使用Java進(jìn)行雙向認(rèn)證的SSL鏈接及使用OpenSSL生產(chǎn)證書鏈附源程序

1、)這幾天被和證書搞得頭昏腦脹的。不過還好終于把這個搞定了。用進(jìn)行雙向身份驗證意思就是在客戶機連接服務(wù)器時，鏈接雙方都要對彼此的數(shù)字證書進(jìn)行驗證，保證這是經(jīng)過授權(quán)的才能夠連接（我們鏈接一般的時采用的是單向驗證，客戶機只驗證服務(wù)器的證書，服務(wù)器不驗證客戶機的證書。而連接網(wǎng)上銀行時使用的盾就是用來存儲進(jìn)行雙向驗證所需要的客戶端證書的）。里面內(nèi)置了一個數(shù)字證書生產(chǎn)工具：t但是這個工具只能生成自簽名的數(shù)字證書。所謂自簽名就是指證書只能保證自己是完整的，沒有經(jīng)過非法修改的。但是無法保證這個證書是屬于誰的。其實用這種自簽名的證書也是可以進(jìn)行雙向驗證的用生成的自簽名證書進(jìn)行雙向驗證請看這里，向這位仁兄致意：）

2、，但是這種驗證有一個缺點：對于每一個要鏈接的服務(wù)器，都要保存一個證書的驗證副本。而且一旦服務(wù)器更換證書，所有客戶端就需要重新部署這些副本。對于比較大型的應(yīng)用來說，這一點是不可接受的。所以就需要證書鏈進(jìn)行雙向認(rèn)證。證書鏈?zhǔn)侵笇ψC書的簽名又一個預(yù)先部署的，眾所周知的簽名方簽名完成，這樣每次需要驗證證書時只要用這個公用的簽名方的公鑰進(jìn)行驗證就可以了。比如我們使用的瀏覽器就保存了幾個常用的R每次連接到網(wǎng)站時只要這個網(wǎng)站的證書是經(jīng)過這些簽名過的。就可以通過驗證了。但是這些共用的的服務(wù)不是免費的。而且價格不菲。所以我們有必要自己生成一個的密鑰對，然后部署應(yīng)用時，只要把這個的私鑰部署在所有節(jié)點就可以完成驗證

3、了。要進(jìn)行的生成，需要（）。你也可以在找到下的版本安裝好以后就可以生成證書鏈了，我寫了一個解決這些東西：echooffsetCsetPWD_SERVER_KS=serverkssetPWD_SERVER_KEY=serverkeysetPWD_CLIENT_KS=clientkssetPWD_CLIENT_KEY=clientkeyifnotexistca.key（echoGeneratingacarootkeyfile.opensslreq-new-x509-keyoutca.key-outca.crt-config%CONFIG%）else（echoca.keyalreadyexists.

4、ifnotexistserver.keystore(echoGeneratingserversprivatekey.keytool-genkey-aliaslogon_server_private_key-validity365-keyalgRSA-keysize1024SERVER_KS%-keystoreserver.keystore-keypass%PWD_SERVER_KEY%-storepass%PWD)else(echoserver.keystorealreadyexits.)ifnotexistclient.keystore(echoGeneratingclientsprivat

5、ekey.keytool-genkey-aliasipclient_private_key-validity365-keyalgRSA-keysize1024-keystoreclient.keystore-keypass%PWD_CLIENT_KEY%-storepass%PWD_CLIENT_KS%)else(echoclient.keystorealreadyexits.)echo=Finishedkeygeneration=ifnotexistlogon_server_private_key.csr(echoGeneratingserverssingaturerequestfile.k

6、eytool-certreq-aliaslogon_server_private_key-sigalgMD5withRSA-filelogon_server_private_key.csr-keypass%PWD_SERVER_KEY%-storepass%PWD_SERVER_KS%-keystoreserver.keystore)else(echologon_server_private_key.csralreadyexits.)ifnotexistipclient_private_key.csr(echoGeneratingclientssingaturerequestfile.keyt

7、ool-certreq-aliasipclient_private_key-sigalgMD5withRSA-fileipclient_private_key.csr-keypass%PWD_CLIENT_KEY%-storepass%PWD_CLIENT_KS%-keystoreclient.keystore)else(echoipclient_private_key.csralreadyexits.ifnotexistlogon_server_private_key.crt(opensslca-inlogon_server_private_key.csr-outlogon_server_p

8、rivate_key.crt-certca.crt-keyfileca.key-notext-config%CONFIG%)else(echologon_server_private_key.crtalreadyexits.)ifnotexistipclient_private_key.crt(opensslca-inipclient_private_key.csr-outipclient_private_key.crt-certca.crt-keyfileca.key-notext-config%CONFIG%)else(echoipclient_private_key.crtalready

9、exits.)echo=Finishedcarootsignaturing=echoImportingcarootcertsintokeystore.keytool-import-v-trustcacerts-aliasca_root-fileca.crt-storepass%PWD_SERVER_KS%-keystoreserver.keystorekeytool-import-v-trustcacerts-aliasca_root-fileca.crt-storepass%PWD_CLIENT_KS%-keystoreclient.keystoreechoImportingsignatur

10、edkeys.keytool-import-v-aliaslogon_server_private_key-filelogon_server_private_key.crt-keypass%PWD_SERVER_KEY%-storepass%PWD_SERVER_KS%-keystoreserver.keystorekeytool-import-v-aliasipclient_private_key-fileipclient_private_key.crt-keypass%PWD_CLIENT_KEY%-storepass%PWD_CLIENT_KS%-keystoreclient.keyst

11、oreechoAlldone!運行這個批處理，期間需要回答一些問題，然后就可以得到一些文件其中的密鑰文件。是需要在客戶端部署的，是在服務(wù)器部署的。是然后可以用下面的代碼測試：/*Copyrights(C)2008Bearice( HYPERLINK mailto:BeariceGBeariceG)*ReleaseunderGNU/GPLVersion2.*/packagecn.bearice.ipcontroller.ccserver;importjava.io.BufferedReader;importjava.io.FileInputStream;importjava.io.InputSt

12、reamReader;importjava.io.PrintWriter;importjava.security.KeyStore;importjava.security.cert.X509Certificate;importjava.util.logging.Level;importjava.util.logging.Logger;.ssl.KeyManagerFactory;.ssl.SSLContext;.ssl.SSLPeerUnverifiedException;.ssl.SSLServerSocket;.ssl.SSLServerSocketFactory;.ssl.SSLSess

13、ion;.ssl.SSLSocket;.ssl.SSLSocketFactory;.ssl.TrustManagerFactory;/*authorBearice*/publicclassNewClassextendsThreadOverridepublicvoidrun()trysleep(100);SSLContextctx=SSLContext.getInstance(SSL);KeyManagerFactorykmf=KeyManagerFactory.getInstance(SunX509);TrustManagerFactorytmf=TrustManagerFactory.get

14、Instance(SunX509);KeyStoreks=KeyStore.getInstance(JKS);/KeyStoretks=KeyStore.getInstance(JKS);ks.load(newFileInputStream(e:/certs/client.keystore),clientks.toCharArray();/tks.load(newFileInputStream(e:/certs/tclient.keystore),clientks.toCharArray();kmf.init(ks,clientkey.toCharArray();tmf.init(ks);ct

15、x.init(kmf.getKeyManagers(),tmf.getTrustManagers(),null);SSLSocketFactoryfactory=ctx.getSocketFactory();SSLSocketsocket=(SSLSocket)factory.createSocket(,4433);showCerts(socket.getSession();PrintWriterpw=newPrintWriter(socket.getOutputStream();pw.println(GET/index.htmlHTTP/1.0);pw.println(Server:);pw

16、.println(Connection:close);pw.println();pw.flush();BufferedReaderin=newBufferedReader(newInputStreamReader(socket.getInputStream();Stringln;while(ln=in.readLine()!=null)System.err.println(ln);catch(Exceptionex)Logger.getLogger(NewClass.class.getName().log(Level.SEVERE,null,ex);publicstaticvoidshowCe

17、rts(SSLSessionsession)X509Certificatecert=null;trycert=(X509Certificate)session.getPeerCertificates()0;catch(SSLPeerUnverifiedExceptione)e.printStackTrace();System.err.println(session.getPeerHost()+didnotpresentavalidcertificate);/System.exit(1);return;System.out.println(session.getPeerHost()+haspre

18、sentedacertificatebelongingto+cert.getSubjectDN()+n+Thecertificatewasissuedby:t+cert.getIssuerDN()+publicstaticvoidmain(Stringargs)throwsExceptionSSLContextctx=SSLContext.getInstance(SSL);KeyManagerFactorykmf=KeyManagerFactory.getInstance(SunX509);TrustManagerFactorytmf=TrustManagerFactory.getInstan

19、ce(SunX509);KeyStoreks=KeyStore.getInstance(JKS);/KeyStoretks=KeyStore.getInstance(JKS);ks.load(newFileInputStream(e:/certs/server.keystore),serverks.toCharArray();/tks.load(newFileInputStream(e:/certs/tserver.keystore),serverks.toCharArray();kmf.init(ks,serverkey.toCharArray();tmf.init(ks);ctx.init

20、(kmf.getKeyManagers(),tmf.getTrustManagers(),null);SSLServerSocketFactoryfactory=ctx.getServerSocketFactory();SSLServerSocketserverSocket=(SSLServerSocket)factory.createServerSocket(4433);serverSocket.setNeedClientAuth(true);newNewClass().start();SSLSocketsocket=(SSLSocket)serverSocket.accept();trysocket.startHandshake();catch(Ex