无法从外部证书创建SSLContext

Question

我试图创建自己的HTTPS服务器，我有两个代码片段：

private SSLContext createSSLContext() throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException, KeyManagementException, NoSuchProviderException {
    KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(new FileInputStream("c:\\tmp\\clientkeystore.jks"), "123456".toCharArray());

    // Create key manager
    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
    keyManagerFactory.init(keyStore, "123456".toCharArray());
    KeyManager[] km = keyManagerFactory.getKeyManagers();

    // Create trust manager
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("SunX509");
    trustManagerFactory.init(keyStore);
    TrustManager[] tm = trustManagerFactory.getTrustManagers();

    // Initialize SSLContext
    SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
    sslContext.init(km, tm, null);

    return sslContext;
}

private SSLContext createSSLContext2() throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException, KeyManagementException, NoSuchProviderException {
    String path = "c:/tmp/example.crt2";
    byte[] certbytes = Files.readAllBytes(Paths.get(path));

    ByteArrayInputStream derInputStream = new ByteArrayInputStream(certbytes);
    CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(derInputStream);
    String alias = cert.getSubjectX500Principal().getName();

    KeyStore trustStore = KeyStore.getInstance("JKS");
    trustStore.load(null, "".toCharArray());
    trustStore.setCertificateEntry(alias, cert);
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
    kmf.init(trustStore, null);
    KeyManager[] keyManagers = kmf.getKeyManagers();

    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
    tmf.init(trustStore);
    TrustManager[] trustManagers = tmf.getTrustManagers();

    SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
    sslContext.init(keyManagers, trustManagers, null);
    return sslContext;
}

$curl-k-vvv https://example.org:443*重新构建URL到:https://example.org:443/*不支持名称查找超时*尝试127.0.0.1...*连接到example.org(127.0.0.1)端口443(#0)*ALPN，提供HTTP/1.1*密码选择：all：！导出：！导出40：！导出56：！anull：！low:！RC4:@strength*成功设置证书验证位置:*cafile:c://program files/git/mingw64/ssl/certs/ca-bundle.crt Capath:none*TLSV1.2(OUT)，TLS标头，证书状态(22):*TLSV1.2(OUT)，TLS标头，TLS握手，客户端您好(1):*TLSV1.2(IN)，TLS标头，未知*错误:14077410:SSL例程:SSL23_GET_SERVER_HELLO:SSLV3警报握手失败*关闭连接0 curl:(35)错误:14077410:SSL例程:SSL23_GET_SERVER_HELLO:SSLV3警报握手失败

clientkeystore.jks中的证书由以下命令行生成：

keytool -genkey ...

第二个代码片段的证书是通过OpenSSL生成的：

$ openssl version -a
OpenSSL 1.0.2e 3 Dec 2015
built on: reproducible build, date unspecified
platform: mingw64
options:  bn(64,64) rc4(16x,int) des(idx,cisc,2,long) idea(int) blowfish(idx)
compiler: gcc -I. -I.. -I../include -I/mingw64/include -D_WINDLL -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -D_MT -DDSO_WIN32 -DL_ENDIAN -O3 -Wall -DWIN32_LEAN_AND_MEAN -DUNICODE -D_UNICODE -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
OPENSSLDIR: "/mingw64/ssl"

我做错了什么？求求你，救命！

Answer 1

在第二种情况下，没有私钥，只有证书。您需要用包含私钥条目的TrustStore初始化KeyManager。

反正你的所作所为也没道理。不能同时将同一文件用作密钥库和信任库。没有任何意义。