java - 没有“服务器”的 Java 双向 SSL

Question

我一直在寻找一个在 java 中没有“服务器”的相互身份验证 SSL 的示例，如 weblogic / glassfish / tomcat / 等 - 有这样的事情吗？

也请不要使用外部库，我希望只使用以下内容：

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;

Answer 1

你可以使用这样的东西（注意这是我做的一个教程学校项目，它不完整）

客户

    //load client private key
    KeyStore clientKeys = KeyStore.getInstance("JKS");
    clientKeys.load(new FileInputStream("proxyKeystore"),"password".toCharArray());
    KeyManagerFactory clientKeyManager = KeyManagerFactory.getInstance("SunX509");
    clientKeyManager.init(clientKeys,"password".toCharArray());
    //load server public key
    KeyStore serverPub = KeyStore.getInstance("JKS");
    serverPub.load(new FileInputStream("proxyTrustedStore"),"password".toCharArray());
    TrustManagerFactory trustManager = TrustManagerFactory.getInstance("SunX509");
    trustManager.init(serverPub);

  //use keys to create SSLSoket
  SSLContext ssl = SSLContext.getInstance("TLS");
  ssl.init(clientKeyManager.getKeyManagers(), trustManager.getTrustManagers(), SecureRandom.getInstance("SHA1PRNG"));
  socket = (SSLSocket)ssl.getSocketFactory().createSocket("localhost", 8889);


  socket.startHandshake();

服务器：

KeyStore serverKeys = KeyStore.getInstance("JKS");
            serverKeys.load(new FileInputStream("authKeystore"),"password".toCharArray());
            KeyManagerFactory serverKeyManager = KeyManagerFactory.getInstance("SunX509");
            serverKeyManager.init(serverKeys,"password".toCharArray());


            KeyStore clientPub = KeyStore.getInstance("JKS");
            clientPub.load(new FileInputStream("authTrustedStore"),"password".toCharArray());
            TrustManagerFactory trustManager = TrustManagerFactory.getInstance("SunX509");
            trustManager.init(clientPub);

          //use keys to create SSLSoket
          SSLContext ssl = SSLContext.getInstance("TLS");
          ssl.init(serverKeyManager.getKeyManagers(), trustManager.getTrustManagers(), SecureRandom.getInstance("SHA1PRNG"));
          serverSock = (SSLServerSocket)ssl.getServerSocketFactory().createServerSocket(8889);
          serverSock.setNeedClientAuth(true);
          socket = (SSLSocket)serverSock.accept();

在开始握手和/或接受 serverSocket 连接之前，您可以从服务器和/或客户端请求证书。