SSL 客户端身份验证 - 即使我的客户端证书与“证书颁发机构”中的列表匹配，也找不到合适的证书

Posted 2023-02-22

【中文标题】SSL 客户端身份验证 - 即使我的客户端证书与“证书颁发机构”中的列表匹配，也找不到合适的证书

【英文标题】：SSL Client Authentiction - no suitable certificate found even though my client certificate matches to the list in 'Cert Authorities'

【发布时间】：2018-11-14 10:18:41

【问题描述】：

这个问题似乎与Warning: no suitable certificate found - continuing without client authentication 重复 但即使客户端证书是由 CertificateRequest 消息中提到的签名者签署的，我也遇到了类似的问题。

我只是想知道对客户端和服务器 (tomcat) 使用自签名证书（不受 CA 信任）是否是对客户端身份验证的限制？

我正在尝试通过自签名证书不受任何 CA 信任（使用 keytool 创建）使用客户端身份验证建立与 HTTPS 服务器的连接。

我已经设置了密钥库和信任库的属性（也启用了“调试”全部）

System.setProperty("javax.net.debug", "all");
System.setProperty("jdk.tls.client.protocols", "TLSv1.2");
System.setProperty("https.protocols", "TLSv1.2");
System.setProperty("javax.net.ssl.trustStore", 
"C:\\Users\\rmohanda\\Certificates\\composerClient.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("javax.net.ssl.keyStore",  
"C:\\Users\\rmohanda\\Certificates\\composerClient.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "changeit");`

在运行时，我遇到了 SSL 握手异常：

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown 
     Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at InstallCert_ORG.main(InstallCert_ORG.java:102)

客户端密钥库：

  Loading Client KeyStore- C:\Users\rmohanda\Certificates\composerClient.jks    
  adding as trusted cert:
  Subject: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
  L="Chennai ", ST=TN, C=IN
  Issuer:  CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
  L="Chennai ", ST=TN, C=IN
  Algorithm: RSA; Serial number: 0x286e9e35
  Valid from Mon May 28 23:25:50 IST 2018 until Sat May 27 23:25:50 IST 2023

调试日志：

 *** CertificateRequest
 Cert Types: RSA, DSS, ECDSA
 Supported Signature Algorithms: SHA512withRSA, Unknown (hash:0x6, 
 signature:0x2), SHA512withECDSA, SHA384withRSA, Unknown (hash:0x5, 
 signature:0x2), SHA384withECDSA, SHA256withRSA, SHA256withDSA, 
 SHA256withECDSA, Unknown (hash:0x3, signature:0x1), Unknown (hash:0x3, 
 signature:0x2), Unknown (hash:0x3, signature:0x3), SHA1withRSA, 
 SHA1withDSA, SHA1withECDSA
 Cert Authorities:
 <CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, L="Chennai ", 
 ST=TN, C=IN>
 [read] MD5 and SHA1 hashes:  len = 171
 0000: 0D 00 00 A7 03 01 02 40   00 1E 06 01 06 02 06 03  .......@........
 0010: 05 01 05 02 05 03 04 01   04 02 04 03 03 01 03 02  ................
 0020: 03 03 02 01 02 02 02 03   00 81 00 7F 30 7D 31 0B  ............0.1.
 0030: 30 09 06 03 55 04 06 13   02 49 4E 31 0B 30 09 06  0...U....IN1.0..
 0040: 03 55 04 08 13 02 54 4E   31 11 30 0F 06 03 55 04  .U....TN1.0...U.
 0050: 07 13 08 43 68 65 6E 6E   61 69 20 31 19 30 17 06  ...Chennai 1.0..
 0060: 03 55 04 0A 13 10 47 65   6E 65 73 79 73 20 43 6F  .U....Genesys Co
 0070: 6D 70 6F 73 65 72 31 19   30 17 06 03 55 04 0B 13  mposer1.0...U...
 0080: 10 47 65 6E 65 73 79 73   20 43 6F 6D 70 6F 73 65  .Genesys Compose
 0090: 72 31 18 30 16 06 03 55   04 03 13 0F 43 6F 6D 70  r1.0...U....Comp
 00A0: 6F 73 65 72 20 43 6C 69   65 6E 74                 oser Client
 *** ServerHelloDone
 [read] MD5 and SHA1 hashes:  len = 4
 0000: 0E 00 00 00                                        ....
 Warning: no suitable certificate found - continuing without client 
 authentication
*** Certificate chain
<Empty>
***
*** ECDHClientKeyExchange
ECDH Public value:   4, 146, 75, 216, 252, 78, 7, 218, 254, 136, 127, 199, 
207, 80, 170, 251, 9, 188, 39, 206, 22, 74, 23, 63, 4, 39, 217, 73, 89, 143, 
4, 0, 116, 9, 234, 67, 240, 44, 91, 209, 165, 85, 22, 207, 75, 74, 86, 154, 
8, 239, 168, 138, 216, 35, 7, 56, 183, 7, 104, 139, 170, 104, 39, 229, 156 
[write] MD5 and SHA1 hashes:  len = 77
0000: 0B 00 00 03 00 00 00 10   00 00 42 41 04 92 4B D8  ..........BA..K.
0010: FC 4E 07 DA FE 88 7F C7   CF 50 AA FB 09 BC 27 CE  .N.......P....'.

虽然证书请求中的证书颁发机构与上面客户端密钥库标题下的客户端证书相匹配，但我仍然收到handshare异常

Cert Authorities:
 <CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, L="Chennai ", 
 ST=TN, C=IN>

证书警告并最终异常中止：

 Warning: no suitable certificate found - continuing without client 
 authentication
*** Certificate chain
<Empty>
***

注意：我没有通过 CA 签署客户端和服务器证书。出于测试目的，我只是使用不受任何证书颁发机构信任的自签名证书。

更新：

命令： keytool -v -list -keystore composerClient.jks

C:\Users\users\XXX>keytool -v -list -keystore composerClient.jks
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: composerclient
Creation date: 28 May, 2018
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
L="Chennai ", ST=TN, C=IN
Issuer: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
L="Chennai ", ST=TN, C=IN
Serial number: 286e9e35
Valid from: Mon May 28 23:25:50 IST 2018 until: Sat May 27 23:25:50 IST 2023
Certificate fingerprints:
         MD5:  88:69:29:39:6D:46:F9:C2:27:8B:2B:C5:C7:F2:90:EE
         SHA1: 3D:7A:39:C4:0C:C1:15:07:94:2B:D2:AE:05:E0:C8:77:D5:13:C1:8D
         SHA256: 
 CB:8D:CD:95:15:35:6C:90:16:DB:35:4B:95:30:
 DE:7B:F8:CC:01:F8:8C:64:A5:F4:AE:F6:93:DB:4E:DE:A4:72
         Signature algorithm name: SHA256withRSA
         Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 CA AF 09 CF DE E6 F4   89 92 DF CC 8A 34 69 38  .............4i8
0010: 6F CB 4A E0                                        o.J.
]
]



*******************************************
*******************************************


Alias name: tomcat
Creation date: 4 Jun, 2018
Entry type: trustedCertEntry

Owner: CN=Tomcat SSLServer, OU=Genesys Tomcat, O=Genesys Tomcat, L=Daly 
City, ST=California, C=US
Issuer: CN=Tomcat SSLServer, OU=Genesys Tomcat, O=Genesys Tomcat, L=Daly 
City, ST=California, C=US
Serial number: 7c49521
Valid from: Mon May 28 23:20:46 IST 2018 until: Sat May 27 23:20:46 IST 2023
Certificate fingerprints:
         MD5:  B9:68:14:FB:95:F5:E6:22:A9:07:32:AD:DA:7A:D6:DD
         SHA1: 75:05:3E:5D:20:32:57:34:D3:67:29:33:B9:30:DB:8F:07:FB:8E:9D
         SHA256: 
 A4:D6:AC:38:AD:47:78:D9:C0:0D:AD:CB:B3:27:3F:99:45:
 1A:73:C0:87:B6:0A:44:04:C3:FD:16:C7:98:9C:06
        Signature algorithm name: SHA256withRSA
        Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 90 B1 89 D6 D2 EC 71 87   FD 46 09 B4 A0 BC A7 98  ......q..F......
0010: D7 C5 5C AD                                        ..\.
]
]



*******************************************
*******************************************

【问题讨论】：

您确定在连接的另一端您使用的是相同的证书。还有其他任何东西，如到期日、有效期。请检查

@SagarKharab，我已将客户端证书文件（从 JKS 密钥库导出）添加到服务器密钥库，反之亦然。我还仔细检查了证书没有过期。事实上，我在几天前创建了证书，有效期指定为 -validity 1825。

您的客户端证书不包含证书链。在密钥库中添加客户端证书和证书链。

@pawindergupta ，我为客户端和服务器使用自签名证书（不受任何 CA 信任），因此客户端和服务器只有一个证书关联（没有证书链存在于客户端和服务器）。也就是说，我不认为这可能是一个问题。如果我的理解有误，请澄清

客户端和服务器使用相同的密钥库文件吗？

【参考方案1】：

对于后代而言，此错误的一个可能原因是您使用的 http 客户端与标准 java 客户端不同（例如 Apache HttpClient、REST Assured）。这些客户端必须单独配置，并且不会仅仅继承通过 java.net.ssl 属性设置的密钥库/信任库值。

这是为 Apache 的 HttpClient (adapted from this answer) 设置密钥库的示例。

try (InputStream inStream = this.class.getResourceAsStream(KEYSTORE))

    KeyStore ks = KeyStore.getInstance(KEYSTORE_TYPE);
    ks.load(inStream, KEYSTORE_PASSWORD.toCharArray());

    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    keyManagerFactory.init(ks, KEYSTORE_PASSWORD.toCharArray());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
    return HttpClients.custom().setSSLContext(sslContext).build();

【讨论】：

如果您调用 HttpClients.createSystem() HttpClientBuilder.useSystemProperties() 或 SSLContexts.createSystemDefault()，Apache HC 确实会使用 sysprops