HttpClient调用大宝CA版本JSSE访问国密SSL协议的HTTPS服务的方法

最新推荐文章于 2024-10-10 08:49:33 发布

置顶大宝CA国密SSL国密TOMCAT

最新推荐文章于 2024-10-10 08:49:33 发布

阅读量2k

点赞数 2

文章标签： PPLIC HttpClient DoubleCA JSSE 国密SSL

本文链接：https://blog.csdn.net/upset_ming/article/details/92817172

版权

系统要求
1. Windows系统、Linux系统、Mac系统
2. JDK7及以上
3. JDK使用无限制的安全策略文件

HttpClient客户端核心代码

import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Security;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;

import org.apache.commons.collections4.MapUtils;
import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.HttpStatus;
import org.apache.http.HttpVersion;
import org.apache.http.NameValuePair;
import org.apache.http.StatusLine;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.HttpClient;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.client.utils.URLEncodedUtils;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.impl.conn.PoolingClientConnectionManager;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.params.BasicHttpParams;
import org.apache.http.params.CoreConnectionPNames;
import org.apache.http.params.CoreProtocolPNames;
import org.apache.http.params.HttpParams;
import org.apache.http.util.EntityUtils;

import doubleca.security.gmssl.provider.DoubleCASSE;
import doubleca.security.provider.DoubleCA;

/**
* @author DoubleCA
*
*/
public class HttpClientUtil
{
private static final String ENCODING = "UTF-8";

   private static HttpClient client = null;
   private static SchemeRegistry schemeRegistry; // 协议控制
   private static PoolingClientConnectionManager ccm; // HttpClient连接池(多连接的线程安全的管理器)

private static DoubleCASSE dcsse = new DoubleCASSE();

   /**
   * 用授权数据初始化dcsse
   */
   private static void initLic()
   {
       // 获得的本机授权数据，在http://www.pplic.com授权平台获取
       String licData = "ASeraPDybn/wwAABTGQnuKT71OrK0gnV/OSwjRcgHXJAtseX+Tu2kqOJCnT4r4b9/FUYOKXfJ3nsjDarus6mo+WPax6Z4W8ONonjro7Ql0WxJgIM234bdV2xBvv8pUkD/dffwZfkQ/HfjXsz4QH2+TQ0eWcUr4f2hnfNDxczJ+g88pWVUuCbcxTLWdCWW547Bp2TJ5FQt28zWxSTXqoJxXavYMffp1PnvBL9DOjKLFhqRdLVVsoiIVTsikGEgHeKrUsjmft01PqSd9ErqWEXsGpslzVzuVBjGtyQh6Arz3Ksy1wyipor+7y4KrsTuD9qxvfEjKdHm58p0BacfOHXfLe8XUKDLADIddfDyMIgAXAiUG8Zh+oRw0qDIuIgVgaRGcQ0SEWpXQbl2wCXye2B9Oa2Pr+9+/OWS4LbxWIiDOEbTA4kQT/lklQ3sfBZZJkXPJtmMQx0HgNcsrX6tkoiZC1G0c4mSkbq6k8R5dIS6KcEycS2SekKCqmNmC1yd9QC2iAXIG/pcTaGWuTzPWbU+6lfu0MMm4zL9po1wBORzpVqxsTh6hhe0URpxqPdNQOWHRp7PxaCRhJrZAh7/DiwulJwu7I42zbXdkncmwHHj07DCyJiUJScXz4tVaC/BgRV93ySirRh9gTjV61DM97pS43adyOA2U4cGNO7nm5b7JLKInE4ukuislJZHDB/5hiDRE/H48KPZNB/EsEZVcEgIXaAaRwf1jOG6pvM9qS6Pg==";
       dcsse.setLicData(licData);
       System.out.println("授权有效期：" + dcsse.getLicEndTime().toLocaleString());
   }

   // 创建SSL上下文---忽略服务端证书信任
   static SSLContext createIgnoreVerifySSL() throws NoSuchAlgorithmException, KeyManagementException, NoSuchProviderException
   {
       SSLContext sc = SSLContext.getInstance("GMSSLv1.1", DoubleCASSE.PROVIDER_NAME);

       // 实现一个X509TrustManager接口，用于绕过验证，不用修改里面的方法
       X509TrustManager trustManager = new X509TrustManager()
       {
           @Override
           public void checkClientTrusted(java.security.cert.X509Certificate[] paramArrayOfX509Certificate, String paramString) throws CertificateException
           {
               for (int i = 0; i < paramArrayOfX509Certificate.length; i++)
               {
                   System.out.println(paramArrayOfX509Certificate[i].getSubjectDN().getName());
               }
               System.out.println("");
           }

           @Override
           public void checkServerTrusted(java.security.cert.X509Certificate[] paramArrayOfX509Certificate, String paramString) throws CertificateException
           {
               for (int i = 0; i < paramArrayOfX509Certificate.length; i++)
               {
                   System.out.println(paramArrayOfX509Certificate[i].getSubjectDN().getName());
               }
               System.out.println("");
           }

           @Override
           public java.security.cert.X509Certificate[] getAcceptedIssuers()
           {
               return null;
           }
       };
       sc.init(null, new TrustManager[]{trustManager}, null);
       return sc;
   }

   // 创建SSL上下文---单向/双向认证，需要信任服务端证书
   static SSLContext createSSL(boolean clientAuth) throws NoSuchAlgorithmException, KeyManagementException, NoSuchProviderException, KeyStoreException, CertificateException, FileNotFoundException, IOException, UnrecoverableKeyException
   {
       SSLContext sc = SSLContext.getInstance("GMSSLv1.1", DoubleCASSE.PROVIDER_NAME);
       KeyManager[] clientCertManager = null;
       if (clientAuth == true)
       {
           // 双向认证
           KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509", DoubleCASSE.PROVIDER_NAME);
           KeyStore sm2ClientKeyStore = KeyStore.getInstance("DCKS");
           sm2ClientKeyStore.load(new FileInputStream("resources/CLIENT.dcks"), "DoubleCA".toCharArray());
           kmf.init(sm2ClientKeyStore, "DoubleCA".toCharArray());
           clientCertManager = kmf.getKeyManagers();
       }
       // 信任管理器，服务端根证书要放在这里
       KeyStore sm2TrustKeyStore = KeyStore.getInstance("DCKS");
       sm2TrustKeyStore.load(new FileInputStream("resources/CLIENT.dcks"), "DoubleCA".toCharArray());

TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509", DoubleCASSE.PROVIDER_NAME);
tmf.init(sm2TrustKeyStore);

       sc.init(clientCertManager, tmf.getTrustManagers(), null);
       return sc;
   }
   private static void initGMSSL()
   {
       try
       {
           Security.addProvider(new DoubleCA());
           Security.addProvider(dcsse);
           /*
           * 与https请求相关的操作
           */
           // 单向认证，忽略不信任服务端证书
           SSLContext sslContext = createIgnoreVerifySSL();
           // 单向认证
//           boolean clientAuth = false;
           // 双向认证
//           clientAuth = true;
           // 单向/双向认证，必须信任服务端证书
//           SSLContext sslContext = createSSL(clientAuth);
           SSLSocketFactory socketFactory = new SSLSocketFactory(sslContext);
           socketFactory.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
           /*
           * 定义访问协议
           */
           schemeRegistry = new SchemeRegistry();
           schemeRegistry.register(new Scheme("https", 443, socketFactory));// https
       }
       catch (Exception e)
       {
           e.printStackTrace();
       }

       // 连接池管理
       ccm = new PoolingClientConnectionManager(schemeRegistry);
       ccm.setDefaultMaxPerRoute(20);// 每个路由的最大连接数
       ccm.setMaxTotal(400);// 最大总连接数

       HttpParams httpParams = new BasicHttpParams();
       httpParams.setParameter(CoreConnectionPNames.CONNECTION_TIMEOUT, 1000);// 连接超时时间（ms）
       httpParams.setParameter(CoreConnectionPNames.SO_TIMEOUT, 2000);// 操作超时时间（ms）
       httpParams.setParameter(CoreProtocolPNames.PROTOCOL_VERSION, HttpVersion.HTTP_1_1);// 设置http1.1或http1.0

client = new DefaultHttpClient(ccm, httpParams);// 一个客户端就有一个连接池
}

   /**
   * get请求
   *
   * @param url
   * 请求URL
   * @param paramMap
   * 请求参数
   * @param headerMap
   * 请求头信息
   */
   public static String get(String url, Map<String, String> paramMap, Map<String, String> headerMap) throws ClientProtocolException, IOException
   {
       /*
       * 拼接URL与参数
       */
       if (MapUtils.isNotEmpty(paramMap))
       {
           List<NameValuePair> params = new ArrayList<NameValuePair>();
           for (String key : paramMap.keySet())
           {
               params.add(new BasicNameValuePair(key, paramMap.get(key)));
           }
           String queryString = URLEncodedUtils.format(params, ENCODING);
           if (url.indexOf("?") > -1)
           {// 存在?，表示这时的URL已经带参数了
               url += "&" + queryString;
           }
           else
           {
               url += "?" + queryString;
           }
       }

HttpGet httpGet = new HttpGet(url);

       /*
       * 设置头信息
       */
       if (MapUtils.isNotEmpty(headerMap))
       {
           Set<String> keySet = headerMap.keySet();
           for (String key : keySet)
           {
               httpGet.addHeader(key, headerMap.get(key));
           }
       }

String result = "";

       HttpResponse response = client.execute(httpGet); // 发出get请求
       StatusLine status = response.getStatusLine(); // 获取返回的状态码
       HttpEntity entity = response.getEntity(); // 获取返回的响应内容
       if (status.getStatusCode() == HttpStatus.SC_OK)
       { // 200
           result = EntityUtils.toString(entity, ENCODING);
       }

       httpGet.abort();// 中止请求，连接被释放回连接池
       return result;
   }

   /**
   * post请求
   *
   * @param url
   * //请求URL
   * @param paramMap
   * //请求参数
   * @param headerMap
   * //请求头信息
   */
   public static String post(String url, Map<String, String> paramMap, Map<String, String> headerMap) throws ClientProtocolException, IOException
   {
       HttpPost httpPost = new HttpPost(url);
       /*
       * 处理参数
       */
       List<NameValuePair> params = new ArrayList<NameValuePair>();
       if (MapUtils.isNotEmpty(paramMap))
       {
           Set<String> keySet = paramMap.keySet();
           for (String key : keySet)
           {
               params.add(new BasicNameValuePair(key, paramMap.get(key)));
           }
       }
       /*
       * 设置头信息
       */
       if (MapUtils.isNotEmpty(headerMap))
       {
           Set<String> keySet = headerMap.keySet();
           for (String key : keySet)
           {
               httpPost.addHeader(key, headerMap.get(key));
           }
       }

String result = "";

       httpPost.setEntity(new UrlEncodedFormEntity(params, ENCODING));// 设置参数
       HttpResponse response = client.execute(httpPost); // 发出post请求
       StatusLine status = response.getStatusLine(); // 获取返回的状态码
       HttpEntity entity = response.getEntity(); // 获取响应内容
       if (status.getStatusCode() == HttpStatus.SC_OK)
       {
           result = EntityUtils.toString(entity, ENCODING);
       }

       httpPost.abort();// 中止请求，连接被释放回连接池
       return result;
   }

   /**
   * 测试
   */
   public static void main(String[] args)
   {
       try
       {
           initLic();
           initGMSSL();
           System.out.println(HttpClientUtil.get("https://sm2test.ovssl.cn:443/", null, null));
       }
       catch (ClientProtocolException e)
       {
           e.printStackTrace();
       }
       catch (IOException e)
       {
           e.printStackTrace();
       }
   }
}

运行结果：

授权有效期：2999-2-20 1:01:01

------ http://www.DoubleCA.com ---- 大宝CA ------
------- Watchdata & DoubleCA -------

C=CN,ST=广东省,L=深圳市,O=沃通电子认证服务有限公司,CN=sm2test.ovssl.cn
C=CN,O=沃通电子认证服务有限公司,CN=国密SM2服务器根证书V3
C=CN,O=沃通电子认证服务有限公司,CN=国密SM2根证书

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">......

DCKS国密SSL通信证书和密钥文件在大宝CA 网站上免费申请
国密SSL的JAR包需要授权使用，generateLicRequest函数生成终端授权请求编码，获取到授权数据放在initLic函数中即可完成授权，申请授权数据的具体步骤：

1. 访问 PP商业软件自主授权平台

2. 点击“应用方入口”

3. “软件1编号”填写：66-61F74672E9534ACEAF86EEFB8D8E75D0，免费授权码数量有限，获取请联系QQ：1337588982，将授权码写在“授权码”输入框内，“终端请求授权编码”框内复制generateLicRequest函数生成的终端授权请求编码

4. 提交授权请求后页面会生成授权数据，将授权数据复制到initLic函数中即可完成授权

最新版本大宝CA国密SSL的JAR包和示例代码下载地址：https://download.csdn.net/download/upset_ming/12193981

授权码保留好，如果授权数据丢失，可凭授权码在 PP商业软件自主授权平台回授权数据

大宝CA国密SSL国密TOMCAT

关注

2
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
复制链接

分享到 QQ

分享到新浪微博

扫一扫