【轉】網絡安全-Java SSLSocketFactory 創建方式

特別提示：本人博客部分有參考網絡其他博客，但均是本人親手編寫過並驗證通過。如發現博客有錯誤，請及時提出以免誤導其他人，謝謝！歡迎轉載，但記得標明文章出處： http://www.cnblogs.com/mao2080/

1、問題描述

　　Java客服端使用證書連接到服務器，加密方式有了兩種：方式一：CA、Client CRT、Client Key 文件  |  方式二：KeyStore.jks、TrustStore.jks、Password。

2、操作方法

　　1、通過 CA、Client CRT、Client Key，客戶端自己創建 KeyStore、TrustStore，再創建 SSLSocketFactory

    /**
     * 創建 SSLSocketFactory 工廠
     *
     * @param caCrtFile 服務端 CA 證書
     * @param crtFile 客戶端 CRT 文件
     * @param keyFile 客戶端 Key 文件
     * @param password SSL 密碼，隨機
     * @return {@link SSLSocketFactory}
     * @throws Exception 異常
     */
    public static SSLSocketFactory getSocketFactory(final String caCrtFile, final String crtFile, final String keyFile, final String password) throws Exception {
        InputStream caInputStream = null;
        InputStream crtInputStream = null;
        InputStream keyInputStream = null;
        try {
            Security.addProvider(new BouncyCastleProvider());
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            // load CA certificate
            caInputStream = new ClassPathResource(caCrtFile).getInputStream();
            X509Certificate caCert = null;
            while (caInputStream.available() > 0) {
                caCert = (X509Certificate) cf.generateCertificate(caInputStream);
            }
            // load client certificate
            crtInputStream = new ClassPathResource(crtFile).getInputStream();
            X509Certificate cert = null;
            while (crtInputStream.available() > 0) {
                cert = (X509Certificate) cf.generateCertificate(crtInputStream);
            }

            // load client private key
            keyInputStream = new ClassPathResource(keyFile).getInputStream();
            PEMParser pemParser = new PEMParser(new InputStreamReader(keyInputStream));
            Object object = pemParser.readObject();
            PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(password.toCharArray());
            JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
            KeyPair key;
            if (object instanceof PEMEncryptedKeyPair) {
                System.out.println("Encrypted key - we will use provided password");
                key = converter.getKeyPair(((PEMEncryptedKeyPair) object).decryptKeyPair(decProv));
            } else {
                System.out.println("Unencrypted key - no password needed");
                key = converter.getKeyPair((PEMKeyPair) object);
            }
            pemParser.close();

            // CA certificate is used to authenticate server
            KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
            caKs.load(null, null);
            caKs.setCertificateEntry("ca-certificate", caCert);
            TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
            tmf.init(caKs);

            // client key and certificates are sent to server so it can authenticate
            // us
            KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
            ks.load(null, null);
            ks.setCertificateEntry("certificate", cert);
            ks.setKeyEntry("private-key", key.getPrivate(), password.toCharArray(), new java.security.cert.Certificate[]{cert});
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(ks, password.toCharArray());

            // finally, create SSL socket factory
            SSLContext context = SSLContext.getInstance("TLSv1.2");
            context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

            return context.getSocketFactory();

        }
        finally {
            if (null != caInputStream) {
                caInputStream.close();
            }
            if (null != crtInputStream) {
                crtInputStream.close();
            }
            if (null != keyInputStream) {
                keyInputStream.close();
            }
        }
    }

　　2、服務端提供 KeyStore.jks、TrustStore.jks，創建 SSLSocketFactory

    /**
     * 創建 SSLSocketFactory 工廠
     *
     * @param keyStoreJks 客戶端 KeyStore
     * @param trustStoreJks 客戶端 信任庫 trust store
     * @param password 密碼
     * @return {@link SSLSocketFactory}
     * @throws Exception 異常
     */
    public static SSLSocketFactory getSocketFactory(final String keyStoreJks, final String trustStoreJks, final String password) throws Exception {
        InputStream keyStoreJksInputStream = null;
        InputStream trustStoreJksInputStream = null;
        try {
            ClassPathResource classPathResource = new ClassPathResource(keyStoreJks);
            keyStoreJksInputStream = classPathResource.getInputStream();
            KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
            ks.load(keyStoreJksInputStream, password.toCharArray());
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(ks, password.toCharArray());

            classPathResource = new ClassPathResource(trustStoreJks);
            trustStoreJksInputStream = classPathResource.getInputStream();
            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            trustStore.load(trustStoreJksInputStream, password.toCharArray());
            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("X509");
            trustManagerFactory.init(trustStore);

            // finally, create SSL socket factory
            SSLContext context = SSLContext.getInstance("TLSv1.2");
            context.init(kmf.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
            return context.getSocketFactory();
        }
        finally {
            try {
                if (null != keyStoreJksInputStream) {
                    keyStoreJksInputStream.close();
                }
            } catch (IOException e) {
                System.out.println(e.getMessage());
            }

            try {
                if (null != trustStoreJksInputStream) {
                    trustStoreJksInputStream.close();
                }
            } catch (IOException e) {
                System.out.println(e.getMessage());
            }
        }
    }

3、參考網站

https://blog.csdn.net/weixin_43803007/article/details/105513034（原文地址）