ssl - 我如何才能正确导入此远程服务器证书(.crt 文件)以便从 WSO2 ESB 应用程序执行 HTTPS 请求？

Question

我绝对是 WSO2 ESB 的新手，我正在疯狂地尝试从已实现的 API 中正确地实现 HTTPS POST 调用。我似乎遇到了一些与 SSL 证书相关的问题，但我无法解决。

所以基本上我有以下情况:

在我的 bash shell 中，我可以对暴露在 HTTPS 上的远程网络服务执行 CURL 调用，将其证书传递到相关的 .crt文件(我已从 Firefox 导出此证书文件):

$ curl --cacert 52708968.crt https://XX.YY.ZZ.WW/myProject/xml/manager
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0    201      0 --:--:-- --:--:-- --:--:--   201<?xml version="1.0" encoding="UTF-8"?>
<response><error>XML document does not appear to begin with "&lt;?xml"</error></response>

如您所见，它可以正常工作，因为我毫无问题地获得了预期的响应。

好的，所以在我的 WSO2 ESB 项目中，我创建了指向此 URL 的端点: https://XX.YY.ZZ.WW/myProject/xml/manager .

然后我以这种方式定义了我的 API(保存到我项目的 RegisterReourceAPI.xml 文件中):

<?xml version="1.0" encoding="UTF-8"?>
<api context="/registerResource" name="RegisterResourceAPI" xmlns="http://ws.apache.org/ns/synapse">
    <resource methods="GET" uri-template="/registerResource/">
        <inSequence>
            <log description="Request Log" level="custom">
                <property name="message" value="&quot;Welcome to Resource Registration Service&quot;"/>
            </log>
            <send>
                <endpoint key="QueryWsEP"/>
            </send>
        </inSequence>
        <outSequence>
            <send/>
        </outSequence>
        <faultSequence/>
    </resource>
</api>

因此，要开始执行流程，我必须在我的 shell 中执行此请求:

curl -v http://localhost:8280/registerResource/registerResource/

但这样做我得到以下错误:

1) 进入我执行 CURL 调用的 shell，我获得了这个超时:

$ curl -v http://localhost:8280/registerResource/registerResource/
* timeout on name lookup is not supported
*   Trying ::1...
* TCP_NODELAY set
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8280 (#0)
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0> GET /registerResource/registerResource/ HTTP/1.1
> Host: localhost:8280
> User-Agent: curl/7.53.0
> Accept: */*
>
  0     0    0     0    0     0      0      0 --:--:--  0:03:00 --:--:--     0* Empty reply from server
  0     0    0     0    0     0      0      0 --:--:--  0:03:00 --:--:--     0
* Connection #0 to host localhost left intact
curl: (52) Empty reply from server

2) 进入WSO2 ESB 控制台我得到这个异常:

[2017-03-13 12:24:31,276]  INFO - LogMediator message = "Welcome to Resource Registration Service"
[2017-03-13 12:24:31,284]  INFO - TimeoutHandler This engine will expire all callbacks after GLOBAL_TIMEOUT: 120 seconds, irrespective of the timeout action, after the specified or optional timeout
[2017-03-13 12:24:31,564] ERROR - TargetHandler I/O error: handshake alert:  unrecognized_name
javax.net.ssl.SSLProtocolException: handshake alert:  unrecognized_name
    at sun.security.ssl.ClientHandshaker.handshakeAlert(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
    at javax.net.ssl.SSLEngine.unwrap(Unknown Source)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:245)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:280)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:410)
    at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:119)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:159)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:338)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:316)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:277)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:105)
    at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:586)
    at java.lang.Thread.run(Unknown Source)
[2017-03-13 12:24:31,603]  WARN - EndpointContext Endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager will be marked SUSPENDED as it failed
[2017-03-13 12:24:31,604]  WARN - EndpointContext Suspending endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager - current suspend duration is : 30000ms - Next retry after : Mon Mar 13 12:25:01 CET 2017
[2017-03-13 12:27:31,317]  WARN - SourceHandler Connection time out after request is read: http-incoming-1 Socket Timeout : 180000 Remote Address : /127.0.0.1:52188

所以我找到了这个教程:http://yasassriratnayake.blogspot.it/2016/04/how-to-get-rid-of-handshake-alert.html

这只是说将 -Djsse.enableSNIExtension=false 添加到 JVM 属性。所以我将它添加到 Eclipse 服务器设置中的服务器 VM 参数中:

再次执行 CURL 调用以执行 ESB 应用程序流程，现在我获得了这些不同的异常:

[2017-03-14 13:05:58,883]  INFO - LogMediator message = "Welcome to Resource Registration Service"
[2017-03-14 13:05:58,891]  INFO - TimeoutHandler This engine will expire all callbacks after GLOBAL_TIMEOUT: 120 seconds, irrespective of the timeout action, after the specified or optional timeout
[2017-03-14 13:06:03,788] ERROR - TargetHandler I/O error: General SSLEngine problem
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
    at sun.security.ssl.Handshaker.checkThrown(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.wrap(Unknown Source)
    at javax.net.ssl.SSLEngine.wrap(Unknown Source)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doWrap(SSLIOSession.java:237)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:271)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:410)
    at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:119)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:159)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:338)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:316)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:277)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:105)
    at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:586)
    at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
    at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
    at sun.security.ssl.Handshaker.processLoop(Unknown Source)
    at sun.security.ssl.Handshaker$1.run(Unknown Source)
    at sun.security.ssl.Handshaker$1.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:255)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:293)
    ... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
    at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
    at sun.security.validator.Validator.validate(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
    ... 18 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
    at java.security.cert.CertPathBuilder.build(Unknown Source)
    ... 24 more
[2017-03-14 13:06:03,815]  WARN - EndpointContext Endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager will be marked SUSPENDED as it failed
[2017-03-14 13:06:03,816]  WARN - EndpointContext Suspending endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager - current suspend duration is : 30000ms - Next retry after : Tue Mar 14 13:06:33 CET 2017

这似乎是与证书相关的东西...因为它找不到证书...所以我认为:“在第一个 CURL 请求中，您手动添加了此证书(52708968.crt 文件)，我还必须将此证书添加到 WSO2 ESB 服务器中。

所以我访问了 WSO2 ESB 管理面板 ( https://192.168.249.1:9443/carbon/ ) 并且:

1) Keystore --> List 在这里我可以找到 wso2carbon.jks 文件:

2) 然后我点击导入证书按钮将我的52708968.crt添加到这个 keystore ，我完成了:

3) 所以这个证书似乎已正确添加到我的 keystore 中，事实上现在我可以在证书列表中看到:

因此应该导入通过 HTTPS 连接到外部 Web 服务的证书。

4) 我重新启动了服务器并再次执行启动 WSO2 ESB 应用程序 执行流程的请求:

curl -v http://localhost:8280/registerResource/registerResource/

但我仍然准确地获得了之前的异常!!!

这怎么可能？证书设置在 keystore 中。怎么了？我错过了什么？我该如何尝试解决这个问题？

Answer 1

尝试在里面导入证书:

[WSO2_HOME]/repository/resources/security/client-truststore.jks
[WSO2_HOME]/repository/resources/security/wso2carbon.jks

使用:

keytool -importcert -file $path/your_certificate.cer -keystore client-truststore.jks -alias "youralias"

keytool -importcert -file $path/your_certificate.cer -keystore wso2carbon.jks -alias "youralias"