java - 证书签名验证失败

Question

我的网站托管在亚马逊上。它建立在微软版本的 java 1.4.2_13 之上。我注意到电子邮件发不出去。我没有对代码进行任何更改。我找到了 this亚马逊网站上的文档并按照他们的指示发现我们的java环境没有通过测试。所以，我导入了新的 ssl 根证书。我可以验证它是否在 keystore 中，但是当我运行他们的 shaTest 时我收到以下错误消息并且电子邮件仍未发送。任何帮助表示赞赏。谢谢!

Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: Certificate signature validation failed
    at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.b(Unknown Source)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect (Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at java.net.URLConnection.getContent(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getContent(Unknown Source)
    at java.net.URL.getContent(Unknown Source)
    at ShaTest.main(ShaTest.java:11)
Caused by: sun.security.validator.ValidatorException: Certificate signature validation failed
    at sun.security.validator.SimpleValidator.engineValidate(Unknown Source)
    at sun.security.validator.Validator.validate(Unknown Source)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
    at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(Unknown Source)
    ... 14 more
Caused by: java.security.NoSuchAlgorithmException: 1.2.840.113549.1.1.11 Signature not available
    at java.security.Security.getEngineClassName(Unknown Source)
    at java.security.Security.getEngineClassName(Unknown Source)
    at java.security.Security.getImpl(Unknown Source)
    at java.security.Signature.getInstance(Unknown Source)
    at sun.security.x509.X509CertImpl.verify(Unknown Source)
    at sun.security.x509.X509CertImpl.verify(Unknown Source)
    ... 18 more

Answer 1

Java 本身在 1.4.2 中获得了 SHA256 支持，但 Microsoft Java 可能没有——尤其是因为它已经停产了很长时间。 You might be able to use bouncycastle .

注意 Java 1.4 于 2002 发布。那是14年前。那应该是一个巨大的危险信号；我不会在任何连接到互联网的机器上运行它。