java - 为什么 Java 尝试验证证书路径，尽管我明确设置了一个不验证任何证书的信任管理器？

Question

我有一个关于使用套接字和 Java 7 通过 SSL 进行简单通信的问题。

到目前为止，我已经创建了两个Runnable - 一个用于服务器，一个用于客户端。最后，我想创建一个简单的测试，我的应用程序在其中使用 SSL 将数据发送到模型服务器。服务器应该做的就是接收客户端发送的字符串，将其与文件内容进行比较，然后返回一个响应字符串，这取决于比较是否成功。

但是，我被困在 javax.net.ssl.SSLHandshakeException 上，尽管我明确地 不 希望对客户端进行身份验证!在客户端，我创建了一个不验证任何证书的信任管理器。在服务器端，设置 this.sslServerSocket.setWantClientAuth(false) 和/或 this.sslServerSocket.setNeedClientAuth(false) 也无济于事。出于测试目的，客户端和服务器都使用名为“keystore.ks”的相同 key 存储文件。

我在下面用箭头 (----->) 标记了发生异常的点。也许有人可以给我提示那里出了什么问题!

---

这是我的 SSLServer 类:

public class SSLServer implements Runnable
{    
    private SSLServerSocketFactory sslServerSocketFactory;
    private SSLServerSocket sslServerSocket;
    private SSLSocket sslSocket;
    private KeyStore keystore;
    private KeyManager[] keyManagers;
    private SSLContext sslContext;
    private SSLSession sslSession;
    private int port = 8081;
    private static final Character EOL = '\n';
    private static final Character EOF = '\u0017';

    public SSLServer() throws IOException, NoSuchAlgorithmException, KeyManagementException, KeyStoreException, CertificateException, UnrecoverableKeyException
    {
        char[] passphrase = "changeit".toCharArray();
        this.keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        this.keystore.load(new FileInputStream("keystore.ks"), passphrase);

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
        keyManagerFactory.init(this.keystore, passphrase);

        this.sslContext = SSLContext.getInstance("TLS");

        this.keyManagers = keyManagerFactory.getKeyManagers();

        this.sslContext.init(this.keyManagers, null, null);

        this.sslServerSocketFactory = this.sslContext.getServerSocketFactory();
        this.sslServerSocket = (SSLServerSocket) this.sslServerSocketFactory.createServerSocket(this.port);
        this.sslServerSocket.setSoTimeout(30000);
        this.sslServerSocket.setEnabledProtocols(new String [] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        this.sslServerSocket.setUseClientMode(false);
        this.sslServerSocket.setWantClientAuth(false);
        this.sslServerSocket.setNeedClientAuth(false);
    }

    @Override
    public void run()
    {
        InputStream inputStream = null;
        InputStreamReader inputStreamReader = null;
        BufferedReader input = null;
        OutputStream outputStream = null;
        PrintWriter output = null;

        try
        {
            System.out.println("Server started");

            System.out.println("  Waiting for connection from client...");
            this.sslSocket = (SSLSocket) this.sslServerSocket.accept();

            // Connection was accepted
            System.out.println("  Accepted connection from " + this.sslSocket.getInetAddress().getHostAddress() + ", port " + this.sslSocket.getPort());

            // set up a SSL session
            this.sslSession = this.sslSocket.getSession();
            System.out.println("  Cipher suite used for this session: " + this.sslSession.getCipherSuite());

            inputStream = (InputStream) this.sslSocket.getInputStream();
            inputStreamReader = new InputStreamReader(inputStream);
            input = new BufferedReader(inputStreamReader);

            outputStream = this.sslSocket.getOutputStream();
            output = new PrintWriter(outputStream);

            System.out.println("  Server -> receiving...");
            StringBuffer receiver = new StringBuffer();
            Character serverReceived;
            while ((serverReceived = (char)input.read()) != EOF)
            {
                receiver.append(serverReceived);
            }
            System.out.println("    Server received: " + serverReceived);

            System.out.println("  Server -> sending...");

            String serverSendSuccess = "Hello client, how are you?" + EOL + EOF;
            String serverSendFail = "Who are you?" + EOL + EOF;

            if (receiver.toString().contains("Hello server! I am the client!"))
            {
                System.out.println("    Server sent: " + serverSendSuccess);
                output.println(serverSendSuccess);
                output.flush();
            }
            else
            {
                System.out.println("    Server sent: " + serverSendFail);
                output.println(serverSendFail);
                output.flush();
            }
        }
        catch (IOException ex)
        {
            ex.printStackTrace();
        }
        finally
        {
            try
            {
                inputStream.close();
                outputStream.close();
                this.sslSocket.close();
            }
            catch(Exception ex) {}
            System.out.println("Server ended");
        }
    }
}

这是我的客户类:

public class SSLClient implements Runnable
{
    private SSLSocketFactory sslSocketFactory;
    private SSLSocket sslSocket;
    private KeyStore keystore;
    private KeyManager[] keyManagers;
    private TrustManager[] trustManagers;
    private SSLContext sslContext;
    private String hostname = "localhost";
    private int port = 8081;
    private static final Character EOL = '\n';
    private static final Character EOF = '\u0017';

    public SSLClient() throws UnknownHostException, IOException, KeyStoreException, NoSuchAlgorithmException, KeyManagementException, CertificateException, NoSuchProviderException, UnrecoverableKeyException
    {
        char[] passphrase = "changeit".toCharArray();        
        this.keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        this.keystore.load(new FileInputStream("keystore.ks"), passphrase);

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
        keyManagerFactory.init(this.keystore, passphrase);

        this.sslContext = SSLContext.getInstance("TLS");

        this.keyManagers = keyManagerFactory.getKeyManagers();

        this.trustManagers = new TrustManager[]{
            new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers()
                {
                    return null;
                }
                public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType)
                {

                }
                public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType)
                {

                }
            }
        };

        this.sslContext.init(this.keyManagers, this.trustManagers, new SecureRandom());

        this.sslSocketFactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
    }

    @Override
    public void run()
    {
        InputStream inputStream = null;
        InputStreamReader inputStreamReader = null;
        BufferedReader input = null;
        OutputStream outputStream = null;
        PrintWriter output = null;

        try
        {
            System.out.println("Start client");

            this.sslSocket = (SSLSocket) this.sslSocketFactory.createSocket(this.hostname, this.port);

            if(this.sslSocket.isConnected())
            {
                inputStream = (InputStream) this.sslSocket.getInputStream();
                inputStreamReader = new InputStreamReader(inputStream);
                input = new BufferedReader(inputStreamReader);

                outputStream = this.sslSocket.getOutputStream();                
                output = new PrintWriter(outputStream);

                System.out.println("  Client -> sending...");

                String clientSend = "Hello server! I am the client!" + EOL + EOF;

                output.println(clientSend);
----->          output.flush(); // exception occurs here!

                System.out.println("    Client sent: " + clientSend);

                StringBuffer receiver = new StringBuffer();
                Character clientReceived;
                while ((clientReceived = (char)input.read()) != EOF)
                {
                    receiver.append(clientReceived);
                }

                System.out.println("    Client received: " + receiver.toString());
            }
            else
            {
                System.err.println("Connection to server lost!");
            }
        }
        catch (IOException ex)
        {
            ex.printStackTrace();
        }
        finally
        {
            try
            {
                inputStream.close();
                outputStream.close();
                this.sslSocket.close();
            }
            catch(Exception ex) {}
            System.out.println("End client");
        }
    }
}

最后，输出:

---Start test---
>> Start server thread
>> Start client thread
Start client
Server started
  Waiting for connection from client...
  Accepted connection from 127.0.0.1, port 55287
  Client -> sending...
    Client sent: Hello server! I am the client!
  Cipher suite used for this session: SSL_NULL_WITH_NULL_NULL
  Server -> receiving...
javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.SSLSocketImpl.checkEOF(SSLSocketImpl.java:1458)
    [...]
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    [...]
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)
    [...]
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
    [...]
Server ended
End client
---End test---

Answer 1

从您精心构建的 SSLContext 中获取 SSLSocketFactory，而不是默认上下文。

在您执行的位置调用 isConnected() 是徒劳的。在这一点上它不可能是假的。如果存在连接问题，则会抛出异常。