java - 使用 SSL 连接的 OpenLdap 失败

Question

我在本地使用 LinuxMint 工作，并在 virtualbox 中安装了带有 openldap 的 UbuntuServer。现在我按照本指南进行配置 http://help.ubuntu-it.org/12.04/server/serverguide/it/ubuntu-1204-server.pdfTLS/SSL 身份验证，但是当我尝试从 Java 连接 SSL 时:

import java.io.UnsupportedEncodingException;
import com.novell.ldap.LDAPConnection;
import com.novell.ldap.LDAPException;
import com.novell.ldap.LDAPJSSESecureSocketFactory;    

public class GetAuthenticated    
{    
    public static void main( String[] args ) {
        int ldapVersion   = LDAPConnection.LDAP_V3;
        int ldapPort      = LDAPConnection.DEFAULT_PORT;
        int ldapSSLPort   = LDAPConnection.DEFAULT_SSL_PORT;
        String ldapHost = "192.168.1.46";
        String loginDN = "cn=admin,dc=company,dc=com";
        String password = "secret";    
        LDAPConnection conn = new LDAPConnection();

        simpleBind1( conn, ldapHost, ldapPort, loginDN, password );
        SSLBind( ldapVersion, ldapHost, ldapSSLPort, loginDN, password );
        System.exit(0);
    }

    private static void simpleBind1(LDAPConnection conn, String host,
                                    int port, String dn, String passwd ) {
        try {    
            System.out.println("Simple bind...");    
            // connect to the server
            conn.connect( host, port );    
            // authenticate to the server
            try {
                conn.bind( LDAPConnection.LDAP_V3, dn, passwd.getBytes("UTF8") );
            } catch (UnsupportedEncodingException u){
                throw new LDAPException( "UTF8 Invalid Encoding",
                                         LDAPException.LOCAL_ERROR,
                                         (String)null, u);
            }
            System.out.println((conn.isBound()) ?
                "\n\tAuthenticated to the server ( simple )\n":
                    "\n\tNot authenticated to the server\n");
                // disconnect with the server
            conn.disconnect();
        }
        catch( LDAPException e ) {
            System.out.println( "Error: " + e.toString() );
        }
        return;
    }

    private static void SSLBind( int version, String host, int SSLPort, 
                                                   String dn, String passwd ) {
        // Set the socket factory for this connection only
        LDAPJSSESecureSocketFactory ssf = new LDAPJSSESecureSocketFactory();
        LDAPConnection  conn = new LDAPConnection(ssf);
        try {
            System.out.println("SSL bind...");
            // connect to the server
            conn.connect( host, SSLPort);
            // authenticate to the server with the connection method
            try {
                conn.bind( version, dn, passwd.getBytes("UTF8") );
            } catch (UnsupportedEncodingException u){
                throw new LDAPException( "UTF8 Invalid Encoding",
                                         LDAPException.LOCAL_ERROR,
                                         (String)null, u);
            }
            System.out.println((conn.isBound()) ?
                "\n\tAuthenticated to the server ( ssl )\n":
                    "\n\tNot authenticated to the server\n");
            // disconnect with the server
            conn.disconnect();
        }
        catch( LDAPException e ) {
            System.out.println( "Error: " + e.toString() );
        }
        return;
    }
}

simpleBind1 工作正常，但 SSLBind 不行，我有这个错误:

I/O Exception on host 192.168.1.46, port 636 (91) Connect Error
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:

Answer 1

您需要将服务器证书添加到 Java 的 keystore ，因为我假设它是自签名的。

您可以使用以下方式获取证书

openssl s_client -connect [hostname]:[port e.g. 443] < /dev/null > /tmp/lb.cert

然后将证书添加到您的 keystore

keytool -importcert -keystore [keystore location, varies, but can be e.g. /etc/pki/java/cacerts] -storepass changeit -file /tmp/lb.cert -alias newSelfSignedKey -noprompt