自签名证书的HttpClient 4.1.x错误（javax.net.ssl.SSLPeerUnverifiedException：peer未通过身份验证） [英] HttpClient 4.1.x error for self signed certificate (javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated )

问题描述

我正在尝试使用clientAuth = true&的自签名证书配置Tomcat6。然后使用HttpClient 4.1.x在客户端调用Tomcat服务器。

I am trying to configure the Tomcat6 with self-signed certificates with clientAuth=true & then to call the Tomcat server on client side using HttpClient 4.1.x.

我按照 http://virgo47.wordpress.com/2010/08/23/tomcat-web-application-with-ssl-client-certificates/ &当我从浏览器或openssl客户端进行测试时，它运行正常（我运行命令openssl s_client -cert client.crt -key client.key -CAfile ca.crt -connect localhost：8443）。

I followed the instruction provided in the http://virgo47.wordpress.com/2010/08/23/tomcat-web-application-with-ssl-client-certificates/ & it is working fine as expected when I am testing from the browser or from the openssl client (I ran the command "openssl s_client -cert client.crt -key client.key -CAfile ca.crt -connect localhost:8443").

我面临的问题是HttpClient。我编写了以下代码来创建HttpClient

The problem I am facing is with the HttpClient. I wrote the following code to create HttpClient

    private DefaultHttpClient creatHttpClient(KeyStore keyStore, 
        char[] keyStorePassword, KeyStore trustStore, char[] trustStorePassword) {
    try {

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
                TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore); // This contains CA certs
        TrustManager[] tm = trustManagerFactory.getTrustManagers();

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(
                KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keyStorePassword); // This contain client private key
        KeyManager[] km = keyManagerFactory.getKeyManagers();

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(km, tm, new SecureRandom());

        SSLSocketFactory sslSocketFactory = new SSLSocketFactory(sslContext, 
                SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

        HttpParams params = new BasicHttpParams();
        HttpConnectionParams.setConnectionTimeout(params, 10000);
        HttpConnectionParams.setSoTimeout(params, 30000);

        SchemeRegistry schemeRegistry = new SchemeRegistry();
        schemeRegistry.register(new Scheme("https", 
                443, sslSocketFactory));

        ClientConnectionManager clientConnectionManager = 
                new ThreadSafeClientConnManager(schemeRegistry);

        final DefaultHttpClient httpClient = new DefaultHttpClient(
                clientConnectionManager, params);
        return httpClient;
    } catch(Exception e) {
        throw e;
    }
}

为此，我收到了

    javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated

我启用了调试

    static
    { System.setProperty("javax.net.debug", "ssl,handshake,trustmanager"); }

我收到以下调试日志

    main, handling exception: java.lang.RuntimeException: Unexpected error:                      java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
    main, SEND TLSv1 ALERT:  fatal, description = internal_error 
    main, WRITE: TLSv1 Alert, length = 2
    main, called closeSocket()
    main, IOException in getSession():  javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
    main, called close()
    main, called closeInternal(true)
    main, called close()
    main, called closeInternal(true)

在这种情况下可能出现的问题？我不想忽略ssl证书错误，而是想要正确认证。

What could be possibly going wrong in this case? I don't want to ignore the ssl certificates error rather want to authenticate properly.

推荐答案

我解决了自己的问题。问题是我正在加载keystore&信任商店使用

I solved my own problem. The issue was that I was loading keystore & trust store using

InputStream ksin = this.getClass().getResourceAsStream("client.jks");
InputStream tsin = this.getClass().getResourceAsStream("cacerts.jks");

&在Junit测试中使用这些线条&它无法找到.jks文件。

& was using these lines in the Junit tests & it was not able to find .jks files.

我通过以下

if(0 == keyStore.size()) { throw new RuntimeException("Keystore is empty"); }
if(0 == trustStore.size()) { throw new RuntimeException("Truststore is empty"); }

信任库初始化。

因此，我将行更改为

InputStream ksin = Thread.currentThread().getContextClassLoader().getResourceAsStream("client.jks");
InputStream tsin = Thread.currentThread().getContextClassLoader().getResourceAsStream("cacerts.jks");

&一切正常。

这篇关于自签名证书的HttpClient 4.1.x错误（javax.net.ssl.SSLPeerUnverifiedException：peer未通过身份验证）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！