java - 自签名证书、Java、Hudson 和 JIRA

Question

我正在尝试设置 Hudson JIRA 插件。我们的 JIRA 服务器使用自签名 SSL 证书进行保护。我已经使用 keytool 命令插入了我的 Web 浏览器存储的证书，并让 Hudson 找到了它。但现在它提示:

java.security.cert.CertificateException: No subject alternative names present

证书的通用名称是“Unknown”，我在证书中没有看到任何主题备用名称

$ openssl x509 -in Unknown -text -noout
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 1214507595 (0x4863ea4b)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=US, ST=NJ, L=[Our town], O=[Our company], OU=[Our project], CN=Unknown
        Validity
            Not Before: Jun 26 19:13:15 2008 GMT
            Not After : May  5 19:13:15 2018 GMT
        Subject: C=US, ST=NJ, L=[Our town], O=[Our company], OU=[Our project], CN=Unknown
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                [omitted]
    Signature Algorithm: md5WithRSAEncryption
        [omitted]

(识别信息已编辑并在括号中注明。)

有没有办法将主题备用名称附加到此证书？或者还有其他方法吗？还是我被迫破解 Hudson Jira 插件？

Answer 1

用于访问您的 Jira 服务器的主机名(例如 https://jira.acme.com/ 中的 jira.acme.com)必须与 CN 之一匹配 主题名称的字段，或者如果没有，证书的 Subject Alternative Name 之一。

这在 RFC 2818 中有详细说明:

In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.

在您的情况下，Java 正在提示，因为 CN(“未知”)和 Subject Alternative Name(因为你没有)确实匹配你的 Jira 服务器的主机名。

因此，要么使用适当的 CN 生成证书，例如使用 keytool:

创建 key 对和自签名证书

$ keytool -genkey -alias jira_acme_com -keyalg RSA -keysize 2048 -validity 365 -keystore jira_acme_com.jksEnter keystore password:  Re-enter new password: What is your first and last name?  [Unknown]:  jira.acme.comWhat is the name of your organizational unit?  [Unknown]:  Our projectWhat is the name of your organization?  [Unknown]:  Our companyWhat is the name of your City or Locality?  [Unknown]:  Our townWhat is the name of your State or Province?  [Unknown]:  NJWhat is the two-letter country code for this unit?  [Unknown]:  USIs CN=jira.acme.com, OU=Our project, O=Our company, L=Our town, ST=NJ, C=US correct?  [no]:  yEnter key password for         (RETURN if same as keystore password): 

To view the personal information

$ keytool -list -v -keystore jira_acme_com.jks Enter keystore password:  Keystore type: JKSKeystore provider: SUNYour keystore contains 1 entryAlias name: jira_acme_comCreation date: Sep 4, 2010Entry type: PrivateKeyEntryCertificate chain length: 1Certificate[1]:Owner: CN=jira.acme.com, OU=Our project, O=Our company, L=Our town, ST=NJ, C=USIssuer: CN=jira.acme.com, OU=Our project, O=Our company, L=Our town, ST=NJ, C=USSerial number: 4c81e9a9Valid from: Sat Sep 04 10:39:37 CEST 2010 until: Sun Sep 04 10:39:37 CEST 2011Certificate fingerprints:     MD5:  15:6A:E3:14:E2:78:F4:95:41:E6:33:C9:F8:8B:64:23     SHA1: CD:A6:9A:84:18:E8:62:50:2C:DC:2F:89:22:F6:BA:E9:1A:63:F6:C6     Signature algorithm name: SHA1withRSA     Version: 3

And setup Tomcat to use the keystore.

Of, if you want to create a multihomed certificate, you'll have to use OpenSSL (keytool cannot add X509 extensions such as Subject Alternative Name). These links are excellent resources:

• Creating an SSL Certificate with Multiple Hostnames
• OpenSSL - Community Ubuntu Documentation

Update: Given that you can't change the certificate (you really should have mentioned that), a temporary solution could be to change the local /etc/hosts file of the required machines to resolve Unknown to the real IP of the machine.

123.123.123.123    Unknown

这样你就可以访问https://Unknown/从这些机器。但很明显，这更像是一个肮脏的 hack，而不是真正的解决方案，并且无法扩展。

联系管理员以获得真正的“好”证书仍然是真正好的解决方案。

资源

• A few frequently used SSL commands (使用 openssl 或 keytool)
• Creating an SSL Certificate with Multiple Hostnames
• OpenSSL - Community Ubuntu Documentation

引用资料

• RFC 2818
• keytool - Key and Certificate Management Tool
• Apache Tomcat 6.0 - SSL Configuration HOW-TO