Question

我有一个自编写的java服务器，它的密钥库中可能有多个密钥（1个密钥用于连接，另一个密钥用于翻转，如果第一个密钥到期），所以我尝试读取密钥库，然后构建一个短暂的密钥库当我需要启动服务器时，传递给SSLContext的一个键。但是，它似乎不起作用：

在客户端，我得到：

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
sun.security.ssl.AppOutputStream.write(Unknown Source)
java.io.BufferedOutputStream.flushBuffer(Unknown Source)
java.io.BufferedOutputStream.flush(Unknown Source)
com.netrust.protocol.ProtocolClient.initialize(ProtocolClient.java:41)
com.netrust.clientregistrar.gui.Client.connect(Client.java:501)
com.netrust.clientregistrar.gui.Client.sendGetDirectoryChangeLog(Client.java:108)
com.netrust.clientregistrar.gui.ServerTreeModel.refresh(ServerTreeModel.java:195)
com.netrust.clientregistrar.gui.ServerTreeModel.refresh(ServerTreeModel.java:333)
com.netrust.clientregistrar.gui.ServerTreePanel.refresh(ServerTreePanel.java:189)
com.netrust.clientregistrar.gui.ClientRegistrarPanel.<init>(ClientRegistrarPanel.java:195)
com.netrust.clientregistrar.gui.Main.runApplication(Main.java:150)
com.netrust.clientregistrar.gui.Main.access$300(Main.java:26)
com.netrust.clientregistrar.gui.Main$1.run(Main.java:64)
java.awt.event.InvocationEvent.dispatch(Unknown Source)
java.awt.EventQueue.dispatchEventImpl(Unknown Source)
java.awt.EventQueue.access$000(Unknown Source)
java.awt.EventQueue$3.run(Unknown Source)
java.awt.EventQueue$3.run(Unknown Source)
java.security.AccessController.doPrivileged(Native Method)
java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source)
java.awt.EventQueue.dispatchEvent(Unknown Source)
java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
java.awt.EventDispatchThread.pumpEvents(Unknown Source)
java.awt.EventDispatchThread.pumpEvents(Unknown Source)
java.awt.EventDispatchThread.run(Unknown Source)

在服务器端，我得到：

javax.net.ssl.SSLException: Received fatal alert: internal_error
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
com.netrust.server.ManagementSecureConnectionHandler.run(ManagementSecureConnectionHandler.java:96)
com.netrust.util.DynamicThreadPool$WorkerThread.run(DynamicThreadPool.java:295)

相关守则：

// marhalAsJKS()
Enumeration< String > aliases = keyStore.aliases();
String alias = null;
java.security.KeyStore jks = java.security.KeyStore.getInstance( java.security.KeyStore.getDefaultType() );
jks.load( null, oldPassword );
while ( aliases.hasMoreElements() )
{
    alias = aliases.nextElement();
    if ( keyStore.isKeyEntry( alias ) )
    {
        jks.setKeyEntry( alias,
                 keyStore.getKey( alias, oldPassword ),
                 oldPassword,
                 keyStore.getCertificateChain( alias ) );
    }
    else if ( keyStore.isCertificateEntry( alias ) )
    {
        jks.setCertificateEntry( alias, keyStore.getCertificate( alias ) );
    }
}
// Constructing ephemeral keystore and truststore
ephemeralKeyStore = managementKeyStore.marshalAsJKS();
ephemeralKeyStore.deleteEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS );
ephemeralTrustStore = managementKeyStore.marshalAsJKS();
ephemeralTrustStore.deleteEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS );
if ( generalConfiguration.isRootServerType() && managementKeyStore.isKeyEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS ) )
    ephemeralTrustStore.setCertificateEntry( PathRegistry.ROOT_CERTIFICATE_ROLLOVER_ENTRY_ALIAS,
                                     managementKeyStore.getCertificate( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS ) );

// Initializing SSL
sslContext = SSLContext.getInstance( "TLS" );
keyManagerFactory.init( getKeyStore(), getKeyStorePassword() );
trustManagerFactory.init( getTrustStore() );
sslContext.init( keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null );
serverSocket = ( SSLServerSocket ) sslContext.getServerSocketFactory().createServerSocket( getPort() );

类似问题，但有1种方式SSL： How can I have multiple SSL certificates for a Java server

Answer 1

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

这几乎可以肯定来自您使用空信任库初始化的客户端代码中的信任管理器。

2方式SSL在java中使用短暂的密钥库

1 个答案: