基于Java证书的身份验证
我有一个 Thrift 端点，是由不再在我们公司工作的人创建的。他们通过客户端证书实现了身份验证，但我很难理解它是如何工作的。有谁知道有关此主题的教程或方法。
我真正拥有的只是一个示例客户类。以下是我需要帮助的事项列表：
- 服务器证书和客户端证书是否可以包含在同一个信任存储中
- 如何创建新的客户端证书？
- 如何将该客户端证书添加到服务器信任存储区？
- 是否需要设置客户端信任存储，并设置java信任（假设服务器是自签名端点）
以下错误是什么意思？
错误[com.cada.CadaDaoTest][main] - 错误： org.apache.thrift.transport.TTransportException: javax.net.ssl.SSLHandshakeException: 收到致命警报: bad_certificate
I have a thrift endpoint that someone created who is not longer with our company. They implemented the authentication via client side certs, but I having a hard time wrapping my head around how it all works. Does anyone know of a tutorial, or howto on this topic.
All I really have is a sample client class. Here are a list of things that I need help with:
- Can a server cert and the client cert both be contained in the same trust store
- How do you create a new client side cert?
- How do you add that client side cert to the server trust store?
- Do you need to set the client trust store, and set the java trust (assuming the server is a self signed endpoint)
What does the following error mean?
ERROR[com.cada.CadaDaoTest][main] - Error:
org.apache.thrift.transport.TTransportException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
信任库（在 Tomcat 上，它是在 server.xml 中为 SSL 连接器配置的）可以保存客户端证书的证书链的根，而不是证书本身。也就是说，当创建证书时，它由 CA（证书颁发机构）签名。如果 CA 证书可信，则该 CA 签署的所有证书也都可信。
您可以使用 keytool（在
jdk/bin/中）或 openssl 创建证书。有一些 GUI 可以实现此目的，例如 portecle。tomcat ssl 教程可能会有所帮助。
The truststore (on Tomcat it's configured forthe SSL connector in server.xml) can hold the root of the certificate chain of the client certificate, not the certificate itself. That is, when a certificate is created, it is signed by a CA - certificate authority. If the CA cert is trusted, all certs singed by the CA are trusted as well.
You can create certificates using either keytool (in
jdk/bin/) or openssl. There are GUIs for that, like portecle.The tomcat ssl tutorial might be helpful.