运行时加载Java Trust Store - JVM启动之后

Question

在我的Java应用程序中，我需要将发布请求发送到位于HTTPS后面的服务器。在我的Java应用程序运行的机器上，有一个Java Trust Store在：/usr/local/comp.jks中包含我需要与之交互的服务器的证书(已导入(。

问题是我无法控制将如何运行我的Java应用程序的JVM - 例如通过添加：

-Djavax.net.ssl.trustStore=/usr/local/comp.jks to vm参数。

在我的应用程序 之后，可以将信任存储加载到上述路径中P>

我只找到了有关如何在运行时导入证书的指南，但我无法使用 - 而且由于我没有/usr/local/comp.jks

的密码

在我当前的实施(groovy(下方：

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.net.URL;
import java.security.KeyManagementException;
import java.security.KeyStore
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException
import java.security.cert.X509Certificate
import java.util.Base64;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

public class HttpsClientImpl extends AbstractHttpClient  {
  private String username = null;
  private String password = null;
  public HttpsClientImpl (String username, String password)  {
    this.username=username;
    this.password=password;
  }
  @Override
  public String sendRequest(String request, String method) {
    System.setProperty( "javax.net.ssl.trustStore", "/usr/local/comp.jks" );
    URL url = new URL(request);
    HttpsURLConnection con = (HttpsURLConnection) url.openConnection()
    // Set auth
    byte[] name = (username + ":" + password).getBytes();
    String authStr = Base64.getEncoder().encodeToString(name);
    con.setRequestProperty("Authorization", "Basic " + authStr)
    con.setRequestMethod(method);
    writeResult(con);
    return con.getResponseCode();
  }

  private void writeResult(HttpsURLConnection con) throws IOException {
    if(con!=null){
      BufferedReader br = null;
      if (200 <= con.getResponseCode() && con.getResponseCode() <= 299) {
        br = new BufferedReader(new InputStreamReader(con.getInputStream()));
      } else {
        br = new BufferedReader(new InputStreamReader(con.getErrorStream()));
      }
      try {
        String input;
        while ((input = br.readLine()) != null){
          System.out.println(input);
        }
        br.close();
      } catch (IOException e) {
        e.printStackTrace();
      }
    }
  }
}

当我跑步时：

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
Caused: sun.security.validator.ValidatorException: PKIX path building failed

Answer 1

假设您尚未实例化任何SSL连接，您可以简单地调用

System.setProperty( "javax.net.ssl.trustStore", "/usr/local/comp.jks" );

您可能还需要设置javax.net.ssl.trustStorePassword甚至javax.net.ssl.trustStoreType。

如果已实例化了默认的SSL基础架构，则可能必须使用密钥库来创建自己的SSLContext和SSLSocketFactory。

Answer 2

您可以在类中加载信任库。我建议的是同时使用您的信托店并加载JDK TrustStore并同时使用。我在这里给出了有关如何做的例子。

public class TrustManagerComposite implements X509TrustManager {
    private final List<X509TrustManager> compositeTrustmanager;
    public TrustManagerComposite() {
        List<X509TrustManager> trustManagers = new ArrayList<>();
        try (InputStream truststoreInput = PATH_TO_YOUR_TRUSTSTORE) {
            trustManagers.add(getCustomTrustmanager(truststoreInput));
            trustManagers.add(getDefaultTrustmanager());
        } catch (Exception e) {
            //log it
        }
        compositeTrustmanager = trustManagers;
    }
    private static X509TrustManager getCustomTrustmanager(InputStream trustStream) throws Exception {
        return createTrustManager(trustStream);
    }
    private static X509TrustManager getDefaultTrustmanager() throws Exception {
        return createTrustManager(null);
    }
    private static X509TrustManager createTrustManager(InputStream trustStream) throws Exception {
        // Now get trustStore
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        // load the stream to your store
        trustStore.load(trustStream, null);
        // initialize a trust manager factory with the trusted store
        TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustFactory.init(trustStore);
        // get the trust managers from the factory
        TrustManager[] trustManagers = trustFactory.getTrustManagers();
        for (TrustManager trustManager : trustManagers) {
            if (trustManager instanceof X509TrustManager) {
                return (X509TrustManager) trustManager;
            }
        }
        return null;
    }
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        for (X509TrustManager trustManager : compositeTrustmanager) {
            try {
                trustManager.checkClientTrusted(chain, authType);
                return;
            } catch (CertificateException e) {
                // maybe the next trust manager will trust it, don't break the loop
            }
        }
        throw new CertificateException("None of the TrustManagers trust this certificate chain");
    }
    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        for (X509TrustManager trustManager : compositeTrustmanager) {
            try {
                trustManager.checkServerTrusted(chain, authType);
                return;
            } catch (CertificateException e) {
                // maybe the next trust manager will trust it, don't break the loop
            }
        }
        throw new CertificateException("None of the TrustManagers trust this certificate chain");
    }
    @Override
    public X509Certificate[] getAcceptedIssuers() {
        List<X509Certificate> certs = new ArrayList<>();
        for (X509TrustManager trustManager : compositeTrustmanager) {
            for (X509Certificate cert : trustManager.getAcceptedIssuers()) {
                certs.add(cert);
            }
        }
        return certs.toArray(new X509Certificate[0]);
    }
}