java - Java 中的 SSL 握手

Question

我的 Java 客户端需要访问通过 TLS 连接提供的资源。资源提供者使用自签名 key ，即 MM_Base64.cer。我将他们的 key 导入到 Java keystore 和 Java 信任库中。

对于keystore，我发布了

keytool -import -keystore D:\mptkeystore.jks -file D:\MM_Base64.cer -alias mpt

结果是

Enter keystore password:
Re-enter new password:
Owner: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN
Issuer: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN
Serial number: 55702f20
Valid from: Thu Jun 04 17:27:36 MMT 2015 until: Sat May 11 17:27:36 MMT 2115
Certificate fingerprints:
         MD5:  F5:8E:12:58:AC:97:53:CB:8B:B6:E2:DB:C3:F2:48:3D
         SHA1: F2:09:23:4C:9A:30:A6:4C:2D:F8:B0:F4:1D:06:41:5C:3A:3E:16:5A
         SHA256: 2B:51:BA:48:52:59:82:22:3C:E3:79:93:9E:C5:57:24:A5:9A:6E:08:A2:
7A:C6:FD:02:60:EB:3C:F2:14:53:AB
         Signature algorithm name: SHA1withRSA
         Version: 3
Trust this certificate? [no]:  yes
Certificate was added to keystore

对于trusrstore，

keytool -import -file D:\MM_Base64.cer -alias mit -keystore D:\truststore.jks

结果:

Enter keystore password:
Re-enter new password:
Owner: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN
Issuer: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN
Serial number: 55702f20
Valid from: Thu Jun 04 17:27:36 MMT 2015 until: Sat May 11 17:27:36 MMT 2115
Certificate fingerprints:
         MD5:  F5:8E:12:58:AC:97:53:CB:8B:B6:E2:DB:C3:F2:48:3D
         SHA1: F2:09:23:4C:9A:30:A6:4C:2D:F8:B0:F4:1D:06:41:5C:3A:3E:16:5A
         SHA256: 2B:51:BA:48:52:59:82:22:3C:E3:79:93:9E:C5:57:24:A5:9A:6E:08:A2:
7A:C6:FD:02:60:EB:3C:F2:14:53:AB
         Signature algorithm name: SHA1withRSA
         Version: 3
Trust this certificate? [no]:  yes
Certificate was added to keystore

看起来多余，但为了以防万一，多余是必要的。

程序是这样执行的:

java -jar CPS.jar -Djavax.net.ssl.trustStore=D:\truststore.jks -Djavax.net.ssl.trustStorePassword=password -Djavax.net.ssl.keyStore=D:\mptkeystore.jks -Djavax.net.ssl.keyStorePassword=password -Ddeployment.security.SSLv2Hello=false -Ddeployment.security.SSLv3=false -Ddeployment.security.TLSv1=false -Ddeployment.security.TLSv1.1=true -Ddeployment.security.TLSv1.2=true

TLS v1 无法与该服务一起使用，因此我禁用了它。

看起来握手错误还是出现了。有人发现我做事的方式有问题吗？

Answer 1

要添加到信任库，我认为您需要添加

-trustcacerts

https://docs.oracle.com/cd/E19830-01/819-4712/ablqw/index.html有例子-

keytool -import -v -trustcacerts
-alias keyAlias
 -file server.cer
-keystore cacerts.jks
 -keypass changeit
-storepass changeit