我正在使用已导入C：\ Program Files \ Java \ jre1.8.0_131 \ lib \ security \ cacerts路径的测试证书。我正在尝试连接到https服务。它总是抛出javax.net.ssl.SSLHandshakeException。
main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
用于导入证书的命令。
"C:\Program Files\Java\jdk1.8.0_45\bin\keytool" -importcert -file rdm.cer -keystore keystore.jks -alias "Alias"
我正在以调试模式运行我的应用程序，并且可以在日志中看到证书。
keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trigger seeding of SecureRandom
done seeding SecureRandom
Allow unsafe renegotiation: true
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
main, setSoTimeout(60000) called
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 for TLSv1.1
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie: GMT: 1534747347 bytes = { 250, 16, 199, 57, 237, 133, 35, 35, 48, 125, 248, 24, 106, 46, 233, 69, 242, 51, 136, 208, 88, 167, 211, 251, 132, 111, 150, 122 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
***
main, WRITE: TLSv1.2 Handshake, length = 161
2018-08-20 12:16:43.235 INFO net.spy.memcached.MemcachedConnection: Reconnecting {QA sa=/172.16.1.17:11211, #Rops=0, #Wops=0, #iq=0, topRop=null, topWop=null, toWrite=0, interested=0}
main, READ: TLSv1.2 Handshake, length = 49
*** ServerHello, TLSv1.2
RandomCookie: GMT: 332696558 bytes = { 234, 168, 242, 200, 28, 74, 219, 81, 9, 44, 216, 43, 86, 174, 243, 47, 83, 112, 137, 143, 32, 28, 204, 137, 90, 230, 22, 102 }
Session ID: {}
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
***
%% Initialized: [Session-1, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
** TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
main, READ: TLSv1.2 Handshake, length = 1187
*** Certificate chain
chain [0] = [
[
Version: V3
Subject: CN="172.16.3.36,172.16.3.14,172.16.3.15,172.16.3.16", OU=zyme, O=e2open, L=bang, ST=kar, C=in
Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
Key: Sun RSA public key, 2048 bits
modulus: 26288587705731226064818589753048659979933979082172398103539291536912116521328191702059505704719623504721452502199723894343473609066181185614682405611327909976414972978300257092694722905977040348285234525233439913517871748456818332434069363143692175499636832151739752955128469125424596932231527684381772140595739308268376798999407602138623191596953297082016223422803203234361208107188586515320842725758206878522616967977338852131061599530993608016215602407912297789913642666962272021519422352667626917854730093008794105038362026941940240849225769346355205424246109492330994413354658193612922036023098171781577539564277
public exponent: 65537
Validity: [From: Wed Jan 31 17:41:25 IST 2018,
To: Tue Oct 27 17:41:25 IST 2020]
Issuer: CN="172.16.3.36,172.16.3.14,172.16.3.15,172.16.3.16"
SerialNumber: [ b633459b 3d582f5f]
Certificate Extensions: 5
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 49 15 62 A2 0A 45 B3 B5 0B 3E 38 87 7C E5 EF 50 I.b..E...>8....P
0010: 41 70 0B DD Ap..
]
[CN="172.16.3.36,172.16.3.14,172.16.3.15,172.16.3.16"]
SerialNumber: [ e6131d8f aeda7271]
]
[2]: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
CA:false
PathLen: undefined
]
[3]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
clientAuth
]
[4]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
DigitalSignature
Key_Encipherment
Data_Encipherment
]
[5]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: kubernetes
DNSName: kubernetes.default
DNSName: kubernetes.default.svc
DNSName: kubernetes.default.svc.cluster
DNSName: kubernetes.default.svc.cluster.local
IPAddress: 172.16.3.36
IPAddress: 10.254.0.1
IPAddress: 172.16.3.16
IPAddress: 172.16.3.15
IPAddress: 172.16.3.14
]
]
Algorithm: [SHA256withRSA]
Signature:
0000: 52 1D EC 32 97 48 89 7C 42 81 24 01 BB 0A 16 52 R..2.H..B.$....R
0010: 17 6C 87 15 BE 99 AC E3 6A CC 82 F2 7E 71 0B 99 .l......j....q..
0020: D9 86 64 4A 89 D7 97 8F 14 B3 CB 77 0B F3 51 F7 ..dJ.......w..Q.
0030: 32 B0 5D 09 FC E7 D5 29 F7 E7 2A 3F 3F 22 DF C7 2.]....)..*??"..
0040: 83 27 00 06 55 A5 97 59 E8 0A B5 AD 2B 1C 18 0C .'..U..Y....+...
0050: 2B F5 FD 6E 19 3D F2 87 7D 5A 68 E2 1D 87 69 D2 +..n.=...Zh...i.
0060: 8D A6 1D F4 4A 24 5A 84 A3 97 DA 8B D1 B0 16 ED ....J$Z.........
0070: D6 E9 74 12 4D BA B3 CA DD 89 F7 6C 4F 7F 0F A2 ..t.M......lO...
0080: B4 DF 84 04 CD 60 59 33 05 FF D6 34 D0 5C 22 42 .....`Y3...4.\"B
0090: 99 F2 95 6F 2B 58 0A 6A 08 28 54 BC E2 17 EC E4 ...o+X.j.(T.....
00A0: 87 8D 8C 6F 6E 84 96 72 B2 02 0B C8 2C ED 8F AB ...on..r....,...
00B0: 86 7A EF 9D 2B AD B7 A6 EF A4 61 FE 9D 2D 60 2B .z..+.....a..-`+
00C0: 01 B0 8C B2 53 6A 91 C2 67 F9 EE 7C E2 EE 36 3F ....Sj..g.....6?
00D0: E6 1A C5 8B 56 1C BB 46 F5 86 79 6A C2 E3 17 48 ....V..F..yj...H
00E0: 23 73 E7 C6 8F DA 36 4D 15 28 B3 64 3B 20 E0 AB #s....6M.(.d; ..
00F0: AA DE AC C9 FD 14 E8 5A DD 0D 66 F1 39 1A 78 BF .......Z..f.9.x.
]
***
%% Invalidated: [Session-1, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
main, SEND TLSv1.2 ALERT: fatal, description = certificate_unknown
main, WRITE: TLSv1.2 Alert, length = 2
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
main, called close()
main, called closeInternal(true)
我正在使用带有spring-boot的feignclient直接连接到服务
@Override
public void run(String... args) throws Exception {
System.setProperty( "sun.security.ssl.allowUnsafeRenegotiation", "true" );
MasterDataSearchResponseDto dto = dataApiProxy.searchDataRepository("zymecustomer", "soumya", "CDT", "NA", 3l);
logger.debug(dto.toString());
}
FeignClient实现
@FeignClient(name = "dataApiProxy", url = "https://172.16.3.36:8081/api/v1/proxy/namespaces/")
public interface DataApiProxy {
@RequestMapping(value="/api/masters/{masterId}", method=RequestMethod.PUT)
MasterDataSearchResponseDto searchDataRepository(@RequestParam("tid") String tid, @RequestParam("uid") String uid,
@RequestParam("tz") String timeZone, @RequestParam("source") String source,
@PathVariable("masterId") final Long masterId,
);
}
因为这是测试证书，所以我添加了sun.security.ssl.allowUnsafeRenegotiation = true以禁用重新协商。我仍然遇到异常。我怀疑我在导入证书时遗漏了一些东西。