0

我有一个使用 ConnectorJ 连接到 MySQL 数据库的应用程序，没有问题。但是，我现在需要扩展应用程序以针对其他端点执行相互验证的 HTTP 请求。

我的麻烦是为 HTTP 请求定义客户端密钥库似乎会导致密钥库也用于 JDBC 连接。MySQL DB 不希望提供证书，握手失败，如下所示。

来源（简体）

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class DbTester {

    private static final String JDBC_DRIVER = "com.mysql.jdbc.Driver";
    private static final String JDBC_URL = "jdbc:mysql://XXX.XXX.XXX.XXX/mysql?useSSL=true";
    private static final String JDBC_USERNAME = "xxxxxxxxxx";
    private static final String JDBC_PASSWORD = "xxxxxxxxxx";

    public static void main(final String[] args) throws Exception {

        Class.forName(JDBC_DRIVER);
        Connection connection = DriverManager.getConnection(JDBC_URL, JDBC_USERNAME, JDBC_PASSWORD);

        try (PreparedStatement statement = connection.prepareStatement("select 1 from user")){
            try (ResultSet results = statement.executeQuery()) {
                if (results.next()) {
                    System.out.println("Query Result: " + results.getString(1));
                }
            }
        }
    }
}

例子

健全性测试运行（成功输出）：

> java -cp .:mysql-connector-java-5.1.24-bin.jar DbTester
Query Result: 1

生成任意密钥：

keytool -genkey -keyalg RSA -keystore myKeystore.jks -storepass 密码

使用指定的键重新运行（失败！！）：

java -cp .:mysql-connector-java-5.1.24-bin.jar -Djavax.net.ssl.keyStore=myKeystore.jks -Djavax.net.ssl.keyStorePassword=password DbTester

Exception in thread "main" com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure
The last packet successfully received from the server was 911 milliseconds ago.  The last packet sent successfully to the server was 907 milliseconds ago.
 at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
 at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57) 
 at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
 at java.lang.reflect.Constructor.newInstance(Constructor.java:525)
 ...
Caused by: javax.net.ssl.SSLException: Unsupported record version Unknown-0.0
 at sun.security.ssl.InputRecord.readV3Record(InputRecord.java:524)
 at sun.security.ssl.InputRecord.read(InputRecord.java:509)
 at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:927)
 at sun.security.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1707)
 at sun.security.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:122)
 at sun.security.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:972)
 at sun.security.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:1087)
 at sun.security.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:1006)
 at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:285)
 at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
 at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
 at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
 at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
 at com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:90)
... 17 more

版本

java 版本“1.7.0_21” Java(TM) SE 运行时环境（内部版本 1.7.0_21-b11） Java HotSpot(TM) 64 位服务器 VM（内部版本 23.21-b01，混合模式）

mysql server: 5.1.66-log 源码分布

连接器j：mysql-connector-java-5.1.24-bin.jar

编辑/已解决

我通过为 HTTP 连接显式加载证书（并删除 JVM 级别的环境参数）来完成这项工作：

        String certPath = System.getProperty("my.cert.path");
        String certPassword = System.getProperty("my.cert.password");

        in = new FileInputStream(new File(certPath));
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(in, certPassword.toCharArray());
        in.close();

        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(ks, certPassword.toCharArray());
        KeyManager[] keymanagers = kmf.getKeyManagers();

        SSLContext context = SSLContext.getInstance("TLS");
        context.init(keymanagers, null, null);
        SSLSocketFactory sslSocketFactory = context.getSocketFactory();

        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
        connection.setSSLSocketFactory(sslSocketFactory);
        // do HTTP connection OPS :)
4

2 回答 2

1

我通过为 HTTP 连接显式加载证书（并删除 JVM 级别的环境参数）来完成这项工作：

        String certPath = System.getProperty("my.cert.path");
        String certPassword = System.getProperty("my.cert.password");

        in = new FileInputStream(new File(certPath));
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(in, certPassword.toCharArray());
        in.close();

        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(ks, certPassword.toCharArray());
        KeyManager[] keymanagers = kmf.getKeyManagers();

        SSLContext context = SSLContext.getInstance("TLS");
        context.init(keymanagers, null, null);
        SSLSocketFactory sslSocketFactory = context.getSocketFactory();

        HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
        // do HTTP connection OPS :)
于 2013-06-04T14:58:29.807 回答
0

MySQL DB 不希望提供证书

但它要求一个！如果服务器没有发送CertificateRequest消息，客户端就不会出示证书。要么你的客户端不被 MySQL 接受，这可以通过 MySQL 端的配置来修复，或者 MySQL 不应该要求客户端证书，这也可以在 MySQL 端修复。

于 2013-06-04T00:49:45.860 回答