Question

我需要能够使用scala和dispatch发送带有get请求的证书文件（.pem，我认为）。

你是怎么做到的？

Answer 1

基于@sbridges示例中的Java代码，我使用dispatch提出了以下Scala代码。它创建一个包含您提供的证书的自定义SSL上下文（仅限那些;在验证远程主机时，此代码不使用受信任根证书的默认存储）。



    class SslAuthenticatingHttp(certData: SslCertificateData) extends Http {
      override val client = new AsyncHttpClient(
        (new AsyncHttpClientConfig.Builder).setSSLContext(buildSslContext(certData)).build
      )

      private def buildSslContext(certData: SslCertificateData): SSLContext = {
        import certData._

        val clientCertStore = loadKeyStore(clientCertificateData, clientCertificatePassword)
        val rootCertStore = loadKeyStore(rootCertificateData, rootCertificatePassword)

        val keyManagerFactory = KeyManagerFactory.getInstance("SunX509")
        keyManagerFactory.init(clientCertStore, clientCertificatePassword.toCharArray)
        val keyManagers = keyManagerFactory.getKeyManagers()

        val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
        trustManagerFactory.init(rootCertStore)
        val trustManagers = trustManagerFactory.getTrustManagers()

        val context = SSLContext.getInstance("TLS")
        context.init(keyManagers, trustManagers, null)

        context
      }

      private def loadKeyStore(keyStoreData: Array[Byte], password: String): KeyStore = {
        val store = KeyStore.getInstance(KeyStore.getDefaultType)
        store.load(new ByteArrayInputStream(keyStoreData), password.toCharArray)
        store
      }
    }

    case class SslCertificateData (
      clientCertificateData: Array[Byte],
      clientCertificatePassword: String,
      rootCertificateData: Array[Byte],
      rootCertificatePassword: String)

将用作：



    val certificateData = SslCertificateData(/* bytes from .jks file for client cert here */, "secret!",
                                             /* bytes from .jks file for root cert here */, "also secret!")
    val http = new SslAuthenticatingHttp(certificateData)
    val page = http(req OK as.String)
    println(page())

请注意，这会将证书数据保留在内存中，这不是最安全的方式，并且不必要地占用内存。在许多情况下，它可能更适合在SslCertificateData案例类中存储InputStream或文件名。

Answer 2

我假设您要使用客户端证书进行https。我认为这需要在jvm级别设置，有一个很好的解释here如何做到。

正如here所述，似乎有一种方法可以直接使用ning，代码复制在下面，

// read in PEM file and parse with commons-ssl PKCS8Key
// (ca.juliusdavies:not-yet-commons-ssl:0.3.11)
RandomAccessFile in = null;
byte[] b = new byte[(int) certFile.length()];
in = new RandomAccessFile( certFile, "r" );
in.readFully( b );
char[] password = hints.get( "password" ).toString().toCharArray();
PKCS8Key key = new PKCS8Key( b, password );

// create empty key store
store = KeyStore.getInstance( KeyStore.getDefaultType() );
store.load( null, password );

// cert chain is not important if you override the default KeyManager and/or
// TrustManager implementation, IIRC
store.setKeyEntry( alias, key.getPrivateKey(), password, new DefaultCertificate[0] );

// initialize key and trust managers -> default behavior
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance( "SunX509" );

// password for key and store have to be the same IIRC
keyManagerFactory.init( store, password );
KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();

TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
tmf.init( store );
TrustManager[] trustManagers = tmf.getTrustManagers();

// override key and trust managers with desired behavior - for example
// * 'trust everything the server gives us' -> TrustManager#checkServerTrusted
// * 'always return a preset alias to use for auth' -> X509ExtendedKeyManager#chooseClientAlias, X509ExtendedKeyManager#chooseEngineClientAlias
for ( int i = 0; i < keyManagers.length; i++ )
{
    if ( keyManagers[i] instanceof X509ExtendedKeyManager )
    {
    AHCKeyManager ahcKeyManager = new AHCKeyManager( (X509ExtendedKeyManager) keyManagers[i] );
    keyManagers[i] = ahcKeyManager;
    }
}

for ( int i = 0; i < trustManagers.length; i++ )
{
    if ( tm instanceof X509TrustManager )
    {
    AHCTrustManager ahcTrustManager = new AHCTrustManager( manager, (X509TrustManager) trustManagers[i] );
    trustManagers[i] = ahcTrustManager;
    }
}

// construct SSLContext and feed to AHC config
SSLContext context = SSLContext.getInstance( "TLS" );
context.init( keyManagers, trustManagers, null );

ahcCfgBuilder.setSSLContext(context);

使用Scala Dispatch发送证书文件

2 个答案: