如何在不重启 JVM 的情况下重新加载证书文件？

最新推荐文章于 2023-05-19 10:51:43 发布

Defonds

最新推荐文章于 2023-05-19 10:51:43 发布

阅读量3.1k

点赞数

CC 4.0 BY-SA版权

文章标签：证书重启JVM加载证书不重启JVM加载证书 SSL证书 X509TrustManager

本文链接：https://blog.youkuaiyun.com/defonds/article/details/83061232

当需要在运行时动态加载SSL证书以避免ValidatorException时，可以避免重启JVM。常见方法包括调用特定方法加载证书文件，或实现X509TrustManager接口。但直接忽略证书校验会降低安全性，应确保进行至少的基础校验，如服务器端验证和域名匹配。

某种情况下需要动态下载证书文件后使用 SSL 访问某服务，但由于 JVM 使用默认的证书访问新服务，该证书在 JVM 启动的时候加载，那时还没有新服务的证书，所以会报 ValidatorException，详情：

16:44:27,338 ERROR [HttpModelLoader] sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.ssl.Alerts.getSSLException(Unknown Source) at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.Handshaker.fatalSE(Unknown Source) at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) at sun.security.ssl.Handshaker.processLoop(Unknown Source) at sun.security.ssl.Handshaker.process_record(Unknown Source) at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353) at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:141) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353) at org.apache.http.impl.execchain.Main