Java Tomcat SSL 服务端/客户端双向认证のApache HttpClient（二）

本演示例程是继 Java Tomcat SSL 服务端/客户端双向认证（一） ，密钥库可证书的生成脚本不再重复黏贴，仅仅是用程序来代替浏览器访问服务端。
例程中使用到了Apache HttpClient库，版本为4.1.3
全部依赖库：
commons-logging-1.1.1.jar
httpclient-4.1.3.jar
httpcore-4.1.4.jar
httpmime-4.1.3.jar(上传文件使用)

在（一）中的程序包中创建一个客户端类：HttpsClient
HttpsClient.java

package com.icesoft.client;

import java.io.BufferedReader;
import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.security.KeyStore;

import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.util.EntityUtils;

public class HttpsClient {
    
    private static final String KEY_STORE_TYPE_JKS = "jks";
    private static final String KEY_STORE_TYPE_P12 = "PKCS12";
    private static final String SCHEME_HTTPS = "https";
    private static final int HTTPS_PORT = 8443;
    private static final String HTTPS_URL = "https://127.0.0.1:8443/HttpClientSSL/sslServlet";
    private static final String KEY_STORE_CLIENT_PATH = "E:/ssl/client.p12";
    private static final String KEY_STORE_TRUST_PATH = "E:/ssl/client.truststore";
    private static final String KEY_STORE_PASSWORD = "123456";
    private static final String KEY_STORE_TRUST_PASSWORD = "123456";

    public static void main(String[] args) throws Exception {
        ssl();
    }
    
    private static void ssl() throws Exception {
        HttpClient httpClient = new DefaultHttpClient();
        try {
            KeyStore keyStore  = KeyStore.getInstance(KEY_STORE_TYPE_P12);
            KeyStore trustStore  = KeyStore.getInstance(KEY_STORE_TYPE_JKS);
            InputStream ksIn = new FileInputStream(KEY_STORE_CLIENT_PATH);
            InputStream tsIn = new FileInputStream(new File(KEY_STORE_TRUST_PATH));
            try {
                keyStore.load(ksIn, KEY_STORE_PASSWORD.toCharArray());
                trustStore.load(tsIn, KEY_STORE_TRUST_PASSWORD.toCharArray());
            } finally {
                try { ksIn.close(); } catch (Exception ignore) {}
                try { tsIn.close(); } catch (Exception ignore) {}
            }
            SSLSocketFactory socketFactory = new SSLSocketFactory(keyStore, KEY_STORE_PASSWORD, trustStore);
            Scheme sch = new Scheme(SCHEME_HTTPS, HTTPS_PORT, socketFactory);
            httpClient.getConnectionManager().getSchemeRegistry().register(sch);
            HttpGet httpget = new HttpGet(HTTPS_URL);
            System.out.println("executing request" + httpget.getRequestLine());
            HttpResponse response = httpClient.execute(httpget);
            HttpEntity entity = response.getEntity();
            System.out.println("----------------------------------------");
            System.out.println(response.getStatusLine());
            if (entity != null) {
                System.out.println("Response content length: " + entity.getContentLength());
                BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(entity.getContent()));
                String text;
                while ((text = bufferedReader.readLine()) != null) {
                    System.out.println(text);
                }
                bufferedReader.close();
            }
            EntityUtils.consume(entity);
        } finally {
            httpClient.getConnectionManager().shutdown();
        }
    }

}

run application,控制台输出：

executing requestGET https://192.168.2.40:8443/SSL/sslServlet HTTP/1.1
----------------------------------------
HTTP/1.1 200 OK
Response content length: 2626
共检测到[1]个客户端证书
客户端证书 [1]： 
校验结果：true
证书详细：
[
[
  Version: V3
  Subject: CN=client, OU=icesoft, O=icesoft, L=Haidian, ST=Beijing, C=cn
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 22728603218554978819167622374511325599166111706120842585148334503663814377444448960259366571673919947780571338983127043390421682869404352922376089234583567571938900644237557681886369694339289456589314853347233755545297104483086707784665927757891116153825825492634449124154488227583686907190744964745385967151525629983475995385595215024905728098739783573362870664794029989374768009043374380109069723045689226245686226076841101834855795400573748937451720766402628528377366911327288488037941852747282339146007290555371317512926236850990439556341824026784906382152275885044029865477105045211011767059728470429818861903553
  public exponent: 65537
  Validity: [From: Thu Mar 02 10:48:52 CST 2017,
               To: Fri Mar 02 10:48:52 CST 2018]
  Issuer: CN=client, OU=icesoft, O=icesoft, L=Haidian, ST=Beijing, C=cn
  SerialNumber: [    57a41c0a]

Certificate Extensions: 1
[1]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 9D 73 C5 59 B7 4F 4C D6   BC 75 63 1D 42 AC 54 5E  .s.Y.OL..uc.B.T^
0010: CE AC 0A AB                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 10 9C 07 51 F1 19 BF 94   81 9D 17 70 5C 7B 5F 32  ...Q.......p\._2
0010: 09 41 69 E9 B1 27 E2 9B   6A F2 26 00 42 B6 FD 83  .Ai..'..j.&.B...
0020: CC 20 53 01 39 D5 85 39   6B 5B 03 91 44 34 07 66  . S.9..9k[..D4.f
0030: 5C 11 FF F6 CE 0C F5 86   F0 F8 EA B1 69 8B 46 5C  \...........i.F\
0040: F6 66 25 F5 9C 51 5B F2   09 5B 45 E0 6D 7E 99 61  .f%..Q[..[E.m..a
0050: C1 29 2A 4C 8D 59 E3 9E   2C F3 BA 15 EF 35 E7 BC  .)*L.Y..,....5..
0060: 68 7E ED 56 F5 78 6F E6   AB 8C 3E 7C 92 DC 17 CE  h..V.xo...>.....
0070: E9 99 2D D0 36 B5 9A B2   CA 93 BB 9C F6 E0 A5 8F  ..-.6...........
0080: 9F B9 34 86 CC D9 17 4B   D8 7E 58 3C 52 BF BC B0  ..4....K..X<R...
0090: 23 82 51 34 6C 08 48 AB   87 30 67 0B 20 65 FD D4  #.Q4l.H..0g. e..
00A0: 2D 6E F9 44 69 D7 0E 7C   8E 9B 02 1E 55 FC 0E 1E  -n.Di.......U...
00B0: E8 55 D1 BF 24 3B 3B 53   B2 3F 6F 6B 97 5E 31 D4  .U..$;;S.?ok.^1.
00C0: F3 F8 82 EF AB 9A 19 31   48 3A 0E 40 78 27 D8 95  .......1H:.@x'..
00D0: D9 72 0B 58 4A 4B 45 3B   64 62 85 BC C3 A4 45 BD  .r.XJKE;db....E.
00E0: AB 6E 8F D5 6E 5A E2 6F   F3 FC 7D 32 8F A6 20 64  .n..nZ.o...2.. d
00F0: 55 21 1E BF 30 8E 51 11   9D 16 75 01 A3 6F 9A 08  U!..0.Q...u..o..

]

至此，说明通过apache HttpClient程序代替浏览器访问成功。

参考：Java Tomcat SSL 服务端/客户端双向认证のApache HttpClient（二）