2

我尝试通过 HTTPS 将 Java 8 连接到具有自签名 TLS 证书的 Intranet 服务器上的 JNLP 文件。

当 Java Web Start 尝试加载 JNLP 尝试中指定的第一个资源（来自该服务器的文件）时，它会引发异常：

javax.net.ssl.SSLHandshakeException: com.sun.deploy.security.RevocationChecker$StatusUnknownException: Certificate does not specify OCSP responder
at sun.security.ssl.Alerts.getSSLException(Unknown Source)

...

Caused by: com.sun.deploy.security.RevocationChecker$StatusUnknownException: Certificate does not specify OCSP responder
at com.sun.deploy.security.RevocationChecker.checkOCSP(Unknown Source)
at com.sun.deploy.security.RevocationChecker.check(Unknown Source)
at com.sun.deploy.security.RevocationCheckHelper.doRevocationCheck(Unknown Source)
at com.sun.deploy.security.RevocationCheckHelper.doRevocationCheck(Unknown Source)
at com.sun.deploy.security.RevocationCheckHelper.checkRevocationStatus(Unknown Source)
at com.sun.deploy.security.X509TrustManagerDelegate.checkTrusted(Unknown Source)
at com.sun.deploy.security.X509Extended7DeployTrustManagerDelegate.checkServerTrusted(Unknown Source)
at com.sun.deploy.security.X509Extended7DeployTrustManager.checkServerTrusted(Unknown Source)
... 39 more
Suppressed: com.sun.deploy.security.RevocationChecker$StatusUnknownException
    at com.sun.deploy.security.RevocationChecker.checkCRLs(Unknown Source)
    ... 46 more

任何的想法？

事实上，我们没有指定 OCSP 响应者。但这真的是个问题吗？有趣的是，这适用于我同事的机器（他们只会收到警告）。几天前，我临时安装了 Java 9 来测试一些东西。这有可能混淆了吗？我又卸载了，顺便说一句。

我当前的解决方法是在 Java 控制面板（选项卡“高级”）中将“执行 TLS 证书吊销检查”设置为“不检查（不推荐）”。但我不喜欢那样。

4

1 回答 1

1

I got past this today, was just an issue with my certificates - recreated my Keystore, but my truststore was missing the new root/intermediate cert that was specified in the website's certificate. I went back and added the certs to the truststore and restarted the site, and it worked.

keytool -import -trustcacerts -alias root -file NewRoot.cer -keystore cacerts

keytool -import -trustcacerts -alias "Intermed Name Here" -file NewInt.cer -keystore cacerts

-- I was going down a dead-end chasing the OCSP responder when Java was really checking CRL and OCSP, in that order. Fixing the Truststore / CAs was really all that was needed.

Brent

于 2019-10-02T14:39:59.953 回答