java - SSL 套接字连接错误

Question

我正在使用 JAVA 8。我正在尝试使用客户端证书和证书树连接套接字服务器。

我有客户提供的以下信息:

1. 客户 CERT (PEM)
2. 私钥 (PEM)
3. CA 树 (PEM) - 拥有 4 个证书

我使用以下步骤创建了 keystore.jks:

1. 使用 cat 将客户端证书和 CA 树合并到单个 pem 文件中

2. 使用私钥(OpenSSL 命令)加密的组合文件中的 Crested PKCS12 文件

3. 使用 keytool 生成 JKS keystore 文件

我使用以下步骤创建了 trustore.jks:

1. 将 CA 树(4 个证书)拆分为 4 个不同的文件
2. 通过将每个文件一一导入，使用 keytool 生成 trustore 文件

我的示例代码如下:

    package com.tutorial.exception.customize;

import javax.net.ssl.SSLHandshakeException;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;
import java.security.cert.CertPathValidatorException;
import java.security.cert.CertificateException;
import java.util.Scanner;

/**
 * Created by SomnathG on 12/1/2016.
 */
public class Client {
    public Client() {

        System.setProperty("javax.net.ssl.keyStore", {keystore Location});
        System.setProperty("javax.net.ssl.keyStorePassword", {password});
        System.setProperty("javax.net.ssl.trustStore", {trustore location});
        System.setProperty("javax.net.ssl.trustStorePassword", {password});
        System.setProperty("javax.net.debug", "all");

        System.setProperty( "sun.security.ssl.allowUnsafeRenegotiation", "true" );
    }

    public void connectHost(){
        SSLSocketFactory sslSocketFactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
        SSLSocket sslSocket = null;
        try {

            sslSocket = (SSLSocket) sslSocketFactory.createSocket(host, port);
            sslSocket.setEnabledProtocols(new String[] {"TLSv1.2"});

            sslSocket.startHandshake();

            InputStream inputStream = sslSocket.getInputStream();
            OutputStream outputStream = sslSocket.getOutputStream();
            System.out.println("Sending request to Socket Server");
            outputStream.write("Hello".getBytes());
            outputStream.write("exit".getBytes());
            byte[] messageByte = new byte[1000];
            boolean end = false;
            String dataString = "";
            int bytesRead = 0;
            String messageString = "";
            DataInputStream in = new DataInputStream(sslSocket.getInputStream());

            while(!end)
            {
                bytesRead = in.read(messageByte);
                messageString += new String(messageByte, 0, bytesRead);
                if (messageString.length() == 100)
                {
                    end = true;
                }
            }
            System.out.println("MESSAGE: " + messageString);
            // byte[] read = (byte[]) ois.readObject();
            //String s2 = new String(read);
            //System.out.println("" + s2);
            //System.out.println("Message: " + message);
            //close resources

            //System.out.println(receive(inputStream));


        }catch (IOException e) {
            e.printStackTrace();
            System.out.println("=====");
            System.out.println(e.getMessage());
            System.out.println("=====");
            CertPathValidatorException ce = new CertPathValidatorException(e);
            System.out.println("******");
            System.out.println(ce.getIndex());
            System.out.println(ce.getReason());
            System.out.println("******");
            //e.printStackTrace();
        }

    }

    public static void main(String[] args){
        new Client().connectHost();
    }
}

执行代码后出现以下异常:

    javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: basic constraints check failed: this is not a CA certificate
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
at com.tutorial.exception.customize.Client.connectHost(Client.java:33)
at com.tutorial.exception.customize.Client.main(Client.java:82)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.intellij.rt.execution.application.AppMain.main(AppMain.java:147)

分析日志后，我发现了“clientHello”和“serverHello”消息，但在该应用程序抛出上述异常之后。

我做错了什么？请指教。

谢谢，索姆纳特·古哈

Answer 1

在分析调试lo后我已经解决了这个问题。

服务器 V3 证书中缺少“BasicConstraints”，因此 java 无法将该证书识别为有效证书。添加该约束后，客户端就能够与服务器握手并能够与服务器通信。

基本限制:[ CA:真实 路径长度:2147483647]