java - 在 Java 中实现 SSL clientAuth

Question

我是 SSL 的新手，正在尝试弄清楚如何让它与 Java Netty 服务器一起工作。我基本上想这样做:Correctly creating a new certificate with an intermediate certificate using bouny castle我想为不同的客户端创建证书并让它们与我的服务器通信。我为每个客户端生成唯一的证书，但我有两个关于 Java 中 SSL 实现的基本问题。

1. 当我创建我的中间证书来签署客户端证书时，这基本上是类似于创建根证书的一次性事情吗？也就是说，在示例中，作者生成了一个 KeyPair intermediatePair。当我签署不同的客户端证书时，我是否会重新生成此 KeyPair？我的猜测是否定的，我应该将这个中间证书保存在某个地方，然后在我的服务器启动时加载它。

2. 客户端如何真正获得服务器的信任？他们拥有的证书是由服务器 rootcert->intermediatecert 签名并创建信任链的事实吗？或者在我创建证书之后，我需要将该证书添加到我在服务器启动时使用的KeyStore trustStore？像这样的东西(伪代码)

   KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
   trustStore.load(null, null);
   CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
   Path p = Paths.get(path);
   byte[] bytes = Files.readAllBytes(p);
   InputStream in = new ByteArrayInputStream(bytes);
   X509Certificate certificate = null;
   if (in != null) {
       certificate = (X509Certificate) certificateFactory.generateCertificate(in);
       in.close();
   }
   trustStore.setCertificateEntry("certficateName", certificate);
   

Answer 1

When I create my intermediate certificate to sign the client certs, is this basically a one time thing similar to creating the root cert?

一次直到过期。

Meaning, in the example, the author generates an KeyPair intermediatePair. Do I regenerate this KeyPair when I sign for different client certs?

没有。

My guess is no and that I should save this intermediate cert somewhere and then load it when my server starts.

是的。

2. How do clients actually get trusted by the server? Is it the fact that the certificate they have is signed by the server rootcert->intermediatecert and creates the chain of trust?

事实是存在从客户端证书到受信任的根证书的证书链。

Or after I create my certificate, so I need to add that cert to the KeyStore trustStore I'm using when my server starts? Something like this (pseudocode)

没有。只需通过 keytool 确保根证书在信任库中。您根本不需要编写代码。