java - 升级到 tomcat 8.5 时使用自定义 keystore 和 jsse 实现

Question

我们使用了自己的自定义 keystore ，还使用 ​​JSSEImplementation 和 ServerSocketFactory 提供了自定义类实现，并在 server.xml 中为“store”和“sslImplementation”属性进行了配置。

但现在升级到 8.5，我开始收到很多 JSSESocketFactory 等的 ClassNotFoundException。
做更多的研究，我发现他们已经删除了许多类和方法，如 JSSESocketFactory.java、getServerSocketFactory()、getSSLUtil(AbstractEndpoint endpoint) 等。

那么现在，我的问题是:
在 apache tomcat 8.5 中有什么方法可以在 server.xml 的“store”下配置我的自定义 keystore 并使用我自己的 sslImplementation？
我在方法签名中使用 AbstractEndpoint 来获取在 server.xml 中设置的商店名称，然后像这样在 MyJSSESocketFactory 中加载该 keystore :

public class MySSLImplementation extends JSSEImplementation 
{ 
@Override
    public org.apache.tomcat.util.net.ServerSocketFactory getServerSocketFactory(
            AbstractEndpoint endpoint) {
        kStore = endpoint.getProperty("store");
        return new MyJSSESocketFactory(endpoint, kStore);
    }
}

public class MyJSSESocketFactory extends JSSESocketFactory {

    private final AbstractEndpoint _endpoint;
    private final String store;

    public MyJSSESocketFactory(AbstractEndpoint endpoint, String store) {
        super(endpoint);
        this._endpoint = endpoint;
        this.store = store;
    }
    /*
     * Gets the SSL server's keystore.
     */
    @Override
    protected KeyStore getKeystore(String type, String provider, String pass)
            throws IOException {

        if ("MYKS".equalsIgnoreCase(type)) {

            String keystoreName = store;
            KeyStore ks = null;
            try {
                if (provider == null || provider.isEmpty()) {
                    ks = KeyStore.getInstance(type);
                } else {
                    ks = KeyStore.getInstance(type, provider);
                }

                MyStoreParameter params = new MyStoreParameter(
                        keystoreName);
                ks.load(params);
            } catch (Exception ex) {
                throw new IOException(
                        "Failed to load keystore " + keystoreName, ex);
            }
            return ks;
        } else {
            return super.getKeystore(type, provider, pass);
        }
    }
}

在 server.xml 中为“store”属性设置了“MYKS”

Answer 1

不管它值多少钱，这是破坏它的提交:

Remove BIo specific JSSE code

以下是删除它的一些理由:

https://github.com/spring-projects/spring-boot/issues/6164

@markt-asf There appears to be a number of breaking changes in 8.5.3 (upgrading from 8.0.33):

1. Maven artifact org.apache.tomcat.embed:tomcat-embed-logging-juli no longer exists
2. Class org.apache.tomcat.util.net.ServerSocketFactory no longer exists
3. Class org.apache.tomcat.util.net.jsse.JSSESocketFactory no longer exists
4. Method JSSEImplementaton.getServerSockerFactory(AbstractEndpoint) no longer exists
5. Method JSSEImplementaton.getSSLUtil(AbstractEndpoint) no longer exists
6. Http11NioProtocol.getEndpoint() is no longer visible
7. Field org.apache.tomcat.util.scan.Constants.MERGED_WEB_XML no longer exists
8. AbstractHttp11Protocol.setCompressableMimeTypes no longer exists

回复:

1 is only required to enable container logging via log4j 1.x and that version is no longer supported by the log4j community. log4j 2.x can be used for container logging without any extra libraries.

2-6 are side effects of the connector refactoring in 8.5.x / 9.0.x. They are all low-level internal APIs that I'm a little surprised to find boot is using.

7 was part of the mechanism used to pass web.xml to Jasper for processing. It was removed as it was no longer required as of Servlet 3.0 as all the necessary information was available via the standard Servlet API.

8 That was some API clean-up. That one could be restored fairly easily for 8.5.x.

提交于 2014 年 11 月。

从 Tomcat 8.0 开始，该类仍然存在 - 并且不在 *deprecated"列表中:

https://tomcat.apache.org/tomcat-8.0-doc/api/org/apache/tomcat/util/net/jsse/JSSESocketFactory.html

这是讨论“删除 BIO”(“阻塞 I/O”)的变更日志:

Migrating from Tomcat 8.0 to 8.5

最后，比较这两个链接可能会有所帮助:

SSL/TLS Configuration HOW-TO Tomcat 8.0.39

SSL/TLS Configuration HOW-TO Tomcat 8.5.9