在同一个 JVM 上设置多个信任库 [英] Setting multiple truststore on the same JVM

问题描述

我有一个在 weblogic 服务器上运行的 Java 应用程序.该应用程序有两个不同的模块，它们使用 SSL 连接到外部 Web 服务 - 假设模块 A 和模块 B.

I have an Java application running on a weblogic server. The application has two distinct modules which use SSL to connect to external web services - let's say module A and module B.

模块 A - 建立在轴上 - 使用信任库 AMoudle B - 基于 Spring-ws 构建 - 使用信任库 B.

Module A - Built on Axis - Uses truststore A Moudle B - Built on Spring-ws - Uses truststore B.

模块 A 已存在.正在引入模块 B.

Module A is existing. Module B is being introduced.

我需要能够根据正在调用的模块在 JVM 中动态设置信任库.

I need to be able to set the truststore dynamically in the JVM based on which module is being invoked.

由于某些限制，我没有选择- 创建自定义密钥管理器.- 使用一个信任库

Due to some constraints I do not have the option - to create a custom key manager. - use one truststore

我尝试使用 System.setProperty im 模块 B 代码库来设置信任库.但是，它只有在首先调用模块 B 时才有效.例如 - 说我重新启动了 JVM然后我调用模块 A - 它在 JVM 中设置了它自己的信任库然后我调用模块 B - 它失败了 - 即使我使用了 System.setProperty 方法，它也没有在 JVM 中设置它自己的信任库.

I tried to use System.setProperty im Module B codebase to set truststore. However it works only if Module B got invoked first. For example - Say I have a fresh restart of the JVM then I invoke module A - it set's it's own truststore in the JVM then I invoke module B - It fails - it's does not set it's own truststore in the JVM even though I have used System.setProperty method.

我是否遗漏了什么，或者只是 System.setProperty 没有覆盖现有的设置值.如果是这样，我的选择是什么.

Am I missing something or it's just that System.setProperty doesn't override existing set values. If so what are my options here.

推荐答案

您可以在运行时动态加载可信密钥库.

You can load trusted key stores dynamically at runtime.

// load your key store as a stream and initialize a KeyStore
InputStream trustStream = ...    
KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());    

// if your store is password protected then declare it (it can be null however)
char[] trustPassword = ...

// load the stream to your store
trustStore.load(trustStream, trustPassword);

// initialize a trust manager factory with the trusted store
TrustManagerFactory trustFactory = 
  TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());    
trustFactory.init(trustStore);

// get the trust managers from the factory
TrustManager[] trustManagers = trustFactory.getTrustManagers();

// initialize an ssl context to use these managers and set as default
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustManagers, null);
SSLContext.setDefault(sslContext);

当心，因为 SSLContext.getDefault() 会给你返回 default 上下文你不能修改，所以你必须创建一个新的，初始化它然后将此新上下文设置为默认值.

Watch out, because SSLContext.getDefault() would give you back the default context which you cannot modify, so you have to create a new one, initialize it then set this new context as the default.

最重要的是，如果您愿意，您可以使用任意数量的信任存储.

The bottom line is that you can use any number of trust stores if you want to.

这篇关于在同一个 JVM 上设置多个信任库的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！