Apache HTTP 客户端服务器 TLS 实现：获取密钥库异常答案

【问题标题】：Apache HTTP Client Server TLS Implementation:getting Keystore ExceptionsApache HTTP 客户端服务器 TLS 实现：获取密钥库异常
【发布时间】：2015-04-06 08:20:20
【问题描述】：

服务器端：

我在已启用 HTTPS 协议的 Tomcat 上部署了安全的 RESTful 服务。
我使用keytool.创建了一个 Keystore serverkeystore 文件
从 serverkeystore 导出 servercertificate.cer。

客户端：

创建了客户端密钥库 clientkeystore.jsk
在clientkeystore.jsk中导入servercertificate.cer
从 clientkeystore.jsk 导出了 clientcertificate.cer。
在JAVA_HOME/lib/security下导入clientcertificate.cer

客户端代码中的异常：

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
... 30 more

代码：

private SSLConnectionSocketFactory buildSSLSocketFactory() throws Exception, UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException {
    KeyStore trustStore  = KeyStore.getInstance(KeyStore.getDefaultType());
    FileInputStream instream = new FileInputStream(new File("path to clientkeystore.jks"));
    try {
        trustStore.load(instream, "phhclient".toCharArray());
    } finally {
        instream.close();
    }
    // Trust own CA and all self-signed certs
    SSLContext sslcontext = SSLContexts.custom()
            .loadTrustMaterial(trustStore, new TrustSelfSignedStrategy())
            .build();
    // Allow TLSv1 protocol only
    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
            sslcontext,
            new String[] { "TLSv1" },
            null,
            SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);


    return sslsf;
}

无法找到请求目标的有效认证路径请让我知道为什么我会收到异常

感谢和问候，

拉胡尔·贾恩

【问题讨论】：

标签： java apache https apache-httpclient-4.x

【解决方案1】：

此异常的原因是代码无法在客户端的信任库中找到服务器证书。请检查服务器证书是否已添加到您的客户端信任库中。另外，TrustManagerFactory 没有在函数中实例化。

以下代码可用于构建 SSL 套接字工厂。请包括必要的导入声明：

SSLSocketFactory buildSSLSocketFactory() throws Exception {
    SSLContext sslcontext = null;

    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
    KeyStore trustks = KeyStore.getInstance("JKS");
    File trustcert = new File("path to truststore");
    InputStream truststream = new FileInputStream(trustcert);
    trustks.load(truststream, "password".toCharArray());
    truststream.close();
    tmf.init(trustks);

    try {
        sslcontext = SSLContext.getInstance("TLS");

        sslcontext.init(new KeyManager[0],
                 tmf.getTrustManagers() ,
                new SecureRandom());
    } catch (NoSuchAlgorithmException e) {  
        System.out.println("Exception  :"+e);       
    } catch (KeyManagementException e) {
        System.out.println("Exception  :"+e);   
    }

    SSLSocketFactory factory = sslcontext.getSocketFactory();

    return factory; 
}

【讨论】：