java - 来自 Java 客户端的 SSL 错误，但在 Firefox 中以 POSTER 形式工作

Question

我只是在我的服务器上设置了 SSL 证书。我很确定它们设置正确。当在浏览器中转到 https://mydomain.com/myapp 时，页面会正确加载并且地址栏中会显示绿色锁。

从 Firefox 执行 POST>POSTER 到此 HTTPS url 我得到有效响应。

如果我从我的 Java 客户端执行相同的 POST，我会收到以下错误:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

在我的服务器上，我已将 CA_ROOT 证书放入 JAVA.../jre/lib/security/cacert keystore 。

这是我的 Java 客户端的发布代码。

URL url = new URL(Global.SERVER_URL);
HttpsURLConnection connection = null;
connection = (HttpsURLConnection) url.openConnection();
connection.setRequestMethod("POST");
connection.setDoOutput(true);
connection.setDoInput(true);
connection.setReadTimeout(45000);
connection.setRequestProperty("Content-Type", "text/json");
connection.connect();

请注意:这不是自签名证书。由CA颁发

我感觉 Glassfish 没有发送完整的证书链。我查看了浏览器获得的证书，它是完整的证书链。我查看了 SSL 错误，那只是我的域的中级证书。

如何让 Glassfish 发送完整的证书链？

检查 SSL 链

openssl.exe s_client -connect mydomain.com:443

返回

WARNING: can't open config file: /usr/local/ssl/openssl.cnf
Loading 'screen' into random state - done
CONNECTED(00000190)
depth=0 C = US, ST = <edited>, L = <edited>, O = <edited>, OU = <edited>, CN = <edited>
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = <edited>, L = <edited>, O = <edited>, OU = <edited>, CN = <edited>
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = US, ST = <edited>, L = <edited>, O = <edited>, OU = <edited>, CN = <edited>
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/C=US/ST=<edited>/L=<edited>/O=<edited>/OU=<edited>/CN=<edited>
   i:/O=Cybertrust Inc/CN=Cybertrust Public SureServer SV CA
---
Server certificate
-----BEGIN CERTIFICATE-----
<edited>
-----END CERTIFICATE-----
subject=/C=US/ST=<edited>/L=<edited>/O=<edited>/OU=<edited>/CN=<edited>
issuer=/O=Cybertrust Inc/CN=Cybertrust Public SureServer SV CA
---
No client certificate CA names sent
---
SSL handshake has read 1676 bytes and written 513 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: <edited>

    Session-ID-ctx:
    Master-Key: <edited>
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1410274974
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
read:errno=0

解决方案

Bruno 接受的概念答案

其他详细信息:

1. 获取 keystore 资源管理器。它是浏览 keystore 的绝佳 GUI 工具。
2. 使用 Keystore Explorer 打开 keystore.jks。
3. 右键单击相关证书 (mydomain) 并查看详细信息>证书链详细信息。
4. 如果它没有显示完整的证书链，则通过右键单击证书编辑证书链>附加证书来添加它。
5. 重新启动 Glassfish。

Answer 1

浏览器和 Java 使用不同的可信根证书集，默认情况下浏览器从操作系统获取此信息，Java 支持自己的列表，这就是它在浏览器中可能是绿色而在 Java 中不支持的原因

检查哪些证书支持您的 Java 版本: <jre_path>\bin\keytool -keystore "<jre_path>\lib\security\cacerts" -storepass changeit -list

如果您没有看到您的证书，只需将其添加到 <jre_path>\lib\security\cacerts文件。