使用 java 套接字 SSL 的客户端-服务器通信。真正需要什么证书
Client-Server communication with java socketSSL. What certificates are really necesary
您好，我正在开发一个 java 项目，该项目的客户端和服务器使用客户端身份验证设置为 true 的 SSL 套接字。我让一切正常，但我想确定每一方在他们的 jks 中应该包含什么。
客户:
1. 客户端私钥(key.pem) & public key(cert.pem).
2.中间CA public key(cert.pem).
服务器:
1.服务器私钥(key.pem) & public密钥(cert.pem).
2.中间CA public key(cert.pem).
我看了很多关于证书的书，但我真的不明白什么证书是真正需要的。
问题:
1.我读客户端应该只包含rootCA和他的证书，以及服务器所有的链和他的证书。这是正确的处理方式吗？
2. 我还读到服务器应该有两个 jks，一个带有证书，另一个带有信任链。我真的不知道每个应该包含什么。
3. 该代码仅在服务器和客户端具有javax.net.ssl.keyStore 和javax.net.ssl.trustStore 时有效。如果我删除其中一个，它们将停止工作，为什么？根据我的阅读，客户端应该只能与 trustStore 一起工作。
我知道网上有很多资料，我花了一个星期的时间阅读，但我仍然无法真正理解这一点。即使代码有效，我真的很想知道它为什么有效以及正确的方法是什么。
我从以下网站的 tutorila 创建了一个批次：https://jamielinux.com/docs/openssl-certificate-authority/。
我正在使用辅助项目来测试 ssl 套接字连接。这就是我正在使用的：
客户端 (MWE):
package com.test.ssl;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
public class Client {
private static final String IP = "127.0.0.1";
private static final int PORT = 15000;
private static DataOutputStream os;
private static DataInputStream is;
private static final byte messageEnd = 0;
public static void main(String[] args) {
System.setProperty("javax.net.ssl.keyStore", "D:\workspace\Client_Server_SSL\clientKeyStore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "CertPass");
System.setProperty("javax.net.ssl.trustStore", "D:\workspace\Client_Server_SSL\clientKeyStore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "CertPass");
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
try {
SSLSocket sslsocket = (SSLSocket) factory.createSocket(IP, PORT);
sslsocket.setNeedClientAuth(true);
is = new DataInputStream(sslsocket.getInputStream());
System.out.println("Loading output streams");
os = new DataOutputStream(sslsocket.getOutputStream());
System.out.println("Streams loaded");
os.write("Hi[=11=]".getBytes());
byte character;
List<Byte> message = new ArrayList<>();
while ((character = is.readByte()) != messageEnd) {
message.add(character);
}
byte[] messageBytes = byteListToByteArray(message);
String response = new String(messageBytes);
System.out.println("Server response: " + response);
} catch (IOException e) {
e.printStackTrace();
}
}
public static byte[] byteListToByteArray(List<Byte> bytes) {
byte[] result = new byte[bytes.size()];
for (int i = 0; i < bytes.size(); i++) {
result[i] = bytes.get(i).byteValue();
}
return result;
}
}
服务器 (MWE):
package com.test.ssl;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
public class Server {
private static boolean serverListening = true;
private static SSLServerSocket sslserversocket;
private static final int PORT = 15000;
private static DataInputStream is;
private static DataOutputStream os;
public static void main(String[] args) {
System.setProperty("javax.net.ssl.keyStore", "D:\workspace\Client_Server_SSL\serverKeyStore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "CertPass");
System.setProperty("javax.net.ssl.trustStore", "D:\workspace\Client_Server_SSL\serverKeyStore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "CertPass");
SSLServerSocketFactory factory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
try {
sslserversocket = (SSLServerSocket) factory.createServerSocket(PORT);
sslserversocket.setNeedClientAuth(true);
while (serverListening) {
System.out.println("Waiting for client");
// Accept return a new socket to handle the client.
SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();
is = new DataInputStream(sslsocket.getInputStream());
os = new DataOutputStream(sslsocket.getOutputStream());
System.out.println("Client connected");
List<Byte> message = new ArrayList<>();
byte character;
while ((character = is.readByte()) != 0) {
message.add(character);
}
byte[] messageBytes = byteListToByteArray(message);
String response = new String(messageBytes);
System.out.println("Client sad: " + response);
os.write("Welcome[=12=]".getBytes());
}
} catch (IOException e) {
System.err.println("Exception: " + e);
}
}
public static byte[] byteListToByteArray(List<Byte> bytes) {
byte[] result = new byte[bytes.size()];
for (int i = 0; i < bytes.size(); i++) {
result[i] = bytes.get(i).byteValue();
}
return result;
}
}
批处理脚本：
已从以下位置下载 openSSL：https://slproweb.com/products/Win32OpenSSL.html
将 bin 文件夹复制到一个单独的文件夹中，并在那里添加批处理文件。
openssl.cnf 是指南中第一个 link.
的副本
@echo on
cd /D %~dp0
REM could not create all subfolder at onces, I got a syntax error when trying root\ca\{certs,crl,newcerts,private}
mkdir root\ca\certs
mkdir root\ca\crl
mkdir root\ca\newcerts
mkdir root\ca\private
type NUL > root\ca\index.txt
echo 1000 > root\ca\serial
REM tried to use type but it was not working.
copy "%~dp0ConfigurationFiles\openssl_ca_test.cnf" root\ca\openssl.cnf
@echo ______________Creating CA
openssl genrsa -aes256 -out root/ca/private/ca.key.pem -passout pass:CAPassword 4096
openssl req -config root/ca/openssl.cnf -key root/ca/private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out root/ca/certs/ca.cert.pem -passin pass:CAPassword
openssl x509 -noout -text -in root/ca/certs/ca.cert.pem
@echo ______________INTERMEDIATE CERTIFICATES
mkdir root\ca\intermediate\certs
mkdir root\ca\intermediate\crl
mkdir root\ca\intermediate\newcerts
mkdir root\ca\intermediate\private
mkdir root\ca\intermediate\csr
type NUL > root\ca\intermediate\index.txt
echo 1000 > root\ca\intermediate\serial
echo 1000 > root\ca\intermediate\crlnumber
copy "%~dp0ConfigurationFiles\openss_intermediate_test.cnf" root\ca\intermediate\openssl.cnf
openssl genrsa -aes256 -out root/ca/intermediate/private/intermediate.key.pem -passout pass:InterMPassword 4096
openssl req -config root/ca/intermediate/openssl.cnf -new -sha256 -key root/ca/intermediate/private/intermediate.key.pem -out root/ca/intermediate/csr/intermediate.csr.pem -passin pass:InterMPassword
openssl ca -config root/ca/openssl.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in root/ca/intermediate/csr/intermediate.csr.pem -out root/ca/intermediate/certs/intermediate.cert.pem -passin pass:CAPassword
type root\ca\intermediate\certs\intermediate.cert.pem root\ca\certs\ca.cert.pem > root\ca\intermediate\certs\ca-chain.cert.pem
@echo ______________GENERATING CERTIFICATES
openssl genrsa -aes256 -out root/ca/intermediate/private/www.client.com.key.pem -passout pass:CertPass 2048
openssl genrsa -aes256 -out root/ca/intermediate/private/www.server.com.key.pem -passout pass:CertPass 2048
openssl req -config root/ca/intermediate/openssl.cnf -key root/ca/intermediate/private/www.client.com.key.pem -new -sha256 -out root/ca/intermediate/csr/www.client.com.csr.pem -passin pass:CertPass
openssl req -config root/ca/intermediate/openssl.cnf -key root/ca/intermediate/private/www.server.com.key.pem -new -sha256 -out root/ca/intermediate/csr/www.server.com.csr.pem -passin pass:CertPass
@echo ______________SIGNING CERTIFICATES
openssl ca -config root/ca/intermediate/openssl.cnf -extensions usr_cert -days 7000 -notext -md sha256 -in root/ca/intermediate/csr/www.client.com.csr.pem -out root/ca/intermediate/certs/www.client.com.cert.pem -passin pass:InterMPassword
openssl ca -config root/ca/intermediate/openssl.cnf -extensions server_cert -days 7000 -notext -md sha256 -in root/ca/intermediate/csr/www.server.com.csr.pem -out root/ca/intermediate/certs/www.server.com.cert.pem -passin pass:InterMPassword
@echo ______________DONE
PAUSE
I would like to be sure what each side should contain in their jks.
首先，对于相互认证的 SSL，每一方都需要两个 JKS 文件：一个密钥库和一个信任库。不要混淆这些文件，或混淆它们的用途，或将两者使用一个文件。
每种情况下的密钥库都包含该方自己的私钥和证书，以及签名证书链到对等方信任的任何根 CA。
每种情况下的信任库都包含本方信任的根 CA。如果对等方出于某种不幸的原因使用自签名证书，则这相当于要求在该方的信任库中导出该证书的副本。
您好，我正在开发一个 java 项目，该项目的客户端和服务器使用客户端身份验证设置为 true 的 SSL 套接字。我让一切正常，但我想确定每一方在他们的 jks 中应该包含什么。
客户:
1. 客户端私钥(key.pem) & public key(cert.pem).
2.中间CA public key(cert.pem).
服务器:
1.服务器私钥(key.pem) & public密钥(cert.pem).
2.中间CA public key(cert.pem).
我看了很多关于证书的书，但我真的不明白什么证书是真正需要的。
问题:
1.我读客户端应该只包含rootCA和他的证书，以及服务器所有的链和他的证书。这是正确的处理方式吗？
2. 我还读到服务器应该有两个 jks，一个带有证书，另一个带有信任链。我真的不知道每个应该包含什么。
3. 该代码仅在服务器和客户端具有javax.net.ssl.keyStore 和javax.net.ssl.trustStore 时有效。如果我删除其中一个，它们将停止工作，为什么？根据我的阅读，客户端应该只能与 trustStore 一起工作。
我知道网上有很多资料，我花了一个星期的时间阅读，但我仍然无法真正理解这一点。即使代码有效，我真的很想知道它为什么有效以及正确的方法是什么。
我从以下网站的 tutorila 创建了一个批次：https://jamielinux.com/docs/openssl-certificate-authority/。
我正在使用辅助项目来测试 ssl 套接字连接。这就是我正在使用的：
客户端 (MWE):
package com.test.ssl;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
public class Client {
private static final String IP = "127.0.0.1";
private static final int PORT = 15000;
private static DataOutputStream os;
private static DataInputStream is;
private static final byte messageEnd = 0;
public static void main(String[] args) {
System.setProperty("javax.net.ssl.keyStore", "D:\workspace\Client_Server_SSL\clientKeyStore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "CertPass");
System.setProperty("javax.net.ssl.trustStore", "D:\workspace\Client_Server_SSL\clientKeyStore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "CertPass");
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
try {
SSLSocket sslsocket = (SSLSocket) factory.createSocket(IP, PORT);
sslsocket.setNeedClientAuth(true);
is = new DataInputStream(sslsocket.getInputStream());
System.out.println("Loading output streams");
os = new DataOutputStream(sslsocket.getOutputStream());
System.out.println("Streams loaded");
os.write("Hi[=11=]".getBytes());
byte character;
List<Byte> message = new ArrayList<>();
while ((character = is.readByte()) != messageEnd) {
message.add(character);
}
byte[] messageBytes = byteListToByteArray(message);
String response = new String(messageBytes);
System.out.println("Server response: " + response);
} catch (IOException e) {
e.printStackTrace();
}
}
public static byte[] byteListToByteArray(List<Byte> bytes) {
byte[] result = new byte[bytes.size()];
for (int i = 0; i < bytes.size(); i++) {
result[i] = bytes.get(i).byteValue();
}
return result;
}
}
服务器 (MWE):
package com.test.ssl;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
public class Server {
private static boolean serverListening = true;
private static SSLServerSocket sslserversocket;
private static final int PORT = 15000;
private static DataInputStream is;
private static DataOutputStream os;
public static void main(String[] args) {
System.setProperty("javax.net.ssl.keyStore", "D:\workspace\Client_Server_SSL\serverKeyStore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "CertPass");
System.setProperty("javax.net.ssl.trustStore", "D:\workspace\Client_Server_SSL\serverKeyStore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "CertPass");
SSLServerSocketFactory factory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
try {
sslserversocket = (SSLServerSocket) factory.createServerSocket(PORT);
sslserversocket.setNeedClientAuth(true);
while (serverListening) {
System.out.println("Waiting for client");
// Accept return a new socket to handle the client.
SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();
is = new DataInputStream(sslsocket.getInputStream());
os = new DataOutputStream(sslsocket.getOutputStream());
System.out.println("Client connected");
List<Byte> message = new ArrayList<>();
byte character;
while ((character = is.readByte()) != 0) {
message.add(character);
}
byte[] messageBytes = byteListToByteArray(message);
String response = new String(messageBytes);
System.out.println("Client sad: " + response);
os.write("Welcome[=12=]".getBytes());
}
} catch (IOException e) {
System.err.println("Exception: " + e);
}
}
public static byte[] byteListToByteArray(List<Byte> bytes) {
byte[] result = new byte[bytes.size()];
for (int i = 0; i < bytes.size(); i++) {
result[i] = bytes.get(i).byteValue();
}
return result;
}
}
批处理脚本：
已从以下位置下载 openSSL：https://slproweb.com/products/Win32OpenSSL.html
将 bin 文件夹复制到一个单独的文件夹中，并在那里添加批处理文件。
openssl.cnf 是指南中第一个 link.
@echo on
cd /D %~dp0
REM could not create all subfolder at onces, I got a syntax error when trying root\ca\{certs,crl,newcerts,private}
mkdir root\ca\certs
mkdir root\ca\crl
mkdir root\ca\newcerts
mkdir root\ca\private
type NUL > root\ca\index.txt
echo 1000 > root\ca\serial
REM tried to use type but it was not working.
copy "%~dp0ConfigurationFiles\openssl_ca_test.cnf" root\ca\openssl.cnf
@echo ______________Creating CA
openssl genrsa -aes256 -out root/ca/private/ca.key.pem -passout pass:CAPassword 4096
openssl req -config root/ca/openssl.cnf -key root/ca/private/ca.key.pem -new -x509 -days 7300 -sha256 -extensions v3_ca -out root/ca/certs/ca.cert.pem -passin pass:CAPassword
openssl x509 -noout -text -in root/ca/certs/ca.cert.pem
@echo ______________INTERMEDIATE CERTIFICATES
mkdir root\ca\intermediate\certs
mkdir root\ca\intermediate\crl
mkdir root\ca\intermediate\newcerts
mkdir root\ca\intermediate\private
mkdir root\ca\intermediate\csr
type NUL > root\ca\intermediate\index.txt
echo 1000 > root\ca\intermediate\serial
echo 1000 > root\ca\intermediate\crlnumber
copy "%~dp0ConfigurationFiles\openss_intermediate_test.cnf" root\ca\intermediate\openssl.cnf
openssl genrsa -aes256 -out root/ca/intermediate/private/intermediate.key.pem -passout pass:InterMPassword 4096
openssl req -config root/ca/intermediate/openssl.cnf -new -sha256 -key root/ca/intermediate/private/intermediate.key.pem -out root/ca/intermediate/csr/intermediate.csr.pem -passin pass:InterMPassword
openssl ca -config root/ca/openssl.cnf -extensions v3_intermediate_ca -days 3650 -notext -md sha256 -in root/ca/intermediate/csr/intermediate.csr.pem -out root/ca/intermediate/certs/intermediate.cert.pem -passin pass:CAPassword
type root\ca\intermediate\certs\intermediate.cert.pem root\ca\certs\ca.cert.pem > root\ca\intermediate\certs\ca-chain.cert.pem
@echo ______________GENERATING CERTIFICATES
openssl genrsa -aes256 -out root/ca/intermediate/private/www.client.com.key.pem -passout pass:CertPass 2048
openssl genrsa -aes256 -out root/ca/intermediate/private/www.server.com.key.pem -passout pass:CertPass 2048
openssl req -config root/ca/intermediate/openssl.cnf -key root/ca/intermediate/private/www.client.com.key.pem -new -sha256 -out root/ca/intermediate/csr/www.client.com.csr.pem -passin pass:CertPass
openssl req -config root/ca/intermediate/openssl.cnf -key root/ca/intermediate/private/www.server.com.key.pem -new -sha256 -out root/ca/intermediate/csr/www.server.com.csr.pem -passin pass:CertPass
@echo ______________SIGNING CERTIFICATES
openssl ca -config root/ca/intermediate/openssl.cnf -extensions usr_cert -days 7000 -notext -md sha256 -in root/ca/intermediate/csr/www.client.com.csr.pem -out root/ca/intermediate/certs/www.client.com.cert.pem -passin pass:InterMPassword
openssl ca -config root/ca/intermediate/openssl.cnf -extensions server_cert -days 7000 -notext -md sha256 -in root/ca/intermediate/csr/www.server.com.csr.pem -out root/ca/intermediate/certs/www.server.com.cert.pem -passin pass:InterMPassword
@echo ______________DONE
PAUSE
I would like to be sure what each side should contain in their jks.
首先，对于相互认证的 SSL，每一方都需要两个 JKS 文件：一个密钥库和一个信任库。不要混淆这些文件，或混淆它们的用途，或将两者使用一个文件。
每种情况下的密钥库都包含该方自己的私钥和证书，以及签名证书链到对等方信任的任何根 CA。
每种情况下的信任库都包含本方信任的根 CA。如果对等方出于某种不幸的原因使用自签名证书，则这相当于要求在该方的信任库中导出该证书的副本。