Question

我已按照Digicert在以下链接提供的说明在服务器上安装了SSL / TLS证书。 https://www.digicert.com/ssl-certificate-installation-java.htm

还定义了TrustManager，但我仍然无法建立安全连接。我收到连接失败错误，原因是“连接建立错误：net :: ERR_SSL_VERSION_OR_CIPHER_MISMATCH”

以下是我添加SSL支持的代码。

private static void addSSLSupport(DefaultIoFilterChainBuilder chain)
        throws Exception {
    try {
        KeyStore keyStore=KeyStore.getInstance("JKS");
        char[] passphrase= {'t','e','s','t','s','s','l'};
        keyStore.load(new FileInputStream("/home/ec2-user/digicert/mydomain.jks"),passphrase);
        Util.logInfo("Key Store loaded");
        SSLContext ctx=SSLContext.getInstance("TLS");
        TrustManagerFactory trustFactory=TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustFactory.init(keyStore);
        X509TrustManager defaultTrustManager = (X509TrustManager) trustFactory.getTrustManagers()[0];
        ctx.init(null, trustFactory.getTrustManagers(), null);            
        SslFilter sslFilter = new SslFilter(ctx);
        chain.addLast("sslFilter", sslFilter);
        Util.logInfo("SSL ON");
    }catch(Exception e){
        Util.logError(e.toString());
        throw e;
    }
}

Answer 1

我初始化SSLContext时使用KeyManager而不是TrustManager。以下是供您参考的代码。

private static void addSSLSupport(DefaultIoFilterChainBuilder chain)
        throws Exception {
    try {
        KeyStore keyStore=KeyStore.getInstance("JKS");
        char[] passphrase= {'t','e','s','t','s','s','l'};
        keyStore.load(new FileInputStream("/root/mydomain.jks"),passphrase);
        Util.logInfo("Key Store loaded");
        KeyManagerFactory kmf = KeyManagerFactory
             .getInstance(KEY_MANAGER_FACTORY_ALGORITHM);
        kmf.init(keyStore, passphrase);
        SSLContext ctx=SSLContext.getInstance("TLS");
        ctx.init(kmf.getKeyManagers(), null, null);            
        SslFilter sslFilter = new SslFilter(ctx);
        chain.addLast("sslFilter", sslFilter);
        Util.logInfo("SSL ON");
    }catch(Exception e){
        Util.logError(e.toString());
        throw e;
    }
}

连接建立错误：net :: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

1 个答案: