相互验证与X509证书使用的HttpClient 4.0.1

Question

有没有人对如何通过使用4.0.1的HTTPClient X509证书进行客户端身份验证任何友好的提示？

谢谢你的时间。

Answer 1

下面是一些代码，让你去。 KeyStore是包含客户端证书的对象。如果服务器正在使用自签名证书或由JVM在附带的cacerts文件中识别的未由CA签名的证书，那么您将需要使用TrustStore。否则使用默认cacerts文件，在传递到null为SSLSockeFactory信任存储参数..

import org.apache.http.conn.scheme.Scheme; 
import org.apache.http.conn.scheme.SchemeRegistry; 
import org.apache.http.conn.ssl.SSLSocketFactory; 
import org.apache.http.impl.client.DefaultHttpClient; 
import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager; 
import org.apache.http.params.BasicHttpParams; 
import org.apache.http.params.HttpParams; 

... 

final HttpParams httpParams = new BasicHttpParams(); 

// load the keystore containing the client certificate - keystore type is probably jks or pkcs12 
final KeyStore keystore = KeyStore.getInstance("pkcs12"); 
InputStream keystoreInput = null; 
// TODO get the keystore as an InputStream from somewhere 
keystore.load(keystoreInput, "keystorepassword".toCharArray()); 

// load the trustore, leave it null to rely on cacerts distributed with the JVM - truststore type is probably jks or pkcs12 
KeyStore truststore = KeyStore.getInstance("pkcs12"); 
InputStream truststoreInput = null; 
// TODO get the trustore as an InputStream from somewhere 
truststore.load(truststoreInput, "truststorepassword".toCharArray()); 

final SchemeRegistry schemeRegistry = new SchemeRegistry(); 
schemeRegistry.register(new Scheme("https", new SSLSocketFactory(keystore, keystorePassword, truststore), 443)); 

final DefaultHttpClient httpClient = new DefaultHttpClient(new ThreadSafeClientConnManager(httpParams, schemeRegistry), httpParams); 

Answer 2

另一种解决方案（从另一示例复制）。我使用了'trusting'（trustStore）和用于验证自己（keyStore）的相同密钥库。

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); 
FileInputStream instream = new FileInputStream(new File("miller.keystore")); 
try { 
    trustStore.load(instream, "pw".toCharArray()); 
} finally { 
    instream.close(); 
} 

SSLContext sslcontext = SSLContexts.custom() 
     .loadTrustMaterial(trustStore) /* this key store must contain the certs needed & trusted to verify the servers cert */ 
     .loadKeyMaterial(trustStore, "pw".toCharArray()) /* this keystore must contain the key/cert of the client */ 
     .build(); 

SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext, 
     SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER); 
CloseableHttpClient httpclient = HttpClients.custom() 
     .setSSLSocketFactory(sslsf) 
     .build(); 
try { 

    HttpGet httpget = new HttpGet("https://localhost"); 

    System.out.println("executing request" + httpget.getRequestLine()); 

    CloseableHttpResponse response = httpclient.execute(httpget); 
    try { 
     HttpEntity entity = response.getEntity(); 

     System.out.println("----------------------------------------"); 
     System.out.println(response.getStatusLine()); 
     if (entity != null) { 
      System.out.println("Response content length: " + entity.getContentLength()); 
     } 
     EntityUtils.consume(entity); 
    } finally { 
     response.close(); 
    } 
} finally { 
    httpclient.close(); 
} 

Answer 3

我从HttpClient网站上的示例代码（如果我没有记错的话，自定义SSL上下文）使用以下代码。

{ 
    KeyStore keyStore = KeyStore.getInstance("PKCS12"); //client certificate holder 
    FileInputStream instream = new FileInputStream(new File(
      "client-p12-keystore.p12")); 
    try { 
     trustStore.load(instream, "password".toCharArray()); 
    } finally { 
     instream.close(); 
    } 

    // Trust own CA and all self-signed certs 
    SSLContext sslcontext = SSLContexts.custom() 
      .loadKeyMaterial(keyStore, "password".toCharArray()) 
      // .loadTrustMaterial(trustStore, new TrustSelfSignedStrategy()) //if you have a trust store 
      .build(); 
    // Allow TLSv1 protocol only 
    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
      sslcontext, new String[] { "TLSv1" }, null, 
      SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
    CloseableHttpClient httpclient = HttpClients 
      .custom() 
      .setHostnameVerifier(
        SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER) //todo 
      .setSSLSocketFactory(sslsf).build(); 
    try { 

     HttpGet httpget = new HttpGet("https://localhost:8443/secure/index"); 

     System.out.println("executing request" + httpget.getRequestLine()); 

     CloseableHttpResponse response = httpclient.execute(httpget); 
     try { 
      HttpEntity entity = response.getEntity(); 

      System.out.println("----------------------------------------"); 
      System.out.println(response.getStatusLine()); 
      if (entity != null) { 
       System.out.println("Response content length: " 
         + entity.getContentLength()); 
      } 
      EntityUtils.consume(entity); 
     } finally { 
      response.close(); 
     } 
    } finally { 
     httpclient.close(); 
    } 
}