java - 为什么我需要为与 IBM MQ 的 SSL 连接提供 keystore 和信任库

Question

我创建了一个使用 SSL 连接到 IBM MQ 的轻型应用程序。

如果我同时设置 javax.net.ssl.trustStore 和 javax.net.ssl.keyStore 一切都按预期工作。

keystore (jks) 包含两个条目:

1. TrustedCertEntry

2. PrivateKeyEntry

我有这样的感觉，鉴于我是此连接的客户端，而 MQ 是服务器，因此应该只使用 trustStore，但事实并非如此，因为如果我只设置 trustStore，应用程序将无法运行。

谁能解释一下为什么两者都需要？

Answer 1

根据 SSL configuration of the Websphere MQ Java/JMS client指南，第 2 点。创建 keyStore 您很可能使用证书进行客户端身份验证。此身份验证设置需要一个 keystore :

Complete this section only if you wish to have client authentication when a connection is made to a Queue Manager. If client authentication has not been specified on the channel, you do not need to complete this section.

The keyStore is essentially the same as a trustStore, except that it holds the client's personal certificate, and the JSSE requires a password for access. You can in fact add your personal certificate to the trustStore created earlier and it will act as both trustStore and keyStore, but the password that was not required before will now need to be passed to the JSSE in order for it to access your personal certificate.

您可以在服务器上验证这一点，如 Using self-signed certificates for mutual authentication of a client and queue manager 中所示运行指导:

DISPLAY CHSTATUS(<your channel name>) SSLPEER SSLCERTI