SSL客户端身份验证-即使我的客户端证书与“证书颁发机构”中的列表匹配，也找不到合适的证书

Question

这个问题似乎是警告的重复：找不到合适的证书-在没有客户端身份验证的情况下继续，但我遇到了类似的问题，即使客户端证书是由CertificateRequest消息中提到的签名者签名的。

我只是想知道对客户端和服务器（tomcat）使用自签名证书（CA不信任）是否是对客户端身份验证的限制？

我正在尝试通过一个不受任何CA信任的自签名证书（使用keytool创建）使用客户端身份验证与HTTPS服务器建立连接。

我已经为keystore和truststore设置了属性（还启用了“debug”all）

System.setProperty("javax.net.debug", "all");
System.setProperty("jdk.tls.client.protocols", "TLSv1.2");
System.setProperty("https.protocols", "TLSv1.2");
System.setProperty("javax.net.ssl.trustStore", 
"C:\\Users\\rmohanda\\Certificates\\composerClient.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("javax.net.ssl.keyStore",  
"C:\\Users\\rmohanda\\Certificates\\composerClient.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "changeit");`

在运行时，我面临SSL握手异常，如下所示：

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown 
     Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at InstallCert_ORG.main(InstallCert_ORG.java:102)

客户端密钥库：

  Loading Client KeyStore- C:\Users\rmohanda\Certificates\composerClient.jks    
  adding as trusted cert:
  Subject: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
  L="Chennai ", ST=TN, C=IN
  Issuer:  CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
  L="Chennai ", ST=TN, C=IN
  Algorithm: RSA; Serial number: 0x286e9e35
  Valid from Mon May 28 23:25:50 IST 2018 until Sat May 27 23:25:50 IST 2023

调试日志：

 *** CertificateRequest
 Cert Types: RSA, DSS, ECDSA
 Supported Signature Algorithms: SHA512withRSA, Unknown (hash:0x6, 
 signature:0x2), SHA512withECDSA, SHA384withRSA, Unknown (hash:0x5, 
 signature:0x2), SHA384withECDSA, SHA256withRSA, SHA256withDSA, 
 SHA256withECDSA, Unknown (hash:0x3, signature:0x1), Unknown (hash:0x3, 
 signature:0x2), Unknown (hash:0x3, signature:0x3), SHA1withRSA, 
 SHA1withDSA, SHA1withECDSA
 Cert Authorities:
 <CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, L="Chennai ", 
 ST=TN, C=IN>
 [read] MD5 and SHA1 hashes:  len = 171
 0000: 0D 00 00 A7 03 01 02 40   00 1E 06 01 06 02 06 03  .......@........
 0010: 05 01 05 02 05 03 04 01   04 02 04 03 03 01 03 02  ................
 0020: 03 03 02 01 02 02 02 03   00 81 00 7F 30 7D 31 0B  ............0.1.
 0030: 30 09 06 03 55 04 06 13   02 49 4E 31 0B 30 09 06  0...U....IN1.0..
 0040: 03 55 04 08 13 02 54 4E   31 11 30 0F 06 03 55 04  .U....TN1.0...U.
 0050: 07 13 08 43 68 65 6E 6E   61 69 20 31 19 30 17 06  ...Chennai 1.0..
 0060: 03 55 04 0A 13 10 47 65   6E 65 73 79 73 20 43 6F  .U....Genesys Co
 0070: 6D 70 6F 73 65 72 31 19   30 17 06 03 55 04 0B 13  mposer1.0...U...
 0080: 10 47 65 6E 65 73 79 73   20 43 6F 6D 70 6F 73 65  .Genesys Compose
 0090: 72 31 18 30 16 06 03 55   04 03 13 0F 43 6F 6D 70  r1.0...U....Comp
 00A0: 6F 73 65 72 20 43 6C 69   65 6E 74                 oser Client
 *** ServerHelloDone
 [read] MD5 and SHA1 hashes:  len = 4
 0000: 0E 00 00 00                                        ....
 Warning: no suitable certificate found - continuing without client 
 authentication
*** Certificate chain
<Empty>
***
*** ECDHClientKeyExchange
ECDH Public value:  { 4, 146, 75, 216, 252, 78, 7, 218, 254, 136, 127, 199, 
207, 80, 170, 251, 9, 188, 39, 206, 22, 74, 23, 63, 4, 39, 217, 73, 89, 143, 
4, 0, 116, 9, 234, 67, 240, 44, 91, 209, 165, 85, 22, 207, 75, 74, 86, 154, 
8, 239, 168, 138, 216, 35, 7, 56, 183, 7, 104, 139, 170, 104, 39, 229, 156 }
[write] MD5 and SHA1 hashes:  len = 77
0000: 0B 00 00 03 00 00 00 10   00 00 42 41 04 92 4B D8  ..........BA..K.
0010: FC 4E 07 DA FE 88 7F C7   CF 50 AA FB 09 BC 27 CE  .N.......P....'.

尽管证书请求中的证书颁发机构与客户机密钥库标题下的客户机证书匹配，但我仍然收到handshare异常

Cert Authorities:
 <CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, L="Chennai ", 
 ST=TN, C=IN>

证书警告并最终中止，出现异常：

 Warning: no suitable certificate found - continuing without client 
 authentication
*** Certificate chain
<Empty>
***

注意：我没有通过CA签署客户端和服务器证书。出于测试目的，我只是使用任何证书颁发机构都不信任的自签名证书。

更新：

命令：keytool-v-list-keystorecomposeclient。jks公司

C:\Users\users\XXX>keytool -v -list -keystore composerClient.jks
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: composerclient
Creation date: 28 May, 2018
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
L="Chennai ", ST=TN, C=IN
Issuer: CN=Composer Client, OU=Genesys Composer, O=Genesys Composer, 
L="Chennai ", ST=TN, C=IN
Serial number: 286e9e35
Valid from: Mon May 28 23:25:50 IST 2018 until: Sat May 27 23:25:50 IST 2023
Certificate fingerprints:
         MD5:  88:69:29:39:6D:46:F9:C2:27:8B:2B:C5:C7:F2:90:EE
         SHA1: 3D:7A:39:C4:0C:C1:15:07:94:2B:D2:AE:05:E0:C8:77:D5:13:C1:8D
         SHA256: 
 CB:8D:CD:95:15:35:6C:90:16:DB:35:4B:95:30:
 DE:7B:F8:CC:01:F8:8C:64:A5:F4:AE:F6:93:DB:4E:DE:A4:72
         Signature algorithm name: SHA256withRSA
         Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 CA AF 09 CF DE E6 F4   89 92 DF CC 8A 34 69 38  .............4i8
0010: 6F CB 4A E0                                        o.J.
]
]



*******************************************
*******************************************


Alias name: tomcat
Creation date: 4 Jun, 2018
Entry type: trustedCertEntry

Owner: CN=Tomcat SSLServer, OU=Genesys Tomcat, O=Genesys Tomcat, L=Daly 
City, ST=California, C=US
Issuer: CN=Tomcat SSLServer, OU=Genesys Tomcat, O=Genesys Tomcat, L=Daly 
City, ST=California, C=US
Serial number: 7c49521
Valid from: Mon May 28 23:20:46 IST 2018 until: Sat May 27 23:20:46 IST 2023
Certificate fingerprints:
         MD5:  B9:68:14:FB:95:F5:E6:22:A9:07:32:AD:DA:7A:D6:DD
         SHA1: 75:05:3E:5D:20:32:57:34:D3:67:29:33:B9:30:DB:8F:07:FB:8E:9D
         SHA256: 
 A4:D6:AC:38:AD:47:78:D9:C0:0D:AD:CB:B3:27:3F:99:45:
 1A:73:C0:87:B6:0A:44:04:C3:FD:16:C7:98:9C:06
        Signature algorithm name: SHA256withRSA
        Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 90 B1 89 D6 D2 EC 71 87   FD 46 09 B4 A0 BC A7 98  ......q..F......
0010: D7 C5 5C AD                                        ..\.
]
]



*******************************************
*******************************************

Answer 1

对于后人来说，此错误的一个可能原因是如果您使用的超文本传输协议客户端不同于标准java客户端（例如Apache HttpClient、REST保证）。这些客户端必须单独配置，而不仅仅是继承通过java.net.ssl属性设置的密钥库/信任库值。

下面是一个为Apache的HttpClient设置密钥库的示例（根据此答案改编）。

try (InputStream inStream = this.class.getResourceAsStream(KEYSTORE))
{
    KeyStore ks = KeyStore.getInstance(KEYSTORE_TYPE);
    ks.load(inStream, KEYSTORE_PASSWORD.toCharArray());

    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    keyManagerFactory.init(ks, KEYSTORE_PASSWORD.toCharArray());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
    return HttpClients.custom().setSSLContext(sslContext).build();
}