无法通过 SSL 连接到 MySQL（无法找到请求目标的有效证书路径）

Question

我正在尝试连接到我在luther:3306 监听的 MySQL 实例。我关注了these instructions，了解如何在 Ubuntu 上为 MySQL 实例设置 SSL，效果很好。当我提供用户名、密码、SSL 密钥、SSL 证书和 SSL CA 时，我可以使用用户 ford 从 GUI（MySQL Workbench）连接到 luther:3306 没有问题。

现在，我正在尝试通过 Java 应用程序进行连接，但在为 Java 提供正确证书时遇到了问题。代码如下：

System.setProperty("javax.net.ssl.keyStore","C:/Program Files/Java/jre1.8.0_45/bin/cacerts");
System.setProperty("javax.net.ssl.keyStorePassword","changeit");
System.setProperty("javax.net.ssl.trustStore","C:/Program Files/Java/jre1.8.0_45/bin/cacerts");
System.setProperty("javax.net.ssl.trustStorePassword","changeit");
System.setProperty("javax.net.debug", "SSL");

// Create the DB connection
try {
  String connectionUrl = "jdbc:mysql://luther/ford";
  Properties dbProps = new Properties();
  dbProps.setProperty("user", "ford");
  dbProps.setProperty("password", "<password>");
  dbProps.setProperty("useSSL", "true");
  dbProps.setProperty("requreSSL", "true");

  dbConnection = DriverManager.getConnection(connectionUrl, dbProps);
  log.info("Connected to DB? " + dbConnection.isValid(5000));
} catch (SQLException e) {
  log.fatal("Unable to connect to DB!");
  e.printStackTrace();
  return;
}

这是 CA 证书文件的内容：

C:\Program Files\Java\jre1.8.0_45\bin>keytool -keystore cacerts -list
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

mysqlcacert, Jan 20, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): 71:92:DA:13:02:57:64:49:3D:72:A0:40:1B:B8:55:42:7D:21:0A:CF
mysqlclientcert, Jan 20, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): A1:F5:5A:DB:31:78:D9:3C:F7:D7:C6:28:77:AB:DF:0A:58:CC:EA:A7

这表明我有我的 CA 证书和我的客户证书。这是我在运行 Java 程序时遇到的顶级异常：

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  at sun.security.ssl.Alerts.getSSLException(Unknown Source)
  at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
  at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
  at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
  at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
  at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
  at sun.security.ssl.Handshaker.processLoop(Unknown Source)
  at sun.security.ssl.Handshaker.process_record(Unknown Source)
  at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
  at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
  at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
  at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
  at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
  at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
  at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
  at org.jsoup.helper.HttpConnection$Response.execute(HttpConnection.java:512)
  at org.jsoup.helper.HttpConnection$Response.execute(HttpConnection.java:493)
  at org.jsoup.helper.HttpConnection.execute(HttpConnection.java:205)
  at org.jsoup.helper.HttpConnection.get(HttpConnection.java:194)

我是否还需要将我的 CA 密钥或客户端密钥添加到密钥库？

Answer 1

首先，我假设您已经按照以下说明创建了密钥： https://dev.mysql.com/doc/refman/5.6/en/creating-ssl-files-using-openssl.html

我假设您已使用以下说明正确配置了服务器： https://dev.mysql.com/doc/refman/5.6/en/using-encrypted-connections.html

（对于那些无法生成密钥的人，您可以使用 CYGWIN for windows，并将 OpenSSL 打包下载）

现在，专门为您服务：没有必要弄乱 java 密钥库中的 CACerts（不好的做法）。而是在 java 连接字符串的末尾使用以下参数：

https://dev.mysql.com/doc/connector-j/5.1/en/connector-j-reference-configuration-properties.html

...?useSSL=true&clientCertificateKeyStoreUrl=file://path_to_truststore_file&clientCertificateKeyStorePassword=mypassword

另外，请确保正确导入证书。经过大量研究，我自己遵循了这些说明（我按照说明的建议将它们导入了单独的密钥库）

https://dev.mysql.com/doc/connector-j/5.1/en/connector-j-reference-using-ssl.html

这让我建立了联系。我现在遇到了其他问题，但这应该可以解决您的问题。

编辑： 我还必须添加以下内容：

trustCertificateKeyStoreUrl=file://path_to_truststore_file&trustCertificateKeyStorePassword=mypassword