java keystore pem_以编程方式从PEM获取KeyStore

如何从包含证书和私钥的PEM文件中以编程方式获取KeyStore？我试图在HTTPS连接中向服务器提供客户端证书。我已经确认，如果我使用openssl和keytool来获取jks文件(该文件是动态加载的)，则客户端证书可以使用。我什至可以通过动态读取p12(PKCS12)文件来使其工作。

我正在考虑使用BouncyCastle的PEMReader类，但无法克服一些错误。我正在使用-Djavax.net.debug =

all选项运行Java客户端，并通过调试LogLevel运行Apache Web服务器。我不确定该寻找什么。Apache错误日志指示：

...

OpenSSL: Write: SSLv3 read client certificate B

OpenSSL: Exit: error in SSLv3 read client certificate B

Re-negotiation handshake failed: Not accepted by client!?

Java客户端程序指示：

...

main, WRITE: TLSv1 Handshake, length = 48

main, waiting for close_notify or alert: state 3

main, Exception while waiting for close java.net.SocketException: Software caused connection abort: recv failed

main, handling exception: java.net.SocketException: Software caused connection abort: recv failed

%% Invalidated: [Session-3, TLS_RSA_WITH_AES_128_CBC_SHA]

main, SEND TLSv1 ALERT: fatal, description = unexpected_message

...

客户端代码：

public void testClientCertPEM() throws Exception {

String requestURL = "https://mydomain/authtest";

String pemPath = "C:/Users/myusername/Desktop/client.pem";

HttpsURLConnection con;

URL url = new URL(requestURL);

con = (HttpsURLConnection) url.openConnection();

con.setSSLSocketFactory(getSocketFactoryFromPEM(pemPath));

con.setRequestMethod("GET");

con.setDoInput(true);

con.setDoOutput(false);

con.connect();

String line;

BufferedReader reader = new BufferedReader(new InputStreamReader(con.getInputStream()));

while((line = reader.readLine()) != null) {

System.out.println(line);

}

reader.close();

con.disconnect();

}

public SSLSocketFactory getSocketFactoryFromPEM(String pemPath) throws Exception {

Security.addProvider(new BouncyCastleProvider());

SSLContext context = SSLContext.getInstance("TLS");

PEMReader reader = new PEMReader(new FileReader(pemPath));

X509Certificate cert = (X509Certificate) reader.readObject();

KeyStore keystore = KeyStore.getInstance("JKS");

keystore.load(null);

keystore.setCertificateEntry("alias", cert);

KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");

kmf.init(keystore, null);

KeyManager[] km = kmf.getKeyManagers();

context.init(km, null, null);

return context.getSocketFactory();

}

我注意到服务器在客户端TLSv1中正在日志中输出SSLv3。如果我添加系统属性-Dhttps.protocols =

SSLv3，则客户端也将使用SSLv3，但是会收到相同的错误消息。我还尝试添加-

Dsun.security.ssl.allowUnsafeRenegotiation = true，但结果没有变化。

我已经四处搜寻，这个问题的通常答案是先使用openssl和keytool。就我而言，我需要即时阅读PEM。实际上，我正在移植已经执行此操作的C

程序，坦率地说，我很惊讶在Java中执行此操作有多么困难。C代码：

curlpp::Easy request;

...

request.setOpt(new Options::Url(myurl));

request.setOpt(new Options::SslVerifyPeer(false));

request.setOpt(new Options::SslCertType("PEM"));

request.setOpt(new Options::SslCert(cert));

request.perform();