如何使用Java访问双向认证的Https资源

Posted 2020-10-05 dreamingodd

本文借鉴了同事 JayChang的研究成果，这里是他的博客：http://jaychang.cn/ http://jaychang.iteye.com/category/105859

本文的相关源码位于 https://github.com/dreamingodd/CA-generation-demo 

 

0.Nginx配置Https双向认证

首先配置Https双向认证的服务器资源。

可以参考：http://www.cnblogs.com/dreamingodd/p/7357029.html

完成之后如下效果：

 

1.导入cacerts进行访问

首先将服务器证书导入keystore cacerts，默认密码为changeit，如果需要修改密码就改一下。

keytool -import -alias ssl.demo.com -keystore cacerts -file C:\\Development\\deployment\\ssl\\ca-demo\\server.crt

需要使用管理员权限到你使用的JDK security目录下执行（注意如果你有多个JDK的情况），效果如下：

然后使用Java访问：

 1 package me.dreamingodd.ca;
 2 
 3 import org.apache.http.HttpEntity;
 4 import org.apache.http.client.methods.CloseableHttpResponse;
 5 import org.apache.http.client.methods.HttpGet;
 6 import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
 7 import org.apache.http.impl.client.CloseableHttpClient;
 8 import org.apache.http.impl.client.HttpClients;
 9 import org.apache.http.ssl.SSLContexts;
10 import org.apache.http.util.EntityUtils;
11 
12 import javax.net.ssl.SSLContext;
13 import java.io.File;
14 import java.io.FileInputStream;
15 import java.io.InputStream;
16 import java.security.KeyStore;
17 
18 
19 /**
20  * #1
21  * HTTPS 双向认证 - direct into cacerts
22  * @Author Ye_Wenda
23  * @Date 7/11/2017
24  */
25 public class HttpsKeyStoreDemo {
26     // 客户端证书路径，用了本地绝对路径，需要修改
27     private final static String PFX_PATH = "C:\\\\Development\\\\deployment\\\\ssl\\\\ca-demo\\\\client.p12";
28     private final static String PFX_PWD = "demo"; //客户端证书密码及密钥库密码
29 
30     public static String sslRequestGet(String url) throws Exception {
31         KeyStore keyStore = KeyStore.getInstance("PKCS12");
32         InputStream instream = new FileInputStream(new File(PFX_PATH));
33         try {
34             // 这里就指的是KeyStore库的密码
35             keyStore.load(instream, PFX_PWD.toCharArray());
36         } finally {
37             instream.close();
38         }
39 
40         SSLContext sslcontext = SSLContexts.custom().loadKeyMaterial(keyStore, PFX_PWD.toCharArray()).build();
41         SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext
42                 , new String[] { "TLSv1" }  // supportedProtocols ,这里可以按需要设置
43                 , null  // supportedCipherSuites
44                 , SSLConnectionSocketFactory.getDefaultHostnameVerifier());
45 
46         CloseableHttpClient httpclient = HttpClients.custom().setSSLSocketFactory(sslsf).build();
47         try {
48             HttpGet httpget = new HttpGet(url);
49 //          httpost.addHeader("Connection", "keep-alive");// 设置一些heander等
50             CloseableHttpResponse response = httpclient.execute(httpget);
51             try {
52                 HttpEntity entity = response.getEntity();
53                 // 返回结果
54                 String jsonStr = EntityUtils.toString(response.getEntity(), "UTF-8");
55                 EntityUtils.consume(entity);
56                 return jsonStr;
57             } finally {
58                 response.close();
59             }
60         } finally {
61             httpclient.close();
62         }
63     }
64 
65     public static void main(String[] args) throws Exception {
66         System.out.println(sslRequestGet("https://ssl.demo.com/"));
67     }
68 
69 }

运行结果如下：

 

2.生成truststore库文件进行访问-原生方式

如果服务器的JDK/JRE不能随便改动，我们还可以使用生成truststore库的方式来实现。

首先通过ca.crt生成自己的truststore，把ca.crt复制一份，重命名为ca.cer，复制到security目录下，执行

keytool -keystore demo.truststore -keypass demodemo -storepass demodemo -alias DemoCA -import -trustcacerts -file ca.cer

效果如下：

使用生成的demo.truststore和client.p12进行java访问：

 1 package me.dreamingodd.ca;
 2 
 3 import javax.net.ssl.*;
 4 import java.io.*;
 5 import java.net.URL;
 6 import java.nio.charset.Charset;
 7 import java.security.KeyStore;
 8 
 9 
10 /**
11  * #2
12  * HTTPS 双向认证 - use truststore
13  * 原生方式
14  * @Author Ye_Wenda
15  * @Date 7/11/2017
16  */
17 public class HttpsTruststoreNativeDemo {
18     // 客户端证书路径，用了本地绝对路径，需要修改
19     private final static String CLIENT_CERT_FILE = "C:/Development/deployment/ssl/ca-demo/client.p12";
20     // 客户端证书密码
21     private final static String CLIENT_PWD = "demo";
22     // 信任库路径
23     private final static String TRUST_STRORE_FILE = "C:\\\\Development\\\\deployment\\\\ssl\\\\ca-demo\\\\demo.truststore";
24     // 信任库密码
25     private final static String TRUST_STORE_PWD = "demodemo";
26 
27 
28     private static String readResponseBody(InputStream inputStream) throws IOException {
29         try {
30             BufferedReader br = new BufferedReader(new InputStreamReader(inputStream, Charset.forName("UTF-8")));
31             StringBuffer sb = new StringBuffer();
32             String buff = null;
33             while((buff = br.readLine()) != null){
34                 sb.append(buff+"\\n");
35             }
36             return sb.toString();
37         } finally {
38             inputStream.close();
39         }
40     }
41 
42     public static void httpsCall() throws Exception {
43         // 初始化密钥库
44         KeyManagerFactory keyManagerFactory = KeyManagerFactory
45                 .getInstance("SunX509");
46         KeyStore keyStore = getKeyStore(CLIENT_CERT_FILE, CLIENT_PWD, "PKCS12");
47         keyManagerFactory.init(keyStore, CLIENT_PWD.toCharArray());
48 
49         // 初始化信任库
50         TrustManagerFactory trustManagerFactory = TrustManagerFactory
51                 .getInstance("SunX509");
52         KeyStore trustkeyStore = getKeyStore(TRUST_STRORE_FILE, TRUST_STORE_PWD,"JKS");
53         trustManagerFactory.init(trustkeyStore);
54 
55         // 初始化SSL上下文
56         SSLContext ctx = SSLContext.getInstance("SSL");
57         ctx.init(keyManagerFactory.getKeyManagers(), trustManagerFactory
58                 .getTrustManagers(), null);
59         SSLSocketFactory sf = ctx.getSocketFactory();
60 
61         HttpsURLConnection.setDefaultSSLSocketFactory(sf);
62         String url = "https://ssl.demo.com";
63         URL urlObj = new URL(url);
64         HttpsURLConnection con = (HttpsURLConnection) urlObj.openConnection();
65         con.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (Khtml, like Gecko) Chrome/56.0.2924.87 Safari/537.36");
66         con.setRequestProperty("Accept-Language", "zh-CN;en-US,en;q=0.5");
67         con.setRequestMethod("GET");
68 
69         String response = readResponseBody(con.getInputStream());
70         System.out.println(response);
71     }
72 
73     /**
74      * 获得KeyStore
75      *
76      * @param keyStorePath
77      * @param password
78      * @return
79 
80      * @throws Exception
81      */
82     private static KeyStore getKeyStore(String keyStorePath, String password,String type)
83             throws Exception {
84         FileInputStream is = new FileInputStream(keyStorePath);
85         KeyStore ks = KeyStore.getInstance(type);
86         ks.load(is, password.toCharArray());
87         is.close();
88         return ks;
89     }
90 
91 
92     public static void main(String[] args) throws Exception {
93         httpsCall();
94     }
95 
96 }

 

结果同1。

 

3.生成truststore库文件进行访问-Apache HTTP 组件方式

 

package me.dreamingodd.ca;

import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import java.io.*;
import java.net.URI;
import java.nio.charset.Charset;
import java.security.KeyStore;
import java.security.SecureRandom;

/**
 * #3
 * HTTPS 双向认证 - use truststore
 * Apache插件
 * @Author Ye_Wenda
 * @Date 7/11/2017
 */
public class HttpsTruststoreApacheContextDemo {
    // 客户端证书路径，用了本地绝对路径，需要修改
    private final static String CLIENT_CERT_FILE = "C:/Development/deployment/ssl/ca-demo/client.p12";
    // 客户端证书密码
    private final static String CLIENT_PWD = "demo";
    // 信任库路径
    private final static String TRUST_STRORE_FILE = "C:\\\\Development\\\\deployment\\\\ssl\\\\ca-demo\\\\demo.truststore";
    // 信任库密码
    private final static String TRUST_STORE_PWD = "demodemo";


    private static String readResponseBody(InputStream inputStream) throws IOException {
        try{
            BufferedReader br = new BufferedReader(new InputStreamReader(inputStream, Charset.forName("UTF-8")));
            StringBuffer sb = new StringBuffer();
            String buff = null;
            while((buff = br.readLine()) != null){
                sb.append(buff+"\\n");
            }
            return sb.toString();
        }finally{
            inputStream.close();
        }
    }

    public static void httpsCall() throws Exception {
        // 初始化密钥库
        KeyManagerFactory keyManagerFactory = KeyManagerFactory
                .getInstance("SunX509");
        KeyStore keyStore = getKeyStore(CLIENT_CERT_FILE, CLIENT_PWD, "PKCS12");
        keyManagerFactory.init(keyStore, CLIENT_PWD.toCharArray());

        // 初始化信任库
        TrustManagerFactory trustManagerFactory = TrustManagerFactory
                .getInstance("SunX509");
        KeyStore trustkeyStore = getKeyStore(TRUST_STRORE_FILE, TRUST_STORE_PWD,"JKS");
        trustManagerFactory.init(trustkeyStore);

//        SSLContext sslContext = SSLContexts.custom().loadKeyMaterial(keyStore, "123456".toCharArray())
//            .loadTrustMaterial(new File(TRUST_STRORE_FILE),"012345".toCharArray()).setSecureRandom(new SecureRandom()).useProtocol("SSL").build();
        SSLContext sslContext = SSLContext.getInstance("SSL");
        sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), new SecureRandom());

        SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext,new String[]{"TLSv1", "TLSv2", "TLSv3"},null,
                SSLConnectionSocketFactory.getDefaultHostnameVerifier());

        CloseableHttpClient closeableHttpClient = HttpClients.custom().setSSLContext(sslContext).build();
        HttpGet getCall = new HttpGet();
        getCall.setURI(new URI("https://ssl.demo.com"));
        CloseableHttpResponse response = closeableHttpClient.execute(getCall);
        System.out.println(convertStreamToString(response.getEntity().getContent()));

    }

    public static String convertStreamToString(InputStream is) {
        /*
          * To convert the InputStream to String we use the BufferedReader.readLine()
          * method. We iterate until the BufferedReader return null which means
          * there\'s no more data to read. Each line will appended to a StringBuilder
          * and returned as String.
          */
        BufferedReader reader = new BufferedReader(new InputStreamReader(is));
        StringBuilder sb = new StringBuilder();

        String line = null;
        try {
            while ((line = reader.readLine()) != null) {
                sb.append(line + "\\n");
            }
        } catch (IOException e) {
            e.printStackTrace();
        } finally {
            try {
                is.close();
            } catch (IOException e) {
                e.printStackTrace();
            }
        }

        return sb.toString();
    }

    /**
     * 获得KeyStore
     *
     * @param keyStorePath
     * @param password
     * @return
     * @throws Exception
     */
    private static KeyStore getKeyStore(String keyStorePath, String password,String type)
            throws Exception {
        FileInputStream is = new FileInputStream(keyStorePath);
        KeyStore ks = KeyStore.getInstance(type);
        ks.load(is, password.toCharArray());
        is.close();
        return ks;
    }



    public static void main(String[] args) throws Exception {
        httpsCall();
    }
}

 

结果同2。

 

本文的相关源码位于 https://github.com/dreamingodd/CA-generation-demo 

 

dreamingodd原创文章，如转载请注明出处。