java - 用户证书身份验证无法正常工作的 HTTPS Apache CXF 上的 Soap

Question

我们有一个在 Tomcat 上运行的服务器。此服务器连接到多个第三方服务。

我开发并测试了与 SOAP 服务的连接。该服务需要客户端使用证书进行识别。第一个版本设置属性:

• javax.net.ssl.trustStore
• javax.net.ssl.trustStorePassword
• javax.net.ssl.keyStore
• javax.net.ssl.keyStore密码
• javax.net.ssl.keyStoreType

我的代码在单独测试时工作正常，但当我的代码集成到我们的服务器时，它弄乱了与其他第三方服务器的连接。在寻找此问题的解决方案时，我找到了 Apache CFX。我注意到这个库有一个 API 来设置证书而无需更改全局属性。我们不使用 Spring，我想通过代码进行配置，但出现异常。

代码

  public NotaFiscalServiceSoap getNotaFiscalServiceSoap() throws IOException, GeneralSecurityException {

    if(notaFiscalServiceSoap==null){
      JaxWsProxyFactoryBean factory = new JaxWsProxyFactoryBean() ;           
      factory.setWsdlURL(municipio.getUrlWsdl().toString());
      factory.setServiceClass(NotaFiscalServiceSoap.class);
      factory.setServiceName(Q_NAME);
      factory.setConduitSelector(getConduitSelector()); 
      notaFiscalServiceSoap = factory.create(NotaFiscalServiceSoap.class);
    }

    return notaFiscalServiceSoap;

  }

  private ConduitSelector getConduitSelector() throws IOException, GeneralSecurityException {


    ServiceInfo serviceInfo = new ServiceInfo();
    serviceInfo.setTargetNamespace(NAMESPACE);

    EndpointInfo endpointInfo = new EndpointInfo();
    endpointInfo.setService(serviceInfo);
    endpointInfo.setName(Q_NAME);
    endpointInfo.setAddress(municipio.getUrlWsdl().toString());

    URLConnectionHTTPConduit conduit = new URLConnectionHTTPConduit(null, endpointInfo);
    conduit.setTlsClientParameters(getTLSClientParameters());
    ConduitSelector selector = new UpfrontConduitSelector(conduit);
    return selector;
  }


  private TLSClientParameters getTLSClientParameters() throws GeneralSecurityException, IOException{
    KeyStoreType trustKeyStore = new KeyStoreType();
    trustKeyStore.setFile(pathCertWsdl);
    trustKeyStore.setPassword(passCertWsdl);
    trustKeyStore.setType("jks");

    TrustManagersType trustManagerType = new TrustManagersType();  
    trustManagerType.setKeyStore(trustKeyStore); 

    KeyStoreType keyStoreType = new KeyStoreType();
    keyStoreType.setFile(pathCertA1);
    keyStoreType.setPassword(passCertA1);
    keyStoreType.setType("pkcs12");

    KeyManagersType keyManagerType = new KeyManagersType();   
    keyManagerType.setKeyStore(keyStoreType);
    keyManagerType.setKeyPassword(passCertA1);

    TLSClientParametersType clientParametersType = new TLSClientParametersType();
    clientParametersType.setTrustManagers(trustManagerType);
    clientParametersType.setKeyManagers(keyManagerType);
    clientParametersType.setUseHttpsURLConnectionDefaultHostnameVerifier(true);
    clientParametersType.setUseHttpsURLConnectionDefaultSslSocketFactory(true);

    return TLSClientParametersConfig.createTLSClientParametersFromType(clientParametersType);
  }

异常

java.security.UnrecoverableKeyException: Password must not be null
    at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:132)
    at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:56)
    at sun.security.provider.KeyStoreDelegator.engineGetKey(KeyStoreDelegator.java:96)
    ...
org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service.
    at org.apache.cxf.wsdl11.WSDLServiceFactory.<init>(WSDLServiceFactory.java:87)
    at org.apache.cxf.wsdl.service.factory.ReflectionServiceFactoryBean.buildServiceFromWSDL(ReflectionServiceFactoryBean.java:394)
    ...
Caused by: javax.wsdl.WSDLException: WSDLException: faultCode=PARSER_ERROR: Problem parsing 'https://issonline.vilavelha.es.gov.br/SistemaIss/WebService/NotaFiscalService.asmx?WSDL'.: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.ibm.wsdl.xml.WSDLReaderImpl.getDocument(WSDLReaderImpl.java:2198)
    at com.ibm.wsdl.xml.WSDLReaderImpl.readWSDL(WSDLReaderImpl.java:2390)
    at com.ibm.wsdl.xml.WSDLReaderImpl.readWSDL(WSDLReaderImpl.java:2422)
    ...  
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
    ... 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    ... 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    ... 

Answer 1

我找到了解决问题的方法。

我使用此 URL 作为引用:http://www.programcreek.com/java-api-examples/index.php?source_dir=support-examples-master/jaxws/cxfSsl.war/WEB-INF/classes/com/redhat/gss/jaxws/TestClient.java

1. 我改变了 soap 服务对象的创建方式。这样我就可以获得 HTTPConduit 并对其进行配置，而不必创建许多辅助对象(可能我在这里犯了一些错误)。
2. 我创建了 keystore 而不是配置证书。