Question

此问题似乎与Warning: no suitable certificate found - continuing without client authentication重复但即使客户证书是由 CertificateRequest 消息中提到的签名者签署的，我也遇到了类似的问题。

我只是想知道对客户端和服务器（tomcat）使用自签名证书（不受CA信任）是否是对客户端身份验证的限制？

我正在尝试通过自签名证书使用客户端身份验证建立与HTTPS服务器的连接不受任何CA信任（使用keytool创建）。

我已经为keystore和truststore设置了属性（也启用了'debug'all）

System.setProperty("javax.net.debug", "all");
System.setProperty("jdk.tls.client.protocols", "TLSv1.2");
System.setProperty("https.protocols", "TLSv1.2");
System.setProperty("javax.net.ssl.trustStore", 
"C:\\Users\\rmohanda\\Certificates\\composerClient.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("javax.net.ssl.keyStore",  
"C:\\Users\\rmohanda\\Certificates\\composerClient.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "changeit");`

在运行时，我面临SSL握手异常：

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown 
     Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at InstallCert_ORG.main(InstallCert_ORG.java:102)

客户端密钥库：

  Loading Client KeyStore- C:\Users\rmohanda\Certificates\composerClient.jks    
  adding as trusted cert:
  Subject: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
  L="Chennai ", ST=TN, C=IN
  Issuer:  CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
  L="Chennai ", ST=TN, C=IN
  Algorithm: RSA; Serial number: 0x286e9e35
  Valid from Mon May 28 23:25:50 IST 2018 until Sat May 27 23:25:50 IST 2023

调试日志：

 *** CertificateRequest
 Cert Types: RSA, DSS, ECDSA
 Supported Signature Algorithms: SHA512withRSA, Unknown (hash:0x6, 
 signature:0x2), SHA512withECDSA, SHA384withRSA, Unknown (hash:0x5, 
 signature:0x2), SHA384withECDSA, SHA256withRSA, SHA256withDSA, 
 SHA256withECDSA, Unknown (hash:0x3, signature:0x1), Unknown (hash:0x3, 
 signature:0x2), Unknown (hash:0x3, signature:0x3), SHA1withRSA, 
 SHA1withDSA, SHA1withECDSA
 Cert Authorities:
 <CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, L="Chennai ", 
 ST=TN, C=IN>
 [read] MD5 and SHA1 hashes:  len = 171
 0000: 0D 00 00 A7 03 01 02 40   00 1E 06 01 06 02 06 03  .......@........
 0010: 05 01 05 02 05 03 04 01   04 02 04 03 03 01 03 02  ................
 0020: 03 03 02 01 02 02 02 03   00 81 00 7F 30 7D 31 0B  ............0.1.
 0030: 30 09 06 03 55 04 06 13   02 49 4E 31 0B 30 09 06  0...U....IN1.0..
 0040: 03 55 04 08 13 02 54 4E   31 11 30 0F 06 03 55 04  .U....TN1.0...U.
 0050: 07 13 08 43 68 65 6E 6E   61 69 20 31 19 30 17 06  ...Chennai 1.0..
 0060: 03 55 04 0A 13 10 47 65   6E 65 73 79 73 20 43 6F  .U....Genesys Co
 0070: 6D 70 6F 73 65 72 31 19   30 17 06 03 55 04 0B 13  mposer1.0...U...
 0080: 10 47 65 6E 65 73 79 73   20 43 6F 6D 70 6F 73 65  .Genesys Compose
 0090: 72 31 18 30 16 06 03 55   04 03 13 0F 43 6F 6D 70  r1.0...U....Comp
 00A0: 6F 73 65 72 20 43 6C 69   65 6E 74                 oser Client
 *** ServerHelloDone
 [read] MD5 and SHA1 hashes:  len = 4
 0000: 0E 00 00 00                                        ....
 Warning: no suitable certificate found - continuing without client 
 authentication
*** Certificate chain
<Empty>
***
*** ECDHClientKeyExchange
ECDH Public value:  { 4, 146, 75, 216, 252, 78, 7, 218, 254, 136, 127, 199, 
207, 80, 170, 251, 9, 188, 39, 206, 22, 74, 23, 63, 4, 39, 217, 73, 89, 143, 
4, 0, 116, 9, 234, 67, 240, 44, 91, 209, 165, 85, 22, 207, 75, 74, 86, 154, 
8, 239, 168, 138, 216, 35, 7, 56, 183, 7, 104, 139, 170, 104, 39, 229, 156 }
[write] MD5 and SHA1 hashes:  len = 77
0000: 0B 00 00 03 00 00 00 10   00 00 42 41 04 92 4B D8  ..........BA..K.
0010: FC 4E 07 DA FE 88 7F C7   CF 50 AA FB 09 BC 27 CE  .N.......P....'.

虽然证书请求中的证书颁发机构在客户端密钥库标题下与客户端证书匹配，但我仍然获得了手动共享异常

Cert Authorities:
 <CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, L="Chennai ", 
 ST=TN, C=IN>

证书警告并最终因异常而中止：

 Warning: no suitable certificate found - continuing without client 
 authentication
*** Certificate chain
<Empty>
***

注意：我没有通过CA签署客户端和服务器证书。出于测试目的，我只使用不受任何证书颁发机构信任的自签名证书。

更新：

命令： keytool -v -list -keystore composerClient.jks

C:\Users\users\XXX>keytool -v -list -keystore composerClient.jks
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: composerclient
Creation date: 28 May, 2018
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
L="Chennai ", ST=TN, C=IN
Issuer: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
L="Chennai ", ST=TN, C=IN
Serial number: 286e9e35
Valid from: Mon May 28 23:25:50 IST 2018 until: Sat May 27 23:25:50 IST 2023
Certificate fingerprints:
         MD5:  88:69:29:39:6D:46:F9:C2:27:8B:2B:C5:C7:F2:90:EE
         SHA1: 3D:7A:39:C4:0C:C1:15:07:94:2B:D2:AE:05:E0:C8:77:D5:13:C1:8D
         SHA256: 
 CB:8D:CD:95:15:35:6C:90:16:DB:35:4B:95:30:
 DE:7B:F8:CC:01:F8:8C:64:A5:F4:AE:F6:93:DB:4E:DE:A4:72
         Signature algorithm name: SHA256withRSA
         Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 CA AF 09 CF DE E6 F4   89 92 DF CC 8A 34 69 38  .............4i8
0010: 6F CB 4A E0                                        o.J.
]
]



*******************************************
*******************************************


Alias name: tomcat
Creation date: 4 Jun, 2018
Entry type: trustedCertEntry

Owner: CN=Tomcat SSLServer, OU=Genesys Tomcat, O=Genesys Tomcat, L=Daly 
City, ST=California, C=US
Issuer: CN=Tomcat SSLServer, OU=Genesys Tomcat, O=Genesys Tomcat, L=Daly 
City, ST=California, C=US
Serial number: 7c49521
Valid from: Mon May 28 23:20:46 IST 2018 until: Sat May 27 23:20:46 IST 2023
Certificate fingerprints:
         MD5:  B9:68:14:FB:95:F5:E6:22:A9:07:32:AD:DA:7A:D6:DD
         SHA1: 75:05:3E:5D:20:32:57:34:D3:67:29:33:B9:30:DB:8F:07:FB:8E:9D
         SHA256: 
 A4:D6:AC:38:AD:47:78:D9:C0:0D:AD:CB:B3:27:3F:99:45:
 1A:73:C0:87:B6:0A:44:04:C3:FD:16:C7:98:9C:06
        Signature algorithm name: SHA256withRSA
        Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 90 B1 89 D6 D2 EC 71 87   FD 46 09 B4 A0 BC A7 98  ......q..F......
0010: D7 C5 5C AD                                        ..\.
]
]



*******************************************
*******************************************

Answer 1

为了后代，此错误的一种可能原因是，如果您使用的HTTP客户端与标准Java客户端不同（例如Apache HttpClient，REST保证）。这些客户端必须单独配置，而不仅仅是继承通过java.net.ssl属性设置的密钥库/信任库值。

这里是为Apache的HttpClient（adapted from this answer）设置密钥库的示例。

try (InputStream inStream = this.class.getResourceAsStream(KEYSTORE))
{
    KeyStore ks = KeyStore.getInstance(KEYSTORE_TYPE);
    ks.load(inStream, KEYSTORE_PASSWORD.toCharArray());

    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    keyManagerFactory.init(ks, KEYSTORE_PASSWORD.toCharArray());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
    return HttpClients.custom().setSSLContext(sslContext).build();
}

SSL客户端验证 - 即使我的客户端证书与“证书颁发机构”中的列表匹配，也找不到合适的证书

1 个答案: