带有 pem 证书的 RestTemplate [英] RestTemplate with pem certificate

问题描述

我有带有私钥和服务器证书的 pem 证书.我可以使用 curl 执行它并且一切正常.

I have pem certificate with private key and server certificate. I can execute it using curl and all works ok.

curl -O -k --cert-type pem --cert mypem.pem url

但是我想和java一起使用，最好是spring的RestTemplate.

But I want to use it with java, most preferably will be RestTemplate from spring.

推荐答案

因此分散了有关在 RestTemplate 中使用 pem 证书的知识.

So knowledge about using pem certificate with RestTemplate is distracted.

必须完成的步骤:

1. 使用 keytool 或 portecle 将服务器证书添加到 trustStore.当您想使用自定义信任库时，请使用此脚本

接下来将 ssl 配置为 RestTemplate.可以按如下方式完成:

Next configure ssl to RestTemplate. It may be done like below:

@Configuration
public class SSLConfiguration {

@Value("${certificate.name}")
private String name;

@Bean(name = "sslContext")
public SSLContext sslContext() throws Exception {
  Security.addProvider(new BouncyCastleProvider());
  return SSLContexts.custom().loadTrustMaterial(null, new TrustSelfSignedStrategy()).useTLS().build();
}

@Bean(name = "sslSocketFactory")
public SSLSocketFactory sslSocketFactory() throws Exception {

  return new ConnectionFactoryCreator(name, sslContext()).getSocketFactory();

}

@Bean(name = "httpClient")
public HttpClient httpClient() throws Exception {
  return HttpClientBuilder.create().setSslcontext(sslContext())
        .setSSLSocketFactory(new SSLConnectionSocketFactory(sslSocketFactory(), new AllowAllHostnameVerifier()))
        .build();
}

@Bean
public ClientHttpRequestFactory httpClientRequestFactory() throws Exception {
  return new HttpComponentsClientHttpRequestFactory(httpClient());
}

@Bean
public RestTemplate restTemplate() throws Exception {
  return new RestTemplate(httpClientRequestFactory());
 }

}

和

public class ConnectionFactoryCreator {

   private final String pemName;

   private final SSLContext context;

   public ConnectionFactoryCreator(String pemName, SSLContext context) {
      this.pemName = pemName;
      this.context = context;
   }

   public SSLSocketFactory getSocketFactory() throws Exception {

      InputStream resourceAsStream = getClass().getResourceAsStream(pemName);
  byte[] certAndKey = ByteStreams.toByteArray(resourceAsStream);

  byte[] certBytes = parseDERFromPEM(certAndKey, "-----BEGIN CERTIFICATE-----", "-----END CERTIFICATE-----");
  byte[] keyBytes = parseDERFromPEM(certAndKey, "-----BEGIN PRIVATE KEY-----", "-----END PRIVATE KEY-----");

  X509Certificate cert = generateCertificateFromDER(certBytes);

  PrivateKey key = generatePrivateKeyFromDER(keyBytes);

  KeyStore keystore = KeyStore.getInstance("JKS");
  keystore.load(null);
  keystore.setCertificateEntry("cert-alias", cert);
  keystore.setKeyEntry("key-alias", key, "changeit".toCharArray(), new Certificate[] { cert });

  KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
  kmf.init(keystore, "changeit".toCharArray());

  KeyManager[] km = kmf.getKeyManagers();

  context.init(km, null, null);

  return context.getSocketFactory();
   }

   private byte[] parseDERFromPEM(byte[] pem, String beginDelimiter, String endDelimiter) {
  String data = new String(pem);
  String[] tokens = data.split(beginDelimiter);
  tokens = tokens[1].split(endDelimiter);
  return DatatypeConverter.parseBase64Binary(tokens[0]);
   }

   private PrivateKey generatePrivateKeyFromDER(byte[] keyBytes)
     throws InvalidKeySpecException, NoSuchAlgorithmException {
  PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyBytes);

  KeyFactory factory = KeyFactory.getInstance("RSA");

  return factory.generatePrivate(spec);
   }

   private X509Certificate generateCertificateFromDER(byte[] certBytes) throws CertificateException {
  CertificateFactory factory = CertificateFactory.getInstance("X.509");

  return (X509Certificate) factory.generateCertificate(new ByteArrayInputStream(certBytes));
 }

最后你可以使用注入 restTemplate 来连接到 url.

Finally you can use inject restTemplate to connect to url.

这篇关于带有 pem 证书的 RestTemplate的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！