以下工具可以用来测试TLS1.2证书是否生效:
第一个类:
package com.firstdata.TLStool;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;
/**
* 实现用于主机名验证的基接口。
* 在握手期间,如果 URL 的主机名和服务器的标识主机名不匹配,则验证机制可以回调此接口的实现程序来确定是否应该允许此连接。
*/
public class MyHostnameVerifier implements HostnameVerifier {
@Override
public boolean verify(String hostname, SSLSession session) {
if ("localhost".equals(hostname)) {
return true;
} else {
return false;
}
}
}
主要测试类:
package com.firstdata.TLStool;
import java.io.BufferedReader;
import java.io.FileInputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
public class httpsClitents {
static int i = 0;
/**
* 获得KeyStore.
*
* @param keyStorePath
* 密钥库路径
* @param password
* 密码
* @return 密钥库
* @throws Exception
*/
public static KeyStore getKeyStore(String password, String keyStorePath) throws Exception {
// 实例化密钥库
KeyStore ks = KeyStore.getInstance("JKS");
// 获得密钥库文件流
FileInputStream is = new FileInputStream(keyStorePath);
// 加载密钥库
ks.load(is, password.toCharArray());
// 关闭密钥库文件流
is.close();
return ks;
}
/**
* 获得SSLSocketFactory.
*
* @param password
* 密码
* @param keyStorePath
* 密钥库路径
* @param trustStorePath
* 信任库路径
* @return SSLSocketFactory
* @throws Exception
*/
public static SSLContext getSSLContext(String password, String keyStorePath, String trustStorePath)
throws Exception {
// 实例化密钥库
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
// 获得密钥库
KeyStore keyStore = getKeyStore(password, keyStorePath);
// 初始化密钥工厂
keyManagerFactory.init(keyStore, password.toCharArray());
// 实例化信任库
TrustManagerFactory trustManagerFactory = TrustManagerFactory
.getInstance(TrustManagerFactory.getDefaultAlgorithm());
// 获得信任库
KeyStore trustStore = getKeyStore(password, trustStorePath);
// 初始化信任库
trustManagerFactory.init(trustStore);
// 实例化SSL上下文
SSLContext ctx = SSLContext.getInstance("TLS");
// 初始化SSL上下文
ctx.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
// 获得SSLSocketFactory
return ctx;
}
/**
* 初始化HttpsURLConnection.
*
* @param password
* 密码
* @param keyStorePath
* 密钥库路径
* @param trustStorePath
* 信任库路径
* @throws Exception
*/
public static void initHttpsURLConnection(String password, String keyStorePath, String trustStorePath)
throws Exception {
// 声明SSL上下文
SSLContext sslContext = null;
// 实例化主机名验证接口
HostnameVerifier hnv = new MyHostnameVerifier();
try {
sslContext = getSSLContext(password, keyStorePath, trustStorePath);
} catch (GeneralSecurityException e) {
e.printStackTrace();
}
if (sslContext != null) {
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
}
HttpsURLConnection.setDefaultHostnameVerifier(hnv);
}
/**
* 发送请求.
*
* @param httpsUrl
* 请求的地址
* @param xmlStr
* 请求的数据
*/
public static void post(String httpsUrl, String xmlStr) {
HttpsURLConnection urlCon = null;
try {
urlCon = (HttpsURLConnection) (new URL(httpsUrl)).openConnection();
urlCon.setDoInput(true);
urlCon.setDoOutput(true);
urlCon.setRequestMethod("POST");
urlCon.setRequestProperty("Content-Length", String.valueOf(xmlStr.getBytes().length));
urlCon.setRequestProperty("Content-Type", "text/xml;charset=UTF-8");
urlCon.setUseCaches(false);
// 设置为gbk可以解决服务器接收时读取的数据中文乱码问题
urlCon.getOutputStream().write(xmlStr.getBytes("utf-8"));
urlCon.getOutputStream().flush();
urlCon.getOutputStream().close();
BufferedReader in = new BufferedReader(new InputStreamReader(urlCon.getInputStream()));
String line;
while ((line = in.readLine()) != null) {
i++;
System.out.println(line + "---- 第" + i + "条");
}
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* 测试方法.
*
* @param args
* @throws Exception
*/
public static void main(String[] args) throws Exception {
// 密码
String password = "123456";
// 密钥库
String keyStorePath = "C:/Program Files/Java/jdk1.7.0_79/bin/kclient.keystore";
// 信任库
String trustStorePath = "C:/Program Files/Java/jdk1.7.0_79/bin/tclient.keystore";
// 本地起的https服务
String httpsUrl = "https://localhost:27890/httpsSubmit";
// 传输文本
String xmlStr = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><MESSAGE>" + "</MESSAGE>";
httpsClitents.initHttpsURLConnection(password, keyStorePath, trustStorePath);
// 发起请求
httpsClitents.post(httpsUrl, xmlStr);
}
}
以下是如何使用p7b证书文件来生成keystore:
打开p7b证书文件,点击copy to file生成Base-64 encoded X.509(.CER)文件,可以获得.CER的证书文件
通过以下命令将.CER文件导入keystore密钥库:
C:\java\jdk1.8.0_65\bin\keytool -importcert -trustcacerts -file D:\CER\TestCer.cer -keystore D:\CER\TestKey.keystore -storepass 12345678 -keypass 12345678