在 Java 中以编程方式添加可信证书
我使用 SSL 在两个用 Java 编写的组件之间进行通信。我无法使用 CA，所以我必须对所有内容进行自签名。不幸的是，这意味着当我尝试握手时，我收到 SunCertPathBuilderException。我可以创建自己的 X509TrustManager，它只信任一切，但这违背了拥有签名证书的目的。
我想在第一次建立连接时提示用户“证书无效的 SSL 握手。将证书添加到存储吗？”或者其他东西，以便他们可以将其添加到他们的证书存储中，就像网络浏览器在具有无效证书的网站上所做的那样。我可以在网上找到很多通过命令行向商店添加证书的示例，但我不知道如何以编程方式执行此操作。有办法做到这一点吗？
I use SSL to communicate between two components written in Java. I can't use a CA, so I have to self-sign everything. Unfortunately, this means that when I try to handshake, I get a SunCertPathBuilderException. I can create my own X509TrustManager that just trusts everything, but that sort of defeats the purpose of having a signed cert.
I would like, when first making the connection, to prompt the user with "SSL handshake with invalid cert. Add cert to store?" or something so they could have it added for them to their certificate store, like web browsers do at sites with invalid certs. I can find plenty of examples online of adding a cert to the store through the commandline, but I can't figure out how to do it programmatically. Is there a way to do this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，这是可能的。
这里有一些代码我以前用过。我必须修改它才能做到我想要的，我怀疑你也会这样做，但这应该会让你接近 - 你不会尝试导入密钥，所以理论上你应该能够简化事情。无论如何，您都可以了解自己需要什么。
java.security.KeyStore 也非常有用。
Yes it is possible.
There is some code here that I've used before. I had to modify it to do what I wanted and I suspect that you will too but this should get you close - you aren't trying to import a key so theoretically you should be able to simplify things. In any case you can get an idea of what you'll need.
The JDK JavaDoc for java.security.KeyStore is pretty useful too.
为什么不创建自己的 CA 并用它签署您的证书呢？然后，您需要做的就是在计算机上安装 CA 自己的证书，并且该 CA 签名的每个证书都会得到验证。
Why don't you create your own CA and sign your certificates with that? Then all you would need to do is install the CA own certificate on the machines and every certificate signed by that CA would validate.
为什么您需要这样做，您没有验证客户端是否是他们所说的人，您只是使用证书来加密通信，因此您只需要一个允许所有证书的自定义信任管理器。
您所要求的是可能的，并且从记忆中还涉及自定义信任管理器来验证证书并将其存储在密钥库中。我不记得细节了，但至少你知道这是可以做到的。
Why would you need to do this, you are not validating that the client is who they say they are you are only using the certs to encrypt the comms, so a custom trust manager that allows all certs is all you need.
What you are asking is possible and from memory also involves a custom trust manager to validate the certificates and store them in the keystore. I can't remember the details, but at least you know it is possible to do it.