java - allowUnsafeRenegotiation，但仍然是 CertificateException

Question

我尝试使用 SOAPConnection 调用 https，并且我已经指向 keystore 和信任库，如下所示:

    System.setProperty("javax.net.ssl.keyStore", "C:/kei/tasks/MIP/Cert/ccc_acp.keystore");
    System.setProperty("javax.net.ssl.keyStorePassword", "password");
    System.setProperty("javax.net.ssl.trustStore", "C:/kei/tasks/MIP/Cert/trusteaistore.keystore");
    System.setProperty("javax.net.ssl.trustStorePassword", "password");
    System.setProperty("javax.net.debug", "all");

但我还是明白了

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present

我谷歌并找到了以下临时解决方案

System.setProperty( "sun.security.ssl.allowUnsafeRenegotiation", "true" );

但即使我将 allowUnsafeRenegotation 设置为 true，我仍然得到

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present

我尝试使用 SOAPUI 5.1.3，并且优先选择> ssl，我设置了 keystore 和 keystore 密码(但没有设置信任库的地方)，这次我可以通过 https 连接到我的目标服务器!

所以

1)为什么soapUI 5.1.3不需要设置truststore(只需要设置keystore)，仍然可以连接到https服务器？

2) 为什么使用系统属性指向相同的 keystore ，但我无法使用 SOAPConnection 连接到 https 服务器？

3) 为什么我将 allowUnsafeRenegotitation 系统属性设置为 true，但它似乎仍在检查公共(public)证书。 https 服务器，并返回 CertificateException?

***************** 编辑于 15/5/2015

我把代码贴在这里

public static void main(String args[]){ 
    System.setProperty("javax.net.ssl.keyStore", "C:/kei/tasks/MIP/Cert/ccc_acp.keystore");
    System.setProperty("javax.net.ssl.keyStorePassword", "password");
    MipCccSoapTest mipCccSoapTest = new MipCccSoapTest();
    mipCccSoapTest.testHttpConnection();        
}

private void testHttpConnection(){
    try{
        doTrustToCertificates();            
         URL url = new URL("https://10.7.3.43:9443/iboss/CustomerCareM1");
         HttpsURLConnection conn = (HttpsURLConnection)url.openConnection(); 
         HttpsURLConnection.getDefaultSSLSocketFactory();
         System.out.println("ResponseCoede ="+conn.getResponseCode());
    }catch(Exception ex){
        ex.printStackTrace();
    }
    System.exit(0);
    //end testing
}

// trusting all certificate 
 public void doTrustToCertificates() throws Exception {
    Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
    TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                public X509Certificate[] getAcceptedIssuers() {
                    return null;
                }

                public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    return;
                }

                public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    return;
                }
            }
    };

    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
    HostnameVerifier hv = new HostnameVerifier() {
        public boolean verify(String urlHostName, SSLSession session) {
            if (!urlHostName.equalsIgnoreCase(session.getPeerHost())) {
                System.out.println("Warning: URL host '" + urlHostName + "' is different to SSLSession host '" + session.getPeerHost() + "'.");
            }
            return true;
        }
    };
    HttpsURLConnection.setDefaultHostnameVerifier(hv);
}

我得到以下错误

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure at sun.security.ssl.Alerts.getSSLException(Unknown Source)

但 keystore 应该是正确的，因为我在 SOAPUI 5.1.3 中使用相同的 keystore ，它可以成功调用服务器。

****************** 编辑于 18/5/2015 *************

我注释掉下面的代码后

Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
    TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                public X509Certificate[] getAcceptedIssuers() {
                    return null;
                }

                public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    return;
                }

                public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {
                    return;
                }
            }
    };

    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

现在可以连接到https服务器了。

Answer 1

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present

这是服务器证书的问题。您需要通过添加包含正确信息的主题替代部分来修复它，以便它可以成功验证。它与信任链无关，因此无需更改 keyStore 或 trustStore 帮助。如果知道服务器 URL 或证书，可能会提供更多信息。

System.setProperty( "sun.security.ssl.allowUnsafeRenegotiation", "true" );

这是 TLS 协议(protocol)级别的事情，与证书验证无关。

如果您无法修复服务器证书，请参阅 SSLHandshakeException: No subject alternative names present寻找可能的解决方法(谷歌搜索此错误消息时首先点击!)。