c6 3d b8 73 df 08 53 b4 dd 27
   md5     f9 1f fe e6 a3 6b 99 88 41 d4 67 dd e5 f8 97 7a

Enter certificate to add to trusted keystore or 'q' to quit: [1]
1

[
[
  Version: V3
  Subject: CN=*.icbccs.com.cn, OU=Terms of use at www.verisign.com/rpa (c)05, OU
=信息科技部, O=xxx有限公司, L=北京, ST=北京, C=CN
  Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

  Key:  Sun RSA public key, 2048 bits
  modulus: 283237183049497030739483311693387386444719015904149423384946260493888
54312086864471764671900256428309535187300203783772426377821213096815298500496081
94282064665836828450489623558133795100728568232326857551921293699758105975955560
78467867487712207989118685364043578867064156005737107583255096315001490431619898
21045983770219821983218784505296890380008642498801268645066729325463558835459047
56207620475530345877804715669138319363187789059044457868706267672311239179445295
87885467587670081420910155653403515351433296352393207580497698650834232055543189
40686664934324614364664826746106933156049209457765088262276907115353
  public exponent: 65537
  Validity: [From: Wed Aug 28 08:00:00 GMT+08:00 2013,
               To: Sun Aug 28 07:59:59 GMT+08:00 2016]
  Issuer: CN=VeriSign Class 3 Secure Server CA - G3, OU=Terms of use at https://
www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
  SerialNumber: [    3de917d4 fbda51b0 529b5c0f 03e1cf57]

Certificate Extensions: 8
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 0D 44 5C 16 53 44 C1 82   7E 1D 20 AB 25 F4 01 63  .D\.SD.... .%..c
0010: D8 BE 79 A5                                        ..y.
]

]

[2]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl]
]]

[3]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: *.icbccs.com.cn
]

[4]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.16.840.1.113733.1.7.54]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 1C 68 74 74 70 73 3A   2F 2F 77 77 77 2E 76 65  ..https://
www.ve
0010: 72 69 73 69 67 6E 2E 63   6F 6D 2F 63 70 73        risign.com/cps

]]  ]
]

[6]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

[7]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: 1.3.6.1.5.5.7.48.1
   accessLocation: URIName: http://ocsp.verisign.com,
   accessMethod: 1.3.6.1.5.5.7.48.2
   accessLocation: URIName: http://SVRSecure-G3-aia.verisign.com/SVRSecureG3.cer
]
]

[8]: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
  CA:false
  PathLen: undefined
]

]
  Algorithm: [SHA1withRSA]
  Signature:
0000: A3 20 AC AE B0 DF 95 16   5F 0D BA DF 8F 08 A2 FA  . ......_.......
0010: 03 5E C4 F2 F0 58 EE 50   D4 EB B5 C4 9F A2 41 B5  .^...X.P......A.
0020: 67 00 CE 67 FB F8 B5 AC   1C D4 C0 F9 97 A6 9F 0B  g..g............
0030: 4C 38 2C 98 C7 6D 1B CA   06 1A A4 20 94 B1 41 47  L8,..m..... ..AG
0040: EA EC C5 CF 57 5E 27 A5   41 7D 1D 1E 7F 9A 6F C5  ....W^'.A.....o.
0050: E3 FE 42 C2 AD 8B 86 6B   49 6E 7A 97 D4 C7 70 A6  ..B....kInz...p.
0060: 3D DE 0A 7B ED 41 E3 C1   0D CE E8 6B 2E DB 3F 4E  =....A.....k..?N
0070: EA 86 DC 10 F4 A0 32 A6   6A B3 53 AB 21 F7 4E F8  ......2.j.S.!.N.
0080: 51 AB 44 0B 2D 66 7B E3   15 2D 45 11 D8 87 23 17  Q.D.-f...-E...#.
0090: 63 FC AD C3 B3 A5 E7 F8   D5 F5 B4 0F 6B FA 9A AC  c...........k...
00A0: 5C C8 13 20 A7 9A 97 5C   07 50 3F 4A D0 9C D9 2B  \.. ...\.P?J...+
00B0: 58 E4 C6 D8 53 7F 9B 40   44 0D B2 6F 83 49 71 5E  X...S..@D..o.Iq^
00C0: D8 1B 63 59 91 C0 7E D0   CB F4 58 7B 7A AF 27 7E  ..cY......X.z.'.
00D0: 1D CB 1B 9C AB 5E 7D 58   61 13 62 6C 35 C5 F6 7D  .....^.Xa.bl5...
00E0: 9A 18 75 7F 7D F6 21 4D   B6 DC 83 BB 51 77 40 06  ..u...!M....Qw@.
00F0: 3D D2 E8 F2 2C A7 8D 78   BA 21 42 C9 1C 59 09 07  =...,..x.!B..Y..

]

Added certificate to keystore 'jssecacerts' using alias www.baidu.com-1'

输入1，回车，然后会在当前的目录下产生一个名为“jssecacerts”的证书。

导入证书：

keytool - import -file d:\Server.cer -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -alias server

将公钥导入到了 %JAVA_HOME%\jre\lib\security\cacerts 文件中。

使用如下命令可以看到结果：

 
          keytool -list -keystore  
          "%JAVA_HOME%\jre\lib\security\cacerts" 
          | findstr /i server 
         
           当看到server 2014-1-15 trustedCertEntry 的结果代表执行成功

李庆伟

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
公钥获取

如何从网站导出公钥，参见：/* * Copyright 2006 Sun Microsystems, Inc. All Rights Reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided ...
复制链接

扫一扫