个人中心
gpt4 book ai didi

java - CAS - Pac4J - SSLHandshakeException

转载 作者：行者123 更新时间：2023-11-28 23:28:06 25 4
gpt4 key购买 nike

我尝试在通过 IP 地址访问的服务器上运行两个 Java 应用程序。

第一个是部署到安装在上述服务器上的 Tomcat 实例的 CAS 服务器。为了支持 SSO，我需要运行 HTTPS/SSL。这里一切正常——我可以毫无异常(exception)地通过 HTTPS 访问服务器。

第二个是我的应用程序配置为使用 CAS 服务器作为身份提供者。它不需要 HTTPS。应用程序在 Spring Embedded Tomcat 上运行。

当我打开应用程序的 protected 部分时，我被重定向到 CAS 登录页面。提交登录表单后，我将重定向到应用程序 (/callback)。如您所见，CAS 服务器端的一切都正常——已创建勾选并重定向用户。重定向到/callback 后我得到一个异常:

2015-12-20 13:14:10 ERROR CommonUtils:442 - java.security.cert.CertificateException: No subject alternative names present
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1916)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:279)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:273)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1469)
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:213)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:901)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:837)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1035)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1344)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1355)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1301)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
        at org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:431)
        at org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:41)
        at org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:193)
        at org.pac4j.cas.client.CasClient.retrieveUserProfile(CasClient.java:320)
        at org.pac4j.cas.client.CasClient.retrieveUserProfile(CasClient.java:83)
        at org.pac4j.core.client.BaseClient.getUserProfile(BaseClient.java:99)
        at org.pac4j.core.client.BaseClient.getUserProfile(BaseClient.java:48)
        at org.pac4j.springframework.web.CallbackController.callback(CallbackController.java:81)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:137)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:776)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:705)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:967)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:858)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:843)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.sitemesh.webapp.contentfilter.ContentBufferingFilter.bufferAndPostProcess(ContentBufferingFilter.java:169)
        at org.sitemesh.webapp.contentfilter.ContentBufferingFilter.doFilter(ContentBufferingFilter.java:126)
        at org.sitemesh.webapp.SiteMeshFilter.doFilter(SiteMeshFilter.java:120)
        at org.sitemesh.config.ConfigurableSiteMeshFilter.doFilter(ConfigurableSiteMeshFilter.java:163)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:85)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:518)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:673)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1526)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1482)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:745)
Caused by: java.security.cert.CertificateException: No subject alternative names present
        at sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:142)
        at sun.security.util.HostnameChecker.match(HostnameChecker.java:91)
        at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:347)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:203)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1451)
        ... 66 more

这两个应用程序在我使用“localhost”别名的个人计算机上运行良好——我不需要任何证书来应用程序。

在服务器上:

  1. Tomcat 证书:cn=localhost。添加到别名为“tomcat”的 cacerts。

  2. 正在为应用创建证书，cn=localhost

2.1

$JAVA_HOME/bin/keytool -genkey -alias communicator -keyalg RSA

2.2

$JAVA_HOME/bin/keytool -export -alias communicator -file communicator.cer -keystore ~/.keystore

2.3

$JAVA_HOME/bin/keytool -import -file /etc/ssl/certs/java/ communicator.cer -keypass changeit -keystore /etc/ssl/certs/java/cacerts -alias communicator

我猜应用程序的别名有问题。我尝试将此证书作为“localhost”和“我的服务器的主机名”添加到 cacerts。没有改变。服务器和我的开发环境之间的唯一区别是 IP 地址而不是“本地主机”别名。

您知道为什么此解决方案不起作用吗？

编辑 09.01.2015

我已经解决了问题。主要错误是从错误的 keystore 创建和导入证书:1. Tomcat配置为使用/home/.keystore2. 我尝试使用/root/.keystore 创建证书并将创建的证书导入 cacerts

我在分析浏览器使用的证书时找到了解决方案——没有任何关于 IP 的信息。

解决方案

  1. 生成证书(Tomcat 配置为使用/home/.keystore):

    $JAVA_HOME/bin/keytool –genkey –alias tomcat –keyalg RSA –keystore /home/.keystore <strong>–ext san=ip:{server_ip}</strong>

  2. 导出证书到文件:

    $JAVA_HOME/bin/keytool –export –alias tomcat –file /home/tomcat.cer –keystore /home/.keystore

  3. 将导出的证书导入到 cacerts:

    $JAVA_HOME/bin/keytool –import –alias tomcat –file /home/tomcat.cer –keystore /etc/ssl/certs/java/cacerts

现在一切正常。

最佳答案

用于调用您的 CAS 服务器的 url 是什么？我是说你在 pac4j 中的 CasClient 配置？

关于java - CAS - Pac4J - SSLHandshakeException，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/34384994/

25 4 0
文章推荐： python - 错误 :not all arguments converted during string formatting
文章推荐： java - 如何使用 java 在 mysql 中更新文件路径？
文章推荐： java - WebSocket 的 ClientEndpoint 接收数据的顺序是否与 ServerEndpoint 发送的顺序相同？
文章推荐： MySQL 显示值为 NULL 或 IN(2, 3) 的行
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com