揭开银行U盾的秘密---签发CA证书：单向认证+双向认证(含java代码)

本文链接：https://blog.csdn.net/weixin_45396965/article/details/120270149

签发CA证书：单向认证+双向认证

<Connector port="443" protocol="HTTP/1.1" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="true" sslPortocol="TLS" keystoreFile="/srv/ftp/cas/server/server.p12" keystoreType="pkcs12" keystorePass="mldnjava" truststoreFile="/usr/local/tomcat9/ca-trust.p12" truststoreType="jks" truststorePass="mldnjava" />

启动tomcat，此时再次访问https://cas.com，提示连接失败。需要在证书里面配置您的证书，把/usr/srv/ftp/cas/client/client.p12 这个证书下载下来导入到浏览器您的证书里，重启浏览器，输入https://cas.com，成功访问！

使用java模拟携带证书请求

根证书可以使用jdk的keytool工具安装，方式有很多种，这里只选用库文件的模式。
首先，把根证书ca.crt复制一份，重命名为ca.cer，然后把这个文件复制到jdk的jre\lib\security目录下，在这个目录中进行根证书的安装：

keytool -keystore test.truststore -keypass mldnjava -storepass mldnjava -alias DemoCA -import -trustcacerts -file ca.cer

其中，test.truststore可以自定义名称，密码自定义，DemoCA别名自定义，ca.cer即刚才复制过来的文件，最后需要输入一个y确认信任。
在这里插入图片描述

java客户端代码：

package com.example.demo.Service;

import org.springframework.stereotype.Service;

import javax.net.ssl.*;
import java.io.*;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.security.KeyStore;

@Service
public class SSLService {

    /**
     * 客户端证书路径
     */
    private final static String CLIENT_CERT_FILE = "C:\\Users\\admin\\Desktop\\client.p12";
    /**
     * 客户端证书密码
     */
    private final static String CLIENT_PWD = "mldnjava";
    /**
     * 信任库文件路径
     */
    private final static String TRUST_STRORE_FILE = "C:\\Users\\admin\\Desktop\\test.truststore";
    /**
     * 信任库密码
     */
    private final static String TRUST_STORE_PWD = "mldnjava";
    private static String readResponseBody(InputStream inputStream) throws IOException {
        try {
            BufferedReader br = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8));
            StringBuilder sb = new StringBuilder();
            String buff = null;
            while ((buff = br.readLine()) != null) {
                sb.append(buff).append("\n");
            }
            return sb.toString();
        } finally {
            inputStream.close();
        }
    }
    private static void httpsCall() throws Exception {
        // 初始化密钥库
        KeyManagerFactory keyManagerFactory = KeyManagerFactory
                .getInstance("SunX509");
        KeyStore keyStore = getKeyStore(CLIENT_CERT_FILE, CLIENT_PWD, "PKCS12");
        keyManagerFactory.init(keyStore, CLIENT_PWD.toCharArray());
        // 初始化信任库
        TrustManagerFactory trustManagerFactory = TrustManagerFactory
                .getInstance("SunX509");
        KeyStore trustKeyStore = getKeyStore(TRUST_STRORE_FILE, TRUST_STORE_PWD, "JKS");
        trustManagerFactory.init(trustKeyStore);
        // 初始化SSL上下文
        SSLContext ctx = SSLContext.getInstance("SSL");
        ctx.init(keyManagerFactory.getKeyManagers(), trustManagerFactory
                .getTrustManagers(), null);
        SSLSocketFactory sf = ctx.getSocketFactory();
        HttpsURLConnection.setDefaultSSLSocketFactory(sf);
        String url = "https://cas.com";
        URL urlObj = new URL(url);
        HttpsURLConnection con = (HttpsURLConnection) urlObj.openConnection();
        con.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 " +
                "(KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36");
        con.setRequestProperty("Accept-Language", "zh-CN;en-US,en;q=0.5");
        con.setRequestMethod("GET");
        String res = readResponseBody(con.getInputStream());
        System.out.println(res);
    }
    /**
     * 获得KeyStore
     */
    private static KeyStore getKeyStore(String keyStorePath, String password, String type)
            throws Exception {
        FileInputStream is = new FileInputStream(keyStorePath);
        KeyStore ks = KeyStore.getInstance(type);
        ks.load(is, password.toCharArray());
        is.close();
        return ks;
    }
   public static void main(String[] args) throws Exception {
    httpsCall();
  }
}