SSL 客户端 - 什么时候需要证书？
我有这个：
SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory();
SSLSocket socket = (SSLSocket) factory.createSocket("www.verisign.com", 443);
第二行失败，出现“连接被拒绝”错误。
现在，我是否必须在我的信任存储中安装威瑞信的证书才能执行上述操作？我的印象是我可以连接到 SSL 服务器并执行 getPeerCertificates() 来获取证书。这不是我们的浏览器所做的吗？否则他们怎么知道要使用哪个签名机构？
（显然我正在使用 Verisign 作为示例。我的真实 URL 太难用了，无法在这里使用......）
I have this:
SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory();
SSLSocket socket = (SSLSocket) factory.createSocket("www.verisign.com", 443);
This is failing on the 2nd line with a "Connection refused" error.
Now, would I have to install verisign's certificate in my trust store before I can even do the above? I was under the impression that I could connect to an SSL server and execute getPeerCertificates() to get the certificates. Is this not what our browsers do? Otherwise how would they know which signing authority to use?
(Obviously I'm using Verisign as an example. My real URL is far too fugly to use here...)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
连接被拒绝意味着目标主机：端口上没有任何内容正在侦听，或者防火墙妨碍了。这在逻辑上和时间上都先于 SSL 所做的任何事情。
Connection refused means nothing was listening at the target host:port, or a firewall got in the way. This is logically and temporally prior to anything SSL does.
您是否检查过远程服务确实已启动并正在运行，并且可以连接到它？也许“连接被拒绝”错误实际上是连接被拒绝。 :-)
Have you checked that the remote service is actually up and running, and that you can connect to it? Perhaps the "Connection refused" error is actually a refused connection. :-)
通常您不需要在计算机上明确安装服务器的证书。 PKI 的工作方式是，您的系统应该能够验证服务器的证书，而无需事先了解它。然而，只有当您的服务器证书的根位于“已知 CA”（即证书颁发机构）中时，这才有效，其根证书或其他证书已在客户端系统上列出。如果情况并非如此（例如，您在服务器上有自签名证书或其他自定义证书），则您确实需要在客户端系统上安装该证书，然后上述类才能正确验证服务器证书。
您可以在此处阅读有关证书及其在 SSL 中的使用方式。
Usually you don't need to install server's certificate on your computer explicitly. PKI works in the way that your system should be able to validate server's certificate without any prior knowledge about it. However this will work only when your server's certificate has it's roots in on of the "known CAs", i.e. certificate authorities, whose root or other certificates are already listed on the client system. If this is not the case (eg. you have a self-signed or some other custom certificate on the server), you really need to install the certificate on your client system before the mentioned classes can validate server certificate properly.
You can read about certificates and how they are used in SSL here.