SSL HandShakeException：No_Certificate。使用 IBM 的 J9 JVM 和 Apache Tomcat
我正在开发一个在 Windows Mobile PDA 上运行的移动应用程序。该应用程序是用 Java 编写的，为了运行它，我们使用 IBM 的 J9 JVM。该应用程序通过 HTTP 与 Apache Tomcat 服务器进行通信，我们现在尝试将其设置为使用 SSL。
我已经为客户端和服务器生成了公钥/私钥，导出了它们的自签名证书并将它们导入到各自的密钥库中。最初，我尝试仅使用服务器端身份验证使其正常工作，并且成功了。但我现在尝试通过在 apache conf 目录中的 server.xml 文件中设置 clientAuth="true" 来获得相互身份验证。
我已在服务器上启用了 SSL 日志记录，当客户端连接服务器时，会报告 SSLProtocolException：握手警报：no_certificate。客户端日志还显示异常：
javax.net.ssl.SSLHandshakeException: unexpected_message
at com.ibm.j9.jsse.SSLSocketImpl.completeHandshake(Unknown Source)
at com.ibm.j9.jsse.SSLSocketImpl.startHandshake(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.openSocket(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.connect(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.sendRequest(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.doRequest(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.getInputStream(Unknown Source)
客户端密钥库和信任库是通过设置以下系统属性来配置的：
javax.net.ssl.trustStore
javax.net.ssl.trustStorePassword
javax.net.ssl.keyStore
javax.net.ssl.keyStorePassword
有谁知道如何在 J9 JVM 上设置客户端身份验证？
I am developing a mobile application that is to run on a Windows Mobile PDA. The application is written in Java and to run it we are using the J9 JVM from IBM. The application communicates with an Apache Tomcat server over HTTP and we are trying to set it up now to use SSL.
I have generated public/private keys for both the client and the server, exported their self signed certificates and imported them into the respective keystores. Initially I tried to just get it working using only server side authentication and that was successful. But I am now trying to get mutual authentication by setting clientAuth="true" in the server.xml file in the apache conf directory.
I have enabled the SSL logging on the server and when the client connects the server reports an SSLProtocolException: handshake alert: no_certificate. The client logs also show an exception:
javax.net.ssl.SSLHandshakeException: unexpected_message
at com.ibm.j9.jsse.SSLSocketImpl.completeHandshake(Unknown Source)
at com.ibm.j9.jsse.SSLSocketImpl.startHandshake(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.openSocket(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.connect(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.sendRequest(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.doRequest(Unknown Source)
at com.ibm.oti.net.www.protocol.https.HttpsURLConnection.getInputStream(Unknown Source)
The client keystore and truststore is configured by setting the following System Properties:
javax.net.ssl.trustStore
javax.net.ssl.trustStorePassword
javax.net.ssl.keyStore
javax.net.ssl.keyStorePassword
Does anyone have any ideas how I can set up client authentication on the J9 JVM?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
所以我得出的最终答案是切换到不同的 JVM。 IBM 提供的支持非常少，仅仅试图让某人向我们出售他们的 JVM 许可证就被证明是非常困难的。我猜他们只喜欢与大型组织打交道。
现在使用 Skelmir 的 CEE-J，到目前为止它更有前途。
So the ultimate answer I came to was to switch to a different JVM. Very little support available from IBM and just trying to get someone to sell us licences for their JVM was proving very difficult. I guess they only like to deal with huge organisations.
Now using CEE-J from Skelmir and so far it is a lot more promising.
基本上，客户端不会发送证书。
服务器无法对客户端进行身份验证：有时它没有收到证书，或者不是相同的 CA_ROOT 等，并且无法设置响应。通过消息“no_certificate”很容易想象客户端没有发送任何内容。
检查您的文件（您的路径）或标签：您应该使用 truststoreFile 而不是“trustStore”，而应使用 truststorePass 而不是“trustStorePassword”
Basically, the client is not sending the certificate.
The server cannot authenticate the client: sometimes it does not receive the certificate, or is not the same CA_ROOT, etc and is not able to set the response. By the message 'no_certificate' is easy to imagine that the client is not sending anything.
Check your files (your paths) or your tags: instead of 'trustStore', you should use truststoreFile, and instead of 'trustStorePassword', use truststorePass