java - 如何在java中解码从apache发送的PEM编码的SSL_CLIENT_CERT header 值

Question

我通过 SSL_CLIENT_CERT 变量在 HTTP header 中发送 PEM 编码的客户端证书，从 apache2 到 jboss5，在我的应用程序中，我正在读取此 header 的值，并尝试在 java 中对其进行解码，但我得到了一个不受支持的信息编码异常

java.security.cert.CertificateException: Could not parse certificate: java.io.IOException: Unsupported encoding
    at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:109)

我的 Apache 配置:

<VirtualHost *:443>

ServerName a.localhost
ProxyPass / http://b.localhost:8080/
ProxyPassReverse / http://b.localhost:8080/

SSLEngine on
SSLProxyEngine on
SSLProtocol all -SSLv2
SSLOptions +ExportCertData +StdEnvVars
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

SSLVerifyClient optional
SSLVerifyDepth 1
SSLCertificateFile C:\Users\user\ssh\4pm.si_wildcard.crt
SSLCertificateKeyFile C:\Users\user\ssh\4pm.si_wildcard.key
SSLCACertificateFile C:\Users\user\ssh\ca_cert_bundle.crt
RequestHeader set X-ClientCert %{SSL_CLIENT_CERT}s

ErrorLog "C:/Apps/wamp/logs/4pm-error-ssl.log"
CustomLog "C:/Apps/wamp/logs/4pm-access-ssl.log" common


</VirtualHost>

我的java代码:

 String certStr = certStr = JSFUtil.getRequest().getHeader("x-clientcert");

 try {
        Certificate cert = CertificateFactory.getInstance("X.509").generateCertificate(new ByteArrayInputStream(certStr.getBytes("UTF-8")));
    } catch (CertificateException e1) {
        // TODO Auto-generated catch block
        e1.printStackTrace();
    } catch (UnsupportedEncodingException e1) {
        // TODO Auto-generated catch block
                e1.printStackTrace();
            }

Tnx 向 owlstead 寻求提示，这促使我找到了解决方案。

这个问题的解决办法是:

您需要这些导入:

import java.io.ByteArrayInputStream;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import javax.servlet.http.HttpServletRequest;
import org.jboss.util.Base64;

public static X509Certificate parseCertificate(String _headerName, HttpServletRequest _request) throws CertificateException{

    String certStr = _request.getHeader("x-clientcert");
    //before decoding we need to get rid off the prefix and suffix
    byte [] decoded = Base64.decode(certStr.replaceAll("-----BEGIN CERTIFICATE-----", "").replaceAll("-----END CERTIFICATE-----", ""));

    return (X509Certificate)CertificateFactory.getInstance("X.509").generateCertificate(new ByteArrayInputStream(decoded));
}

Answer 1

PEM 是带有页眉和页脚行的 Base 64 编码。您不能仅使用 UTF-8 对文本执行字符编码。您需要decode the PEM itself .