java - 谷歌地理编码 SSL 握手异常

Question

我的 java 信任库有问题。如果有人可以帮助我解决这个问题，我将不胜感激。我已经使用 Spring-Boot 构建了一个用于地理编码的微服务，我想在其中使用 Google Geocoding API。不幸的是，我收到了 SSL 握手异常，尽管我已经通过 Open SSL 下载了 Google Authority G3 证书，将其导入到新的信任库文件中，并将此信任库文件包含到我的代码中。

编辑:这是我收到的准确错误消息:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested targe

这是我的代码:

我的应用程序属性中的信任库条目:

server.ssl.trust-store=src\\main\\java\\de\\projectname\\microservicename\\geographical\\files\\newTrustStore

server.ssl.trust-store-password=changeit

编辑2:

这是我用来在我的信任库中导入 Google 证书并将其保存在我的微服务目录中的 keytool 命令(出于数据安全原因，几个目录已重命名):

keytool -importcert C:\Users\jdoe\IdeaProjects\microservice\src\main\java\de\projectname\microservicename\geographical\files\googleapicert -keystore C:\Users\jdoe\IdeaProjects\microservice\src\main\java\de\projectname\projecttitle\geographical\files\truststore.jks -alias "jdoe"

编辑 3:

这是我的信任库的样子:

Keystore enthält 1 Eintrag

Aliasname: mykey
Erstellungsdatum: 31.07.2018
Eintragstyp: trustedCertEntry

Eigentümer: CN=*.googleapis.com, O=Google LLC, L=Mountain View, ST=California, C=US
Aussteller: CN=Google Internet Authority G3, O=Google Trust Services, C=US
Seriennummer: 78b8f1fdffefda73
Gültig von: Tue Jun 19 13:38:18 CEST 2018 bis: Tue Aug 28 13:31:00 CEST 2018
Zertifikatsfingerprints:
     SHA1: 0A:AA:3A:7D:F6:4D:56:32:0A:50:95:B5:60:D7:EA:46:A4:92:5A:A2
     SHA256: E8:E6:8E:47:F5:16:57:7A:C8:3E:8D:7E:6A:F2:3C:FB:CF:16:60:EF:38:FA:59:A4:0D:6E:22:16:21:0C:92:4E
Signaturalgorithmusname: SHA256withRSA
Public Key-Algorithmus von Subject: 2048-Bit-RSA-Schlüssel
Version: 3

Erweiterungen:

#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
[accessMethod: caIssuers
 accessLocation: URIName: http://pki.goog/gsr2/GTSGIAG3.crt
  , accessMethod: ocsp
  accessLocation: URIName: http://ocsp.pki.goog/GTSGIAG3
]]

#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 77 C2 B8 50 9A 67 76 76   B1 2D C2 86 D0 83 A0 7E  w..P.gvv.-......
0010: A6 7E BA 4B                                        ...K
]]

#3: ObjectId: 2.5.29.19 Criticality=true
 BasicConstraints:[
 CA:false
 PathLen: undefined
]

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
[DistributionPoint:
 [URIName: http://crl.pki.goog/GTSGIAG3.crl]
]]

#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
[CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.3]
[]  ]
[CertificatePolicyId: [2.23.140.1.2.2]
[]  ]]

#6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
serverAuth
]

#7: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
DNSName: *.googleapis.com
DNSName: *.clients6.google.com
DNSName: *.cloudendpointsapis.com
DNSName: cloudendpointsapis.com
DNSName: googleapis.com
]

#8: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: F9 74 1D 45 80 81 1C C1   17 A9 01 C4 A0 66 A0 7C  .t.E.........f..
0010: 91 A1 62 D5                                        ..b.
]]



*******************************************
*******************************************

我的地理编码类:

public class Geocoding {
@Value("${google.geocoding.api}")
private String googleAPIKey;

@Value("${google.geocoding.url}")
private String url;

final static Logger logger = Logger.getLogger(Geocoding.class);

private GeoApiContext context = new GeoApiContext.Builder()
        .apiKey(googleAPIKey)
        .build();

@ApiModelProperty
private String langauge;

private Gson gson = new GsonBuilder().setPrettyPrinting().create();

public Geocoding() {
}

public Geocoding(String googleAPIKey, String url) {
    this.googleAPIKey = googleAPIKey;
    this.url = url;
    this.context = new GeoApiContext.Builder().apiKey(googleAPIKey).build();
}

public String getLangauge() {
    return langauge;
}

public void setLangauge(String langauge) {
    if (langauge.length() > 1) {
        IllegalArgumentException ex = new IllegalArgumentException("illegal representation of a language code");
        throw ex;
    }
    this.langauge = langauge;
}

public String generateOutput(String request) {
    String output = url;
    request = request.replaceAll("\\s+", "+");
    List<String> deserializedString = Arrays.asList(request.split("\\s*,\\s*"));
    output = output.concat(deserializedString.get(0))
            .concat(",").concat(deserializedString.get(1)).concat(",")
            .concat(deserializedString.get(2)).concat("&key=").concat(googleAPIKey);
    return output;
}

public Address geoCodingResult(String address) throws Exception {

        GeocodingResult[] results = GeocodingApi.geocode(context, address).await(); //The application throws an SSL handshake exception right here

    }
}

这些是我在 Gradle 中包含的用于地理编码的依赖项:

//Google Geocoding
compile 'com.google.maps:google-maps-services:0.2.8'
compile 'org.slf4j:slf4j-nop:1.7.25'
compile 'com.squareup.okhttp3:okhttp:3.10.0'

我已经多次检查了 Google API key 和地理编码网址，它们似乎都是正确的，所以我排除了这就是问题所在。我还使用 keytools 查看了“newTrustStore”文件，它实际上包含 Google Authority G3 证书。

非常感谢您的帮助!

Answer 1

我在 OpenJDK 10 上使用 com.google.maps:google-maps-services 时遇到了同样的问题，出于某种原因它不信任 Google Internet Authority G3。

要解决此问题，最好使用 keytool 将丢失的证书导入系统范围的 keystore (通常位于 $JAVA_HOME/lib/security/cacerts 中):

wget http://pki.goog/gsr2/GTSGIAG3.crtkeytool -import -alias GTSGIAG3 -file GTSGIAG3.crt -keystore $JAVA_HOME/lib/security/cacerts

然后在出现提示时输入密码(默认为 changeit)。

如果您使用的是 Docker，则可以使用以下命令导入丢失的证书:

FROM openjdk:10-jre-slimRUN apt-get -qqy update \    && apt-get -qqy --no-install-recommends install wget \    && wget http://pki.goog/gsr2/GTSGIAG3.crt \    && yes | keytool -import -alias GTSGIAG3 -file GTSGIAG3.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass 'changeit' \    && rm GTSGIAG3.crt \    && apt-get -qqy purge wget \    && rm -rf /var/lib/apt/lists/* /var/cache/apt/*