java - Jetty 9 - 为域验证证书启用 OCSP 装订

Question

我在 Jetty 9 中启用 OCSP 装订时遇到了一些问题，我真的希望有人能在这里帮助我……希望如此!

为了我的测试，我从 PositiveSSL (Comodo) 购买了一个 SSL 证书，它给了我一个有效/可信的证书。此示例中的域是“dev.mydomain.com”，它将简单地指向我的本地 ip (127.0.0.1)。

然后我将提供的证书转换为 Java keystore 格式。

# Convert certificate to pkcs12
openssl pkcs12 -export -out dev.mydomain.com.pkcs12 -inkey dev.mydomain.com.key -in dev_mydomain_com.crt

# Create java keystore
keytool -importkeystore -srckeystore dev.mydomain.com.pkcs12 -srcstoretype pkcs12 -destkeystore dev.mydomain.com.keystore -deststoretype JKS

这是我用于创建 Jetty 服务器、激活证书、监听 443 端口 (https) 以及理论上激活 OCSP 的简化 Java 代码:

Server _server = new Server(); // org.eclipse.jetty.server.Server

HttpConfiguration httpsConfig = new HttpConfiguration();
HttpConnectionFactory http1 = new HttpConnectionFactory(httpsConfig);

SslContextFactory sslContextFactory = new SslContextFactory();
sslContextFactory.setKeyStorePath("dev.mydomain.com.keystore");
sslContextFactory.setKeyStorePassword("mypass");
sslContextFactory.setKeyManagerPassword("mypass");

// sslContextFactory.setValidateCerts(true); // tested
sslContextFactory.setEnableOCSP(true);

SslConnectionFactory ssl = new SslConnectionFactory(sslContextFactory, http1.getProtocol());

// SSL Connector
ServerConnector sslConnector = new ServerConnector(_server, ssl, http1);

sslConnector.setHost("127.0.0.1");
sslConnector.setPort(443);

_server.addConnector(sslConnector);

_server.start();
_server.join();

在 Java VM 启动时，我还启用了这些系统属性:

Security.setProperty("ocsp.enable", "true");
System.setProperty("jdk.tls.server.enableStatusRequestExtension", "true");
System.setProperty("com.sun.net.ssl.checkRevocation", "true");

经过几次尝试，我也尝试将证书链导入 keystore ，但对结果没有任何影响。

keytool -import -trustcacerts -alias ca -file COMODORSAAddTrustCA.crt -keystore dev.mydomain.com.keystore
keytool -import -trustcacerts -alias dv -file COMODORSADomainValidationSecureServerCA.crt -keystore dev.mydomain.com.keystore
keytool -import -trustcacerts -alias te -file AddTrustExternalCARoot.crt -keystore dev.mydomain.com.keystore

为了测试 OCSP 是否正确启用，我使用了一个名为 sslyze 的工具，但无论我尝试做什么，对 OCSP 的响应总是否定的:

OCSP Stapling - NOT SUPPORTED - Server did not send back an OCSP response

这是 sslyze 的完整输出:

C:\Tools\sslyze-1_4_1>sslyze --certinfo dev.mydomain.com:443


 AVAILABLE PLUGINS
 -----------------

  OpenSslCipherSuitesPlugin
  RobotPlugin
  CertificateInfoPlugin
  FallbackScsvPlugin
  SessionRenegotiationPlugin
  HeartbleedPlugin
  CompressionPlugin
  OpenSslCcsInjectionPlugin
  SessionResumptionPlugin
  HttpHeadersPlugin



 CHECKING HOST(S) AVAILABILITY
 -----------------------------

   dev.mydomain.com:443                       => 127.0.0.1




 SCAN RESULTS FOR DEV.MYDOMAIN.COM:443 - 127.0.0.1
 ------------------------------------------------

 * Certificate Information:
     Content
       SHA1 Fingerprint:                  7c398c59bac3a231efc9823c6958a7bc711bfc0e
       Common Name:                       dev.mydomain.com
       Issuer:                            COMODO RSA Domain Validation Secure Server CA
       Serial Number:                     103185809289011988533713848804380317148
       Not Before:                        2018-04-18 00:00:00
       Not After:                         2019-04-18 23:59:59
       Signature Algorithm:               sha256
       Public Key Algorithm:              RSA
       Key Size:                          2048
       Exponent:                          65537 (0x10001)
       DNS Subject Alternative Names:     ['dev.mydomain.com', 'www.dev.mydomain.com']

     Trust
       Hostname Validation:               OK - Certificate matches dev.mydomain.com
       Android CA Store (8.1.0_r9):       FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       iOS CA Store (11):                 FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       macOS CA Store (High Sierra):      FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       Mozilla CA Store (2018-01-14):     FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       Windows CA Store (2018-02-09):     FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       Symantec 2018 Deprecation:         OK - Not a Symantec-issued certificate
       Received Chain:                    dev.mydomain.com
       Verified Chain:                    ERROR - Could not build verified chain (certificate untrusted?)
       Received Chain Contains Anchor:    ERROR - Could not build verified chain (certificate untrusted?)
       Received Chain Order:              OK - Order is valid
       Verified Chain contains SHA1:      ERROR - Could not build verified chain (certificate untrusted?)

     Extensions
       OCSP Must-Staple:                  NOT SUPPORTED - Extension not found
       Certificate Transparency:          WARNING - Only 2 SCTs included but Google recommends 3 or more

     OCSP Stapling
                                          NOT SUPPORTED - Server did not send back an OCSP response


 SCAN COMPLETED IN 0.78 S
 ------------------------

抱歉发了这么长的帖子，但我尽量提供了尽可能多的细节!

谢谢! Jade 薇

Answer 1

Jetty 对 OSCP 配置值的处理确实不多。

3 个关键配置值 ...

1。启用 OCSP

SslContextFactory.setEnableOCSP(true)

该配置只是设置了 ocsp.enable JVM 安全属性。

2。设置 OCSP 响应程序 URL

SslContextFactory.setOcspResponderURL(ocspResponderURL)

如果设置了 setEnableOSCP(true) 和 OcspResponderURL，则设置了 ocsp.responderURL JVM 安全属性。

Jetty 代码

    if (_enableOCSP)
    {
        // Enable On-Line Certificate Status Protocol (OCSP) support
        Security.setProperty("ocsp.enable", "true");

        if (_ocspResponderURL != null)
        {
            // Override location of OCSP Responder
            Security.setProperty("ocsp.responderURL", _ocspResponderURL);
        }
    }

这两个是 JVM 级配置，此时 JVM 有责任将 OCSP 内容添加到 TLS/SSL 协商中。

3。自定义证书 validator

SslContextFactory.setValidateCerts(true)

如果设置了此项，则其他两个值将传递到自定义 Eclipse Jetty CertificateValidator。

更多 Jetty 代码

if (isValidateCerts())
{
    CertificateValidator validator = new CertificateValidator(trustStore, crls);
    validator.setMaxCertPathLength(getMaxCertPathLength());
    validator.setEnableCRLDP(isEnableCRLDP());
    validator.setEnableOCSP(isEnableOCSP());
    validator.setOcspResponderURL(getOcspResponderURL());
    validator.validate(keyStore, x509C);
}

这是一个服务器端组件，仅验证服务器将在启动时使用的证书。它只会在加载 keystore /信任库时发生一次。