使用 JSSE (Javase6) 和自签名证书设置 SSL 连接

发布于 2024-09-08 19:50:57 字数 1454 浏览 10 评论 0原文

我正在尝试构建一个简单的客户端/服务器系统，它使用 SSLSocket 来交换数据。 (JavaSE 6) 服务器必须有自己的证书，客户端不需要。

我从这个开始 http://java.sun. com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore 为服务器生成密钥和自签名证书。总结一下：

    Create a new keystore and self-signed certificate with corresponding public/private keys. 
keytool -genkeypair -alias mytest -keyalg RSA -validity 7 -keystore /scratch/stores/server.jks

    Export and examine the self-signed certificate.
keytool -export -alias mytest -keystore /scratch/stores/server.jks -rfc -file server.cer

    Import the certificate into a new truststore.
keytool -import -alias mytest -file server.cer -keystore /scratch/stores/client.jks

然后在我的服务器代码中，我

System.setProperty("javax.net.ssl.keyStore", "/scratch/stores/server.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "123456");

SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket sslServerSocket = (SSLServerSocket)sf.createServerSocket( port );

Socket s = sslServerSocket.accept();

基本上遗漏了一些点，因为我收到“javax.net.ssl.SSLException：没有可用的证书或密钥对应于启用的 SSL 密码套件”。当我尝试运行服务器时。

会不会是证书的问题？当在 keytool 中使用 -validity 时，证书会进行自签名，所以如果我没有错的话它应该可以工作。

阅读文档似乎设置属性“javax.net.ssl.keyStore”足以使 SSLContext 正确设置。有什么建议吗？

原文

I'm trying to build a simple client/server system wich uses SSLSocket to exchange data. (JavaSE 6)
The server must have its own certificate, clients don't need one.

I started with this
http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
To generate key for the server and a self signed certificate.
To sum it up:

    Create a new keystore and self-signed certificate with corresponding public/private keys. 
keytool -genkeypair -alias mytest -keyalg RSA -validity 7 -keystore /scratch/stores/server.jks

    Export and examine the self-signed certificate.
keytool -export -alias mytest -keystore /scratch/stores/server.jks -rfc -file server.cer

    Import the certificate into a new truststore.
keytool -import -alias mytest -file server.cer -keystore /scratch/stores/client.jks

Then in my server code I do

System.setProperty("javax.net.ssl.keyStore", "/scratch/stores/server.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "123456");

SSLServerSocketFactory sf = sslContext.getServerSocketFactory();
SSLServerSocket sslServerSocket = (SSLServerSocket)sf.createServerSocket( port );

Socket s = sslServerSocket.accept();

I am basically missing some point because I get a "javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled." when I try to run the server.

Can it be a problem with the certificate? When using -validity in keytool the certificate gets self-signed, so it should work if I'm not wrong.

Reading the docs seems that setting the property "javax.net.ssl.keyStore" is sufficient for the SSLContext to setup correctly. Any suggestion?

分享到QQ

分享到微博