使用 Retrofit 的相互认证 Android

Question

我需要根据 api 请求发送 .CRT 和 .KEY 文件。我设法使用 Postman 完成了请求，但我不知道如何在 android 代码中传递密钥。

CRT:

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

关键：

-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----

这是我的客户

fun getClient(url: String, context: Context): Retrofit {

        // Loading CAs from an InputStream
        val cf: CertificateFactory = CertificateFactory.getInstance("X.509")

        val ca: Certificate = context.resources.openRawResource(R.raw.crt).use { cert ->  cf.generateCertificate(cert) }

        // Creating a KeyStore containing our trusted CAs
        val keyStoreType = KeyStore.getDefaultType()
        val keyStore = KeyStore.getInstance(keyStoreType).apply {
            load(null, null)
            setCertificateEntry("ca", ca)
        }

        // Creating a TrustManager that trusts the CAs in our KeyStore.
        val tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm()
        val tmf = TrustManagerFactory.getInstance(tmfAlgorithm).apply {
            init(keyStore)
        }

        val trustManager: X509TrustManager = tmf.trustManagers[0] as X509TrustManager

        // Creating an SSLSocketFactory that uses our TrustManager
        val sslContext = SSLContext.getInstance("TLS").apply {
            init(null, arrayOf<TrustManager>(trustManager), null)
        }

        val okHttpClient = OkHttpClient.Builder()
            .sslSocketFactory(sslContext.socketFactory, trustManager)
            .build()

        val json = GsonBuilder().setLenient().create()

        return Retrofit
            .Builder()
            .baseUrl(url)
            .client(okHttpClient)
            .addCallAdapterFactory(RxJavaCallAdapterFactory.create())
            .addConverterFactory(GsonConverterFactory.create(json))
            .build()
    }

调用return一个throwable：

java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

非常感谢能帮助我的人。抱歉我的英语不好。

Answer 1

您的 Retrofit ssl 配置似乎与您配置邮递员的方式不匹配。在邮递员中，您已将其配置为在客户端证书配置部分中具有私钥和证书链。受信任的 certificates/CA 是空的。现在，如果我们将其与您的改装配置进行比较，我可以看到您已将 certificate.crt 文件添加为受信任的证书，而不是客户端密钥 material.

很难复制完全相同的情况，因为我们没有证书，所以我从 https://badssl.com/ 中获取了一个，我们可以用它来轻松测试这个用例。

我在此处添加证书，但您可能需要从网站本身获取一个新证书，因为它们将过期。

这个用例基本上需要 3 个文件：

客户端私钥
客户端证书链
受信任的服务器证书

1.客户端私钥

2。客户端证书链

3。可信服务器证书

有多种方法可以将这些文件加载到您的应用程序中并将它们转换为正确的 ssl materials。使用 vanilla java，如果你的 pem 文件（私钥）有不同的 headers，你可能需要调整它。但是对于上面的例子，下面的代码片段应该可以工作：

选项 1

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.Charset;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.StandardOpenOption;
import java.security.KeyFactory;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;

public class App {

    public static void main(String[] args) throws Exception {
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");

        InputStream trustedCertificateAsInputStream = Files.newInputStream(Paths.get("badssl-server-certificate.pem"), StandardOpenOption.READ);
        Certificate trustedCertificate = certificateFactory.generateCertificate(trustedCertificateAsInputStream);
        KeyStore trustStore = createEmptyKeyStore("secret".toCharArray());
        trustStore.setCertificateEntry("badssl-server", trustedCertificate);

        String privateKeyContent = new String(Files.readAllBytes(Paths.get("private-key-badssl.pem")), Charset.defaultCharset())
                .replace("-----BEGIN PRIVATE KEY-----", "")
                .replaceAll(System.lineSeparator(), "")
                .replace("-----END PRIVATE KEY-----", "");

        byte[] privateKeyAsBytes = Base64.getDecoder().decode(privateKeyContent);
        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(privateKeyAsBytes);

        InputStream certificateChainAsInputStream = Files.newInputStream(Paths.get("certificate-chain-badssl.pem"), StandardOpenOption.READ);
        Certificate certificateChain = certificateFactory.generateCertificate(certificateChainAsInputStream);

        KeyStore identityStore = createEmptyKeyStore("secret".toCharArray());
        identityStore.setKeyEntry("client", keyFactory.generatePrivate(keySpec), "".toCharArray(), new Certificate[]{certificateChain});

        trustedCertificateAsInputStream.close();
        certificateChainAsInputStream.close();

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(identityStore, "secret".toCharArray());
        KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagers, trustManagers, null);

        SSLSocketFactory socketFactory = sslContext.getSocketFactory();


        val okHttpClient = OkHttpClient.Builder()
                .sslSocketFactory(socketFactory, trustManagers[0])
                .build()

        val json = GsonBuilder().setLenient().create()

        val retrofit = Retrofit.Builder()
                .baseUrl("https://client.badssl.com/")
                .client(okHttpClient)
                .addConverterFactory(GsonConverterFactory.create(json))
                .build()
    }

    public static KeyStore createEmptyKeyStore(char[] keyStorePassword) throws CertificateException, NoSuchAlgorithmException, IOException, KeyStoreException {
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null, keyStorePassword);
        return keyStore;
    }

}

它有点冗长，但这应该可以解决问题。我用 vanilla java 写了这个，但是你的 IDEA 应该能够轻松地将它转换为 kotlin。

上面的设置还有一个替代方案，我在自己的库中提供了它，请参见此处：GitHub - SSLContext Kickstart参见下面选项 2 下的示例用法。

选项 2

X509ExtendedKeyManager keyManager = PemUtils.loadIdentityMaterial("certificate-chain-badssl.pem", "private-key-badssl.pem");
X509ExtendedTrustManager trustManager = PemUtils.loadTrustMaterial("badssl-server-certificate.pem");

SSLFactory sslFactory = SSLFactory.builder()
          .withIdentityMaterial(keyManager)
          .withTrustMaterial(trustManager)
          .build();

val okHttpClient = OkHttpClient.Builder()
        .sslSocketFactory(sslFactory.getSslSocketFactory(), sslFactory.getTrustManager().get())
        .build()

val json = GsonBuilder().setLenient().create()

val retrofit = Retrofit.Builder()
        .baseUrl("https://client.badssl.com/")
        .client(okHttpClient)
        .addConverterFactory(GsonConverterFactory.create(json))
        .build()

使用 Retrofit 的相互认证 Android

Mutual authentication using Retrofit Android

android

ssl

kotlin

retrofit

mutual-authentication