受信任的证书失效
在 Sun Glassfish 服务器中，我部署了一个通过 SSL 与外部 Web 服务通信的应用程序。
我已使用 java keytool cli (keytool -import -trustcacerts -keystore cacerts.jks -alias somealias -file somecert.cer) 在 cacerts.jks 中手动导入证书。
我验证一切正常，但过了一段时间后，事情停止工作，我在日志中得到以下输出：
[#|2010-06-18T09:13:23.930+0200|警告|sun-appserver9.1|...|_ThreadID=850;_ThreadName=p: 线程池-1; w: 901;javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: 来自服务器的证书链不受信任|...|#]
从这里服务停止工作。根据日志，在异常发生前不久，证书受到质疑，服务器默认回复“否”，我怀疑这就是产生错误的原因。
但是什么触发服务器突然质疑证书呢？证书已导入并在密钥库中标记为受信任。所有日期都可以。我错过了什么吗？
In a Sun Glassfish server I have deployed an application that communicates with an external webservice over SSL.
I have manually imported certificates in cacerts.jks with java keytool cli (keytool -import -trustcacerts -keystore cacerts.jks -alias somealias -file somecert.cer).
I verify that everything works, but then after a longer while things stop to work and I get the following output in log:
[#|2010-06-18T09:13:23.930+0200|WARNING|sun-appserver9.1|...|_ThreadID=850;_ThreadName=p: thread-pool-1; w: 901;javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: The certificate chain from the server is not trusted|...|#]
And from here the service stops working. According to the log, shortly before the exception occurs, the certificate is questioned and the server by default replies no and I suspect this is what generates the error.
But what trigger the server to suddenly question the certificate? Certificate is already imported and marked as trusted in the keystore. All dates are ok. Have I missed something?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
也许还有其他一些应用程序正在更改系统属性 (
javax.net.ssl.trustStore)。javax.net.ssl.trustStore是指向可信密钥库的内容。尝试打印此系统属性以查看它是否发生变化。另一种选择是使用以下选项启动 JVM
-Djavax.net.debug=SSL、握手、数据、trustmanager这应该会在 stdout 日志文件中提供一些详细的输出。
Perhaps there is some other application which is changing the System property (
javax.net.ssl.trustStore).javax.net.ssl.trustStoreis what is pointing to the trusted keystore. Try printing out this System property to see if it changes.Another option is to start the JVM with the following option
-Djavax.net.debug=SSL,handshake,data,trustmanagerThis should give you some verbose output in your stdout log file.