java http 双向认证_【转】使用Httpclient实现SSL双向认证

tomcat6配置双向认证

1、生成服务器端证书

Java代码

keytool -genkey -keyalg RSA -dname "cn=localhost,ou=sango,o=none,l=china,st=beijing,c=cn" -alias server -keypass password -keystore server.jks -storepass password -validity 3650

keytool -genkey -keyalg RSA -dname "cn=localhost,ou=sango,o=none,l=china,st=beijing,c=cn" -alias server -keypass password -keystore server.jks -storepass password -validity 3650

2、生成客户端证书

Java代码

keytool -genkey -keyalg RSA -dname "cn=sango,ou=sango,o=none,l=china,st=beijing,c=cn" -alias custom -storetype PKCS12 -keypass password -keystore custom.p12 -storepass password -validity 3650

keytool -genkey -keyalg RSA -dname "cn=sango,ou=sango,o=none,l=china,st=beijing,c=cn" -alias custom -storetype PKCS12 -keypass password -keystore custom.p12 -storepass password -validity 3650

客户端的CN可以是任意值。

3、由于是双向SSL认证，服务器必须要信任客户端证书，因此，必须把客户端证书添加为服务器的信任认证。由于不能直接将PKCS12格式的证书库导入，我们必须先把客户端证书导出为一个单独的CER文件，使用如下命令，先把客户端证书导出为一个单独的cer文件：

Java代码

keytool -export -alias custom -file custom.cer -keystore custom.p12 -storepass password -storetype PKCS12 -rfc

keytool -export -alias custom -file custom.cer -keystore custom.p12 -storepass password -storetype PKCS12 -rfc

然后，添加客户端证书到服务器中(将已签名数字证书导入密钥库)

Java代码

keytool -import -v -alias custom -file custom.cer -keystore server.jks -storepass password

keytool -import -v -alias custom -file custom.cer -keystore server.jks -storepass password

4、查看证书内容

Java代码

keytool -list -v -keystore server.jks -storepass password

keytool -list -v -keystore server.jks -storepass password

5、配置tomcat service.xml文件

Xml代码

maxThreads="150" scheme="https" secure="true"

clientAuth="true" sslProtocol="TLS"

keystoreFile="D:/server.jks" keystorePass="password"

truststoreFile="D:/server.jks" truststorePass="password"

/>

maxThreads="150" scheme="https" secure="true"

clientAuth="true" sslProtocol="TLS"

keystoreFile="D:/server.jks" keystorePass="password"

truststoreFile="D:/server.jks" truststorePass="password"

/>

clientAuth="true"表示双向认证

6、导入客户端证书到浏览器

双向认证需要强制验证客户端证书。双击“custom.p12”即可将证书导入至IE

7、java代码实现

DefaultHttpClient httpclient = new DefaultHttpClient();

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());

FileInputStream instream = new FileInputStream(new File("D:/server.jks"));

try {

trustStore.load(instream, "password".toCharArray());

} finally {

instream.close();

}

SSLSocketFactory socketFactory = new SSLSocketFactory(trustStore,"password",trustStore);

Scheme sch = new Scheme("https", socketFactory, 443);

httpclient.getConnectionManager().getSchemeRegistry().register(sch);

HttpGet httpget = new HttpGet("https://localhost:8443/");

System.out.println("executing request" + httpget.getRequestLine());

HttpResponse response = httpclient.execute(httpget);

HttpEntity entity = response.getEntity();

System.out.println("----------------------------------------");

System.out.println(response.getStatusLine());

if (entity != null) {

System.out.println("Response content length: " + entity.getContentLength());

}

if (entity != null) {

entity.consumeContent();

}

httpclient.getConnectionManager().shutdown();