java - 我正在为 CertificateException 的异常(exception)而苦苦挣扎。如何生成带有主题备用名称的证书

Question

堆栈跟踪是:

Caused by: java.security.cert.CertificateException: No subject alternative names present
at sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:144) ~[na:1.8.0_65]
at sun.security.util.HostnameChecker.match(HostnameChecker.java:93) ~[na:1.8.0_65]
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455) ~[na:1.8.0_65]
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436) ~[na:1.8.0_65]
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200) ~[na:1.8.0_65]
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) ~[na:1.8.0_65]
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491) ~[na:1.8.0_65]

解决方案是:您的证书应包括该 ip 值作为主体替代名称值(IPAddress 类型:key=7)。但是，如何在生成证书时将 ip 值包含为主题备用名称值？

Answer 1

我会尝试使用 opessl。检查这个网址，你会找到你需要的。 opensslSAN .

看看这部分:文本:

"So by using the common syntax for OpenSSL subject written via command line you need to specify all of the above (the OU is optional) and add another section called subjectAltName=. By adding DNS.n (where n is a sequential number) entries under the subjectAltName" field you'll be able to add as many additional "alternate names" as you want, even not related to the main domain. Obviously the first-level parent domain will be covered by most SSL products, unless specified differently. So here's an example to generate a certificate"

openssl req -new -key endpoint.com.key -sha256 -nodes -subj '/C=US/ST=New York/L=New York/O=End Point/OU=Hosting Team/CN=www.endpoint.com/ emailAddress=administrative-not-existent-address@our-awesome-domain.com/
subjectAltName=DNS.1=endpoint.com' > www.endpoint.com.csr