java - 在 2-way SSL 中禁用证书链验证

Question

我指的是这个问题的第二个答案:

Web Service Client (JAX-WS) in Weblogic(10.3) with 2 way SSL cannot complete the handshake

我有一个客户端程序，它使用单向 SSL 连接到另一台服务器 A。为了关闭证书链验证，我使用了上述问题的第二个答案中的解决方案来安装一个完全信任的信任管理器。它工作正常。

但是，当客户端程序通过双向SSL连接到另一台服务器B时，抛出如下异常。

java.net.SocketException: Software caused connection abort: recv failed
        at java.net.SocketInputStream.socketRead0(Native Method)
        at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
        at java.net.SocketInputStream.read(SocketInputStream.java:171)
        at java.net.SocketInputStream.read(SocketInputStream.java:141)
        at sun.security.ssl.InputRecord.readFully(InputRecord.java:465)
        at sun.security.ssl.InputRecord.read(InputRecord.java:503)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
        at sun.security.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1769)
        at sun.security.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:124
)
        at sun.security.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:1130
)
        at sun.security.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHan
dshaker.java:1216)
        at sun.security.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.ja
va:1128)
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.jav
a:348)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:961)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.
java:1375)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403
)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387
)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:
559)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect
(AbstractDelegateHttpsURLConnection.java:185)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLC
onnection.java:1316)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLCo
nnection.java:1291)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Htt
psURLConnectionImpl.java:250)

如果我不安装完全信任的信任管理器，我仍然可以连接到两个服务器(无论是单向还是双向 SSL)，前提是我指定了身份存储和信任存储:

System.setProperty("javax.net.ssl.keyStore", "path/to/your/key");
System.setProperty("javax.net.ssl.keyStorePassword", "your-keystore-password");
System.setProperty("javax.net.ssl.keyStoreType", "JKS");
System.setProperty("javax.net.ssl.trustStore", "path/to/your/trust/keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "your-truststore-password");

但是，我仍然想在双向 SSL 中关闭证书链验证。安装 all-trusting trust manager 似乎不起作用。为什么？

提前致谢。

Answer 1

However, I still want to turn off certificate chain validation in two-way SSL. Installing the all-trusting trust manager does not seem to work. Why?

服务器 要求您提供识别客户端证书。如果您的客户端未提供服务器配置为接受的证书，它会放弃您的连接尝试。

您根本无法在客户端中更改它。

SSL 协议(protocol)的设计使得如果客户端或服务器要求另一方使用证书来标识自己，则无法由需要提供证书的一方进行修改。