0

我有一个自己编写的 java 服务器，它的密钥库中可能有多个密钥（一个用于连接的密钥，另一个用于翻转的密钥，以防第一个过期）所以我尝试读取密钥库，然后构造一个只有一个密钥的临时密钥库当我需要启动服务器时传递给 SSLContext。但是，它似乎不起作用：

在客户端，我得到：

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
sun.security.ssl.AppOutputStream.write(Unknown Source)
java.io.BufferedOutputStream.flushBuffer(Unknown Source)
java.io.BufferedOutputStream.flush(Unknown Source)
com.netrust.protocol.ProtocolClient.initialize(ProtocolClient.java:41)
com.netrust.clientregistrar.gui.Client.connect(Client.java:501)
com.netrust.clientregistrar.gui.Client.sendGetDirectoryChangeLog(Client.java:108)
com.netrust.clientregistrar.gui.ServerTreeModel.refresh(ServerTreeModel.java:195)
com.netrust.clientregistrar.gui.ServerTreeModel.refresh(ServerTreeModel.java:333)
com.netrust.clientregistrar.gui.ServerTreePanel.refresh(ServerTreePanel.java:189)
com.netrust.clientregistrar.gui.ClientRegistrarPanel.<init>(ClientRegistrarPanel.java:195)
com.netrust.clientregistrar.gui.Main.runApplication(Main.java:150)
com.netrust.clientregistrar.gui.Main.access$300(Main.java:26)
com.netrust.clientregistrar.gui.Main$1.run(Main.java:64)
java.awt.event.InvocationEvent.dispatch(Unknown Source)
java.awt.EventQueue.dispatchEventImpl(Unknown Source)
java.awt.EventQueue.access$000(Unknown Source)
java.awt.EventQueue$3.run(Unknown Source)
java.awt.EventQueue$3.run(Unknown Source)
java.security.AccessController.doPrivileged(Native Method)
java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source)
java.awt.EventQueue.dispatchEvent(Unknown Source)
java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
java.awt.EventDispatchThread.pumpEvents(Unknown Source)
java.awt.EventDispatchThread.pumpEvents(Unknown Source)
java.awt.EventDispatchThread.run(Unknown Source)

在服务器端，我得到：

javax.net.ssl.SSLException: Received fatal alert: internal_error
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
com.netrust.server.ManagementSecureConnectionHandler.run(ManagementSecureConnectionHandler.java:96)
com.netrust.util.DynamicThreadPool$WorkerThread.run(DynamicThreadPool.java:295)

相关代码：

// marhalAsJKS()
Enumeration< String > aliases = keyStore.aliases();
String alias = null;
java.security.KeyStore jks = java.security.KeyStore.getInstance( java.security.KeyStore.getDefaultType() );
jks.load( null, oldPassword );
while ( aliases.hasMoreElements() )
{
    alias = aliases.nextElement();
    if ( keyStore.isKeyEntry( alias ) )
    {
        jks.setKeyEntry( alias,
                 keyStore.getKey( alias, oldPassword ),
                 oldPassword,
                 keyStore.getCertificateChain( alias ) );
    }
    else if ( keyStore.isCertificateEntry( alias ) )
    {
        jks.setCertificateEntry( alias, keyStore.getCertificate( alias ) );
    }
}
// Constructing ephemeral keystore and truststore
ephemeralKeyStore = managementKeyStore.marshalAsJKS();
ephemeralKeyStore.deleteEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS );
ephemeralTrustStore = managementKeyStore.marshalAsJKS();
ephemeralTrustStore.deleteEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS );
if ( generalConfiguration.isRootServerType() && managementKeyStore.isKeyEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS ) )
    ephemeralTrustStore.setCertificateEntry( PathRegistry.ROOT_CERTIFICATE_ROLLOVER_ENTRY_ALIAS,
                                     managementKeyStore.getCertificate( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS ) );

// Initializing SSL
sslContext = SSLContext.getInstance( "TLS" );
keyManagerFactory.init( getKeyStore(), getKeyStorePassword() );
trustManagerFactory.init( getTrustStore() );
sslContext.init( keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null );
serverSocket = ( SSLServerSocket ) sslContext.getServerSocketFactory().createServerSocket( getPort() );

类似的问题，但使用 1 路 SSL： 我如何为 Java 服务器提供多个 SSL 证书

4

1 回答 1

2

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

这几乎可以肯定来自您使用空信任存储初始化的客户端代码中的信任管理器。

于 2012-08-08T14:31:19.123 回答