JAVA中如何使用证书调用服务器API

Question

我必须使用证书调用服务器API，所以我已经将cerhtml" target="_blank">文件导入到密钥库中并完成编码，但仍然得到了javax.net.ssl.SSLHandShakeException：Sun.Security.Validator.ValidatoreXception：PKIX路径构建失败：Sun.Security.Provider.CertPath.SunCertPathBuilderException：找不到请求目标的有效证书路径

用于将cer文件导入密钥存储库的命令。keytool-importcert-file d:\kalaivani_all\kalaivani\new_emandate_apgb\servertoservecert\onmagcert.cer-keystore d:\kalaivani_all\kalaivani\new_emandate_apgb\servertoservecert\server_npcikeystore.jks-别名“cedge1”

    appPathCertificate="D:/KALAIVANI_ALL/kalaivani/NEW_EMANDATE_APGB/servertoservecert/server_npcikeystore.jks";
                 
                  System.out.println("appPathCertificate--->"+appPathCertificate);
                  char[] passphrase = "cedge1".toCharArray(); //password
                  KeyStore keystore = KeyStore.getInstance("JKS");
                  keystore.load(new FileInputStream(appPathCertificate), passphrase); //path
 TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                  tmf.init(keystore);


                  SSLContext context = SSLContext.getInstance("TLS");
                  TrustManager[] trustManagers = tmf.getTrustManagers();
                  context.init(null, trustManagers, null);
                  SSLSocketFactory sf = context.getSocketFactory();
                  
             URL url = new URL(common_utility.getEmandateServerResponeURL());
            System.setProperty("javax.net.ssl.keyStore", appPathCertificate);
System.setProperty("javax.net.ssl.keyStorePassword", "cedge1");
System.setProperty("javax.net.ssl.keyStoreType", "JKS");   
                
                String proxyhost=common_utility.getProxyHost();
                String proxyport=common_utility.getProxyPort();
                Proxy proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress(proxyhost, new Integer(proxyport)));
                HttpsURLConnection  conn = (HttpsURLConnection ) url.openConnection(proxy);
                conn.setSSLSocketFactory(sf);
                
                conn.setDoInput(true);
                conn.setDoOutput(true);
                conn.setRequestMethod("POST");
                conn.setUseCaches (false);
                System.out.println("GETISSUE Request : "+str_jsonparams);
                OutputStream os = conn.getOutputStream();
                os.write(str_jsonparams.getBytes());
                os.flush();
                 System.out.println("Response code :"+conn.getResponseCode());

Answer 1

您将面临在SSL握手过程中验证服务器响应的问题。您需要在信任存储中添加中间件和根证书。这些证书将用于验证服务器标识。例如，在建立连接时，您将收到stackexchange服务器证书。然后，为了验证标识，您必须在信任存储中具有R3 CERT（中间CA）和DST根CA X3（根CA）。

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(keystore);

context.init(null, trustManagers, null);

在您的示例中，当您使用keystore初始化trustmanagerFactory时，您必须将intermediates和root证书放在密钥库中。这里将不使用JDK存储cacerts。