可以说我有这样的东西(客户端代码):
TrustManager[] trustAllCerts = new TrustManager[]{ new X509TrustManager() { @Override public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } @Override public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType) { } @Override public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType) { } } }; SSLContext sslc = SSLContext.getInstance("TLS"); sslc.init(null, trustAllCerts, null); SocketFactory sf = sslc.getSocketFactory(); SSLSocket s = (SSLSocket) sf.createSocket("127.0.0.1", 9124);
这段代码是完整的功能,但是我真的不知道如何根据pem文件中可用的一个具体的CA证书来验证服务器的证书。
所有证书均由我的自签名CA签名,这是我需要根据其进行验证的CA(仅针对此证书)。
每个答案表示赞赏。
编辑:
回应 jglouie (非常感谢您-无法投票支持您的答案)。
我创建了解决方案:
new X509TrustManager() { @Override public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } @Override public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType) { } @Override public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType) throws CertificateException { InputStream inStream = null; try { // Loading the CA cert URL u = getClass().getResource("tcp/cacert.pem"); inStream = new FileInputStream(u.getFile()); CertificateFactory cf = CertificateFactory.getInstance("X.509"); X509Certificate ca = (X509Certificate) cf.generateCertificate(inStream); inStream.close(); for (X509Certificate cert : certs) { // Verifing by public key cert.verify(ca.getPublicKey()); } } catch (Exception ex) { Logger.getLogger(Client.class.getName()).log(Level.SEVERE, null, ex); } finally { try { inStream.close(); } catch (IOException ex) { Logger.getLogger(Client.class.getName()).log(Level.SEVERE, null, ex); } } } } };
我假设您的CA的自签名证书已按以下方式加载:
CertificateFactory cf = CertificateFactory.getInstance("X.509"); FileInputStream finStream = new FileInputStream("CACertificate.pem"); X509Certificate caCertificate = (X509Certificate)cf.generateCertificate(finStream);
然后在检查证书的方法中:
@Override public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) throws CertificateException { if (certs == null || certs.length == 0) { throw new IllegalArgumentException("null or zero-length certificate chain"); } if (authType == null || authType.length() == 0) { throw new IllegalArgumentException("null or zero-length authentication type"); } //Check if certificate send is your CA's if(!certs[0].equals(caCertificate)){ try { //Not your CA's. Check if it has been signed by your CA certs[0].verify(caCertificate.getPublicKey()) } catch(Exception e){ throw new CertificateException("Certificate not trusted",e); } } //If we end here certificate is trusted. Check if it has expired. try{ certs[0].checkValidity(); } catch(Exception e){ throw new CertificateException("Certificate not trusted. It has expired",e); } }
免责声明: 甚至没有尝试编译代码