gpt4 book ai didi

java - 如何为相互 SSL 覆盖 Spring boot keystore /信任库

转载 作者:太空宇宙 更新时间:2023-11-03 14:26:04 26 4
gpt4 key购买 nike

我有一个 Spring Boot 应用程序。它的 application.yml 是从在线资源中获取的。它包含以下相互 SSL 的配置:

server:
ssl:
enabled: true
client-auth: need
key-store-type: PKCS12
key-store: http://{config server url}/keystore.p12
key-store-password: {keystore password}
trust-store-type: JKS
trust-store: http://{config server url}/truststore.jks
trust-store-password: {truststore password}
port: 8443

运行应用程序时,出现以下错误:

java.io.IOException: DerInputStream.getLength(): lengthTag=111, too big.
at sun.security.util.DerInputStream.getLength(DerInputStream.java:599)
at sun.security.util.DerValue.init(DerValue.java:391)
at sun.security.util.DerValue.<init>(DerValue.java:332)
at sun.security.util.DerValue.<init>(DerValue.java:345)
at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1938)
at java.security.KeyStore.load(KeyStore.java:1445)
at org.apache.tomcat.util.security.KeyStoreUtil.load(KeyStoreUtil.java:69)
at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:209)
at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:206)
at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:272)
at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:239)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:97)
... 23 common frames omitted

但我可以通过编程方式打开 keystore 和信任库。 (如下图)

private KeyStore getKeyStore() {
KeyStore keyStore = KeyStore.getInstance("PKCS12");
try (InputStream is = readCertificateFromURL(new URI(keyStoreURL))) {
keyStore.load(is, keyStorePassword.toCharArray());
}
return keyStore();
}

private InputStream readCertificateFromURL(URI uri) throws IOException {
RequestEntity<Void> requestEntity = RequestEntity.get(uri)
.accept(org.springframework.http.MediaType.APPLICATION_OCTET_STREAM)
.build();
Resource resource = new RestTemplate().exchange(requestEntity,Resource.class).getBody();
return resource.getInputStream();
}

我如何告诉 Spring boot 选择这些 key /信任库而不是 application.yml 中定义的那些?

我在网上找到的唯一东西是关于覆盖 keystore /信任库路径,而不是 KeyStore 对象本身。

最佳答案

javax.net.ssl.trustStorejavax.net.ssl.keyStore 的值以及它们在 Spring 属性中的对应值需要是文件系统路径。如果您将它们复制到本地文件系统并改为引用它们,您的方法是否有效?

关于java - 如何为相互 SSL 覆盖 Spring boot keystore /信任库,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/57112236/

26 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com