[Java] SSL 证书使用

作者: 巨馍蘸酱 | 来源:发表于2022-11-24 14:30 被阅读0次

Tomcat配置SSL证书
将Fiddler的服务器证书导入到Java的cacerts证书库
SpringBoot HTTPS配置
跳过 Java SSL 校验
Nginx环境下http和https(ssl)共存的方法
在Nginx中配置ssl证书
AFNetworking框架下的SSL服务器证书的自定义验证
nginx https 配置
根据https证书类型选择性价比高的https证书
Apache中多个HTTPS虚拟主机的实现

Springboot

适用于 jar 直接运行

单向

mydefine:
  port: 8081
server:
  port: 8011
  ssl:
    enabled: true
    key-store: classpath:certificate/server.p12 # src/main/resources/certificate/server.p12
    key-store-password: 123456
    key-store-type: PKCS12

SSLConfig

@Configuration
public class SSLConfig {

    // http 请求端口
    @Value("${mydefine.port}")
    private int serverPortHttp;

    // HTTPS 请求端口
    @Value("${server.port}")
    private int serverPortHttps;


    @Bean
    public Connector connector (){
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        //Connector监听的http的端口号
        connector.setPort(serverPortHttp);
        connector.setSecure(false);
        //监听到http的端口号后转向到的https的端口号
        connector.setRedirectPort(serverPortHttps);
        return connector;
    }

    //springboot 2.x 可用
    @Bean
    public TomcatServletWebServerFactory tomcatServletWebServerFactory(Connector connector){
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        tomcat.addAdditionalTomcatConnectors(connector);
        return tomcat;
    }
}

双向

mydefine:
  port: 8082
server:
  port: 8022
  ssl:
    enabled: true
    key-store-type: PKCS12 # PKCS12 #JKS
    key-store: classpath:certificate/server.p12
    key-store-password: 123456
    key-alias: server
    client-auth: none
    #trust-store-provider: SUN
    trust-store-type: PKCS12
    trust-store: classpath:certificate/server.p12
    trust-store-password: 123456

SSLConfig

@Configuration
public class SSLConfig {

    // http 请求端口
    @Value("${mydefine.port}")
    private int serverPortHttp;

    // HTTPS 请求端口
    @Value("${server.port}")
    private int serverPortHttps;

    @Bean
    public Connector connector (){
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        //Connector监听的http的端口号
        connector.setPort(serverPortHttp);
        connector.setSecure(false);
        //监听到http的端口号后转向到的https的端口号
        connector.setRedirectPort(serverPortHttps);
        return connector;
    }

    //springboot 2.x 可用
    @Bean
    public TomcatServletWebServerFactory tomcatServletWebServerFactory(Connector connector){
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        tomcat.addAdditionalTomcatConnectors(connector);
        return tomcat;
    }
}

RestTemplateConfig

@Configuration
public class RestTemplateConfig {
    @Value("${server.ssl.key-store-type}")
    String clientKeyType;
    @Value("${server.ssl.key-store}")
    String clientPath;
    @Value("${server.ssl.key-store-password}")
    String clientPass;

    @Value("${server.ssl.trust-store-type}")
    String trustKeyType;
    @Value("${server.ssl.trust-store}")
    String trustPath;
    @Value("${server.ssl.trust-store-password}")
    String trustPass;

    @Bean
    public RestTemplate restTemplate() {
        RestTemplate restTemplate = null;
        try {
            HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
            // 客户端证书类型
            KeyStore clientStore = KeyStore.getInstance(clientKeyType);
            // 加载客户端证书，即自己的私钥
            InputStream keyStream = getClass().getClassLoader().getResourceAsStream(clientPath);
            clientStore.load(keyStream, clientPass.toCharArray());
            // 创建密钥管理工厂实例
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            // 初始化客户端密钥库
            keyManagerFactory.init(clientStore, clientPass.toCharArray());
            KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();

            // 创建信任库管理工厂实例
            TrustManagerFactory trustManagerFactory = TrustManagerFactory
                    .getInstance(TrustManagerFactory.getDefaultAlgorithm());
            KeyStore trustStore = KeyStore.getInstance(trustKeyType);
            InputStream trustStream = getClass().getClassLoader().getResourceAsStream(trustPath);
            trustStore.load(trustStream, trustPass.toCharArray());

            // 初始化信任库
            trustManagerFactory.init(trustStore);
            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
            // 建立TLS连接
            SSLContext sslContext = SSLContext.getInstance("TLS");
            // 初始化SSLContext
            sslContext.init(keyManagers, trustManagers, new SecureRandom());
            // INSTANCE 忽略域名检查
            SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
            CloseableHttpClient httpclient = HttpClients
                    .custom()
                    .setSSLSocketFactory(sslConnectionSocketFactory)
                    .setSSLHostnameVerifier(new NoopHostnameVerifier())
                    .build();
            requestFactory.setHttpClient(httpclient);
            requestFactory.setConnectTimeout((int) Duration.ofSeconds(15).toMillis());
            restTemplate = new RestTemplate(requestFactory);
        } catch (KeyManagementException | FileNotFoundException | NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (KeyStoreException | CertificateException | UnrecoverableKeyException | IOException e) {
            e.printStackTrace();
        }
        return restTemplate;
    }
}

Tomcat

tomcat/conf/server.xml

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks" type="RSA" certificateKeystorePassword="123456" />
    </SSLHostConfig>
</Connector>

或者

<Connector 
     port="443" 
     protocol="org.apache.coyote.http11.Http11NioProtocol" 
     maxThreads="150" 
     SSLEnabled="true" 
     scheme="https" 
     secure="true" 
     clientAuth="false" 
     sslProtocol="TLS" 
     keystoreFile="conf/localhost-rsa.jks" 
     keystorePass="123456" />

Nginx

nginx 配置后 tomcat / jar 不用配置

编辑配置文件 vim /usr/local/nginx/conf/nginx.conf

#user  nobody;
worker_processes  1;

events {
   worker_connections  1024;
}

http {
   include  mime.types;
   default_type  application/octet-stream;
   sendfile  on;
   keepalive_timeout  65;

   # http
   server {
      listen  80;
      server_name  localhost 192.168.1.1;
      return 301 https://$server_name$request_uri;
   }

   # https 单向认证
   server {
      listen       443 ssl;
      server_name  localhost 192.168.1.1;

      ssl_certificate /root/ssl/server.crt;
      ssl_certificate_key /root/ssl/server.key;

      location / {
         # 反向代理
         proxy_pass http://localhost:8080;
      }
   }

   # https 双向认证
   server {
        listen       443 ssl;
        server_name  localhost 192.168.1.1;

        ssl_certificate /root/ssl/server.crt;
        ssl_certificate_key /root/ssl/server.key;
        ssl_client_certificate /root/ssl/root.crt; # 根证书 也可以是单个的客户端证书
        ssl_verify_client on; # 开启双向认证
        
        ssl_session_timeout 10m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
        ssl_prefer_server_ciphers on;

        location / {
            # 反向代理
            proxy_pass http://localhost:8080;
        }
   }

   server {
        listen       443 ssl;
        server_name  localhost 192.168.1.1;

        ssl_certificate /root/ssl/server.crt;
        ssl_certificate_key /root/ssl/server.key;
        ssl_client_certificate /root/ssl/root.crt; # 根证书 也可以是单个的客户端证书
        ssl_verify_client optional; # 配置校验客户端策略, ssl_client_verify = SUCCESS
        
        ssl_session_timeout 10m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; 
        ssl_prefer_server_ciphers off;

        location / { # 需要双向验证https的接口
            if ($ssl_client_verify != SUCCESS) {
                 return 401;
            }
            proxy_pass http://localhost:8080;
            proxy_connect_timeout 600;
            proxy_read_timeout 600;
        }

        location /other/downloadUpdateFile { # 获取证书版本和下载证书接口，不需要验证Https
            proxy_pass http://localhost:8080;
            proxy_connect_timeout 600;
            proxy_read_timeout 600;
        }
   }
}

Tomcat配置SSL证书
Tomcat配置SSL证书一、使用JDK自带的工具生成数字证书 keytool.exe 命令位于Java\jdk...
将Fiddler的服务器证书导入到Java的cacerts证书库
我在将Fiddler作为Java应用的代理时，在使用Java代码连接Fiddler时遇到了SSL证书相关的错误： ...
SpringBoot HTTPS配置
1、获取SSL证书正式项目可以购买或者申请免费ssl证书，测试项目可以使用cmd自行生成ssl证书。输入密码和...
跳过 Java SSL 校验
无论使用什么 HttpClient, 只要用了SSL, java都会有求校验证书. 下面举例 apache Htt...
Nginx环境下http和https(ssl)共存的方法
给nginx配置SSL证书后（这里使用的是自己生成的测试证书，参见 nginx使用ssl模块配置HTTPS支持），...
在Nginx中配置ssl证书
网站配置ssl证书之后，就可以使用https的方式进行访问。 1.申请ssl证书可以申请免费的ssl证书，也可以...
AFNetworking框架下的SSL服务器证书的自定义验证
AFNetworking框架下的SSL服务器证书的自定义验证如何使用本地证书进行SSL验证开启SSL验证需要...
nginx https 配置
1. 首先需要一个免费的 ssl 证书本文使用的是 Let's Encrypt 免费的 SSL 证书关于其他证书...
根据https证书类型选择性价比高的https证书
SSL证书根据验证级别分为三种类型，即DV SSL证书（域名型SSL证书）、OV SSL证书（企业型SSL证书）、...
Apache中多个HTTPS虚拟主机的实现
点击：申请SSL证书要实现一个Apache服务器上提供多个SSL虚拟主机，可以： * 使用多域名SSL证书，可以...

[Java] SSL 证书使用

Springboot

单向

双向

Tomcat

Nginx

相关文章

Tomcat配置SSL证书

将Fiddler的服务器证书导入到Java的cacerts证书库

SpringBoot HTTPS配置

跳过 Java SSL 校验

Nginx环境下http和https(ssl)共存的方法

在Nginx中配置ssl证书

AFNetworking框架下的SSL服务器证书的自定义验证

nginx https 配置

根据https证书类型选择性价比高的https证书

Apache中多个HTTPS虚拟主机的实现

网友评论

延伸阅读

深度阅读

栏目导航

热点阅读