接受Java中的自签名证书

Question

我正在尝试使用JBoss的自签名证书并试图信任代码。但我得到javax.net.ssl.SSLPeerUnverifiedException：。以下是我尝试过的事情，

创建了一个密钥库

创建了一个Trust Store

在JBoss AS 7.1.1中配置SSL

<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
  <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
    <ssl password="password" certificate-key-file="C:\work\certs\ks" protocol="TLSv1" verify-client="false" certificate-file="C:\work\certs\ks"/>
  </connector>
  <virtual-server name="default-host" enable-welcome-root="true">
    <alias name="localhost"/>
    <alias name="example.com"/>
  </virtual-server>
</subsystem>

启动了JBoss。现在，我可以通过点击“继续前进”按钮访问Chrome中的网站。

但是当我尝试从代码访问时，我会遇到异常。

javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:352)
    at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:397)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:573)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:732)
    at com.test.utility.TestHttps.main(TestHttps.java:61)

这是我的代码，

public class TestHttps {

  private static TrustManager[] getTrustManagers() throws IOException, GeneralSecurityException {

    String trustStorePassword = "password";

    String alg = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmFact = TrustManagerFactory.getInstance(alg);

    FileInputStream fis = new FileInputStream("C:\\work\\certs\\trust");
    KeyStore ks = KeyStore.getInstance("JKS");
    ks.load(fis, trustStorePassword.toCharArray());
    fis.close();

    tmFact.init(ks);

    TrustManager[] tms = tmFact.getTrustManagers();
    return tms;
  }

  public static void main(String[] args) throws Exception {

    SSLContext context = SSLContext.getInstance("TLS");
    context.init(null, getTrustManagers(), null);

    SSLSocketFactory ssf = new SSLSocketFactory(context);

    HttpClient base = new DefaultHttpClient();
    ClientConnectionManager ccm = base.getConnectionManager();
    SchemeRegistry registry = ccm.getSchemeRegistry();
    registry.register(new Scheme("https", 8443, ssf));

    try {

      DefaultHttpClient httpClient = new DefaultHttpClient(ccm, base.getParams());
      HttpGet getRequest = new HttpGet("https://localhost:8443/cafe/");

      HttpResponse response = httpClient.execute(getRequest);

      if (response.getStatusLine().getStatusCode() != 200) {
        throw new RuntimeException("Failed : HTTP error code : "
            + response.getStatusLine().getStatusCode());
      }

      BufferedReader br = new BufferedReader(new InputStreamReader(
          (response.getEntity().getContent())));
      String output;
      while ((output = br.readLine()) != null) {
        System.out.println(output);
      }
      httpClient.getConnectionManager().shutdown();
    } catch (ClientProtocolException e) {
      e.printStackTrace();
    } catch (IOException e) {
      e.printStackTrace();
    }
  }
}

请让我知道我做错了什么。提前谢谢。

Answer 1

我通过设置系统属性

找到了问题

System.setProperty("javax.net.debug", "SSL,handshake,trustmanager");

似乎问题出在Jboss SSL配置上，

<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
  <ssl password="password" certificate-key-file="C:\work\certs\ks" protocol="TLSv1" verify-client="false" certificate-file="C:\work\certs\ks"/>
</connector>

删除协议=＆＃34; TLSv1＆＃34;。并将证书导入JRE密钥库

1. 从浏览器访问该网站
2. 导出证书
3. 导入JRE密钥库

keytool -import -alias localhost -file C：\ ssl \ test.cer -keystore％JAVA_HOME％\ jre \ lib \ security \ cacerts＆＃34;

之后，以下代码就像魅力一样。

String path = "https://localhost:8443/cafe/";

URL url = new URL(path);
URLConnection conn = url.openConnection();

BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()));
String output;
while ((output = br.readLine()) != null) {
  System.out.println(output);
}
br.close();