Java加密技术（九）——初探SSL

最新推荐文章于 2025-11-30 18:24:05 发布

最新推荐文章于 2025-11-30 18:24:05 发布 · 139 阅读

文章标签：

本文深入探讨了基于RSA非对称加密网络的安全通信原理，并指导如何构建有效证书，导入至密钥库，配置Tomcat以实现SSL双向认证。通过实践案例，展示了证书组件的实现与HTTPS访问的简化过程。

在 Java加密技术（八）中，我们模拟了一个基于RSA非对称加密网络的安全通信。现在我们深度了解一下现有的安全网络通信——SSL。
我们需要构建一个由CA机构签发的有效证书，这里我们使用上文中生成的自签名证书 zlex.cer
这里，我们将证书导入到我们的密钥库。

    Shell代码
     
 keytool-import-aliaswww.zlex.org-filed:/zlex.cer-keystored:/zlex.keystore

其中
-import表示导入
-alias指定别名，这里是 www.zlex.org
-file指定算法，这里是 d:/zlex.cer
-keystore指定存储位置，这里是 d:/zlex.keystore
在这里我使用的密码为 654321

控制台输出：

    Console代码
     
   
 输入keystore密码： 
 再次输入新密码: 
 所有者:CN=www.zlex.org,OU=zlex,O=zlex,L=BJ,ST=BJ,C=CN 
 签发人:CN=www.zlex.org,OU=zlex,O=zlex,L=BJ,ST=BJ,C=CN 
 序列号:4a1e48df 
 有效期:ThuMay2816:18:39CST2009至WedAug2616:18:39CST2009 
 证书指纹: 
 MD5:19:CA:E6:36:E2:DF:AD:96:31:97:2F:A9:AD:FC:37:6A 
 SHA1:49:88:30:59:29:45:F1:69:CA:97:A9:6D:8A:CF:08:D2:C3:D5:C0:C4 
 签名算法名称:SHA1withRSA 
 版本:3 
 信任这个认证？[否]：y 
 认证已添加至keystore中 

OK，最复杂的准备工作已经完成。
接下来我们将域名 www.zlex.org定位到本机上。打开 C:\Windows\System32\drivers\etc\hosts文件，将 www.zlex.org绑定在本机上。在文件末尾追加 127.0.0.1 www.zlex.org。现在通过地址栏访问 http://www.zlex.org，或者通过 ping命令，如果能够定位到本机，域名映射就搞定了。
现在，配置tomcat。先将 zlex.keystore拷贝到tomcat的conf目录下，然后配置 server.xml。将如下内容加入配置文件

    Xml代码
     
   
 <Connector 
 SSLEnabled="true" 
 URIEncoding="UTF-8" 
 clientAuth="false" 
 keystoreFile="conf/zlex.keystore" 
 keystorePass="123456" 
 maxThreads="150" 
 port="443" 
 protocol="HTTP/1.1" 
 scheme="https" 
 secure="true" 
 sslProtocol="TLS"/> 

注意 clientAuth="false"测试阶段，置为 false，正式使用时建议使用 true。现在启动tomcat，访问 https://www.zlex.org/。

显然，证书未能通过认证，这个时候你可以选择安装证书（上文中的 zlex.cer文件就是证书），作为 受信任的根证书颁发机构导入，再次重启浏览器（IE，其他浏览器对于域名www.zlex.org不支持本地方式访问），访问 https://www.zlex.org/，你会看到地址栏中会有个小锁

，就说明安装成功。所有的浏览器联网操作已经在RSA加密解密系统的保护之下了。但似乎我们感受不到。
这个时候很多人开始怀疑，如果我们要手工做一个这样的https的访问是不是需要把浏览器的这些个功能都实现呢？不需要！

接着上篇内容，给出如下代码实现：

    Java代码
     
   
 importjava.io.FileInputStream; 
 importjava.security.KeyStore; 
 importjava.security.PrivateKey; 
 importjava.security.PublicKey; 
 importjava.security.Signature; 
 importjava.security.cert.Certificate; 
 importjava.security.cert.CertificateFactory; 
 importjava.security.cert.X509Certificate; 
 importjava.util.Date; 
  
 importjavax.crypto.Cipher; 
 importjavax.net.ssl.HttpsURLConnection; 
 importjavax.net.ssl.KeyManagerFactory; 
 importjavax.net.ssl.SSLContext; 
 importjavax.net.ssl.SSLSocketFactory; 
 importjavax.net.ssl.TrustManagerFactory; 
  
 /** 
 *证书组件 
 * 
 *@author梁栋 
 *@version1.0 
 *@since1.0 
 */ 
 publicabstractclassCertificateCoderextendsCoder{ 
  
 /** 
 *Java密钥库(JavaKeyStore，JKS)KEY_STORE 
 */ 
 publicstaticfinalStringKEY_STORE="JKS"; 
  
 publicstaticfinalStringX509="X.509"; 
 publicstaticfinalStringSunX509="SunX509"; 
 publicstaticfinalStringSSL="SSL"; 
  
 /** 
 *由KeyStore获得私钥 
 * 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 *@return 
 *@throwsException 
 */ 
 privatestaticPrivateKeygetPrivateKey(StringkeyStorePath,Stringalias, 
 Stringpassword)throwsException{ 
 KeyStoreks=getKeyStore(keyStorePath,password); 
 PrivateKeykey=(PrivateKey)ks.getKey(alias,password.toCharArray()); 
 returnkey; 
 } 
  
 /** 
 *由Certificate获得公钥 
 * 
 *@paramcertificatePath 
 *@return 
 *@throwsException 
 */ 
 privatestaticPublicKeygetPublicKey(StringcertificatePath) 
 throwsException{ 
 Certificatecertificate=getCertificate(certificatePath); 
 PublicKeykey=certificate.getPublicKey(); 
 returnkey; 
 } 
  
 /** 
 *获得Certificate 
 * 
 *@paramcertificatePath 
 *@return 
 *@throwsException 
 */ 
 privatestaticCertificategetCertificate(StringcertificatePath) 
 throwsException{ 
 CertificateFactorycertificateFactory=CertificateFactory 
 .getInstance(X509); 
 FileInputStreamin=newFileInputStream(certificatePath); 
  
 Certificatecertificate=certificateFactory.generateCertificate(in); 
 in.close(); 
  
 returncertificate; 
 } 
  
 /** 
 *获得Certificate 
 * 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 *@return 
 *@throwsException 
 */ 
 privatestaticCertificategetCertificate(StringkeyStorePath, 
 Stringalias,Stringpassword)throwsException{ 
 KeyStoreks=getKeyStore(keyStorePath,password); 
 Certificatecertificate=ks.getCertificate(alias); 
  
 returncertificate; 
 } 
  
 /** 
 *获得KeyStore 
 * 
 *@paramkeyStorePath 
 *@parampassword 
 *@return 
 *@throwsException 
 */ 
 privatestaticKeyStoregetKeyStore(StringkeyStorePath,Stringpassword) 
 throwsException{ 
 FileInputStreamis=newFileInputStream(keyStorePath); 
 KeyStoreks=KeyStore.getInstance(KEY_STORE); 
 ks.load(is,password.toCharArray()); 
 is.close(); 
 returnks; 
 } 
  
 /** 
 *私钥加密 
 * 
 *@paramdata 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 *@return 
 *@throwsException 
 */ 
 publicstaticbyte[]encryptByPrivateKey(byte[]data,StringkeyStorePath, 
 Stringalias,Stringpassword)throwsException{ 
 //取得私钥 
 PrivateKeyprivateKey=getPrivateKey(keyStorePath,alias,password); 
  
 //对数据加密 
 Ciphercipher=Cipher.getInstance(privateKey.getAlgorithm()); 
 cipher.init(Cipher.ENCRYPT_MODE,privateKey); 
  
 returncipher.doFinal(data); 
  
 } 
  
 /** 
 *私钥解密 
 * 
 *@paramdata 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 *@return 
 *@throwsException 
 */ 
 publicstaticbyte[]decryptByPrivateKey(byte[]data,StringkeyStorePath, 
 Stringalias,Stringpassword)throwsException{ 
 //取得私钥 
 PrivateKeyprivateKey=getPrivateKey(keyStorePath,alias,password); 
  
 //对数据加密 
 Ciphercipher=Cipher.getInstance(privateKey.getAlgorithm()); 
 cipher.init(Cipher.DECRYPT_MODE,privateKey); 
  
 returncipher.doFinal(data); 
  
 } 
  
 /** 
 *公钥加密 
 * 
 *@paramdata 
 *@paramcertificatePath 
 *@return 
 *@throwsException 
 */ 
 publicstaticbyte[]encryptByPublicKey(byte[]data,StringcertificatePath) 
 throwsException{ 
  
 //取得公钥 
 PublicKeypublicKey=getPublicKey(certificatePath); 
 //对数据加密 
 Ciphercipher=Cipher.getInstance(publicKey.getAlgorithm()); 
 cipher.init(Cipher.ENCRYPT_MODE,publicKey); 
  
 returncipher.doFinal(data); 
  
 } 
  
 /** 
 *公钥解密 
 * 
 *@paramdata 
 *@paramcertificatePath 
 *@return 
 *@throwsException 
 */ 
 publicstaticbyte[]decryptByPublicKey(byte[]data,StringcertificatePath) 
 throwsException{ 
 //取得公钥 
 PublicKeypublicKey=getPublicKey(certificatePath); 
  
 //对数据加密 
 Ciphercipher=Cipher.getInstance(publicKey.getAlgorithm()); 
 cipher.init(Cipher.DECRYPT_MODE,publicKey); 
  
 returncipher.doFinal(data); 
  
 } 
  
 /** 
 *验证Certificate 
 * 
 *@paramcertificatePath 
 *@return 
 */ 
 publicstaticbooleanverifyCertificate(StringcertificatePath){ 
 returnverifyCertificate(newDate(),certificatePath); 
 } 
  
 /** 
 *验证Certificate是否过期或无效 
 * 
 *@paramdate 
 *@paramcertificatePath 
 *@return 
 */ 
 publicstaticbooleanverifyCertificate(Datedate,StringcertificatePath){ 
 booleanstatus=true; 
 try{ 
 //取得证书 
 Certificatecertificate=getCertificate(certificatePath); 
 //验证证书是否过期或无效 
 status=verifyCertificate(date,certificate); 
 }catch(Exceptione){ 
 status=false; 
 } 
 returnstatus; 
 } 
  
 /** 
 *验证证书是否过期或无效 
 * 
 *@paramdate 
 *@paramcertificate 
 *@return 
 */ 
 privatestaticbooleanverifyCertificate(Datedate,Certificatecertificate){ 
 booleanstatus=true; 
 try{ 
 X509Certificatex509Certificate=(X509Certificate)certificate; 
 x509Certificate.checkValidity(date); 
 }catch(Exceptione){ 
 status=false; 
 } 
 returnstatus; 
 } 
  
 /** 
 *签名 
 * 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 * 
 *@return 
 *@throwsException 
 */ 
 publicstaticStringsign(byte[]sign,StringkeyStorePath,Stringalias, 
 Stringpassword)throwsException{ 
 //获得证书 
 X509Certificatex509Certificate=(X509Certificate)getCertificate( 
 keyStorePath,alias,password); 
 //获取私钥 
 KeyStoreks=getKeyStore(keyStorePath,password); 
 //取得私钥 
 PrivateKeyprivateKey=(PrivateKey)ks.getKey(alias,password 
 .toCharArray()); 
  
 //构建签名 
 Signaturesignature=Signature.getInstance(x509Certificate 
 .getSigAlgName()); 
 signature.initSign(privateKey); 
 signature.update(sign); 
 returnencryptBASE64(signature.sign()); 
 } 
  
 /** 
 *验证签名 
 * 
 *@paramdata 
 *@paramsign 
 *@paramcertificatePath 
 *@return 
 *@throwsException 
 */ 
 publicstaticbooleanverify(byte[]data,Stringsign, 
 StringcertificatePath)throwsException{ 
 //获得证书 
 X509Certificatex509Certificate=(X509Certificate)getCertificate(certificatePath); 
 //获得公钥 
 PublicKeypublicKey=x509Certificate.getPublicKey(); 
 //构建签名 
 Signaturesignature=Signature.getInstance(x509Certificate 
 .getSigAlgName()); 
 signature.initVerify(publicKey); 
 signature.update(data); 
  
 returnsignature.verify(decryptBASE64(sign)); 
  
 } 
  
 /** 
 *验证Certificate 
 * 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 *@return 
 */ 
 publicstaticbooleanverifyCertificate(Datedate,StringkeyStorePath, 
 Stringalias,Stringpassword){ 
 booleanstatus=true; 
 try{ 
 Certificatecertificate=getCertificate(keyStorePath,alias, 
 password); 
 status=verifyCertificate(date,certificate); 
 }catch(Exceptione){ 
 status=false; 
 } 
 returnstatus; 
 } 
  
 /** 
 *验证Certificate 
 * 
 *@paramkeyStorePath 
 *@paramalias 
 *@parampassword 
 *@return 
 */ 
 publicstaticbooleanverifyCertificate(StringkeyStorePath,Stringalias, 
 Stringpassword){ 
 returnverifyCertificate(newDate(),keyStorePath,alias,password); 
 } 
  
 /** 
 *获得SSLSocektFactory 
 * 
 *@parampassword 
 *密码 
 *@paramkeyStorePath 
 *密钥库路径 
 * 
 *@paramtrustKeyStorePath 
 *信任库路径 
 *@return 
 *@throwsException 
 */ 
 privatestaticSSLSocketFactorygetSSLSocketFactory(Stringpassword, 
 StringkeyStorePath,StringtrustKeyStorePath)throwsException{ 
 //初始化密钥库 
 KeyManagerFactorykeyManagerFactory=KeyManagerFactory 
 .getInstance(SunX509); 
 KeyStorekeyStore=getKeyStore(keyStorePath,password); 
 keyManagerFactory.init(keyStore,password.toCharArray()); 
  
 //初始化信任库 
 TrustManagerFactorytrustManagerFactory=TrustManagerFactory 
 .getInstance(SunX509); 
 KeyStoretrustkeyStore=getKeyStore(trustKeyStorePath,password); 
 trustManagerFactory.init(trustkeyStore); 
  
 //初始化SSL上下文 
 SSLContextctx=SSLContext.getInstance(SSL); 
 ctx.init(keyManagerFactory.getKeyManagers(),trustManagerFactory 
 .getTrustManagers(),null); 
 SSLSocketFactorysf=ctx.getSocketFactory(); 
  
 returnsf; 
 } 
  
 /** 
 *为HttpsURLConnection配置SSLSocketFactory 
 * 
 *@paramconn 
 *HttpsURLConnection 
 *@parampassword 
 *密码 
 *@paramkeyStorePath 
 *密钥库路径 
 * 
 *@paramtrustKeyStorePath 
 *信任库路径 
 *@throwsException 
 */ 
 publicstaticvoidconfigSSLSocketFactory(HttpsURLConnectionconn, 
 Stringpassword,StringkeyStorePath,StringtrustKeyStorePath) 
 throwsException{ 
 conn.setSSLSocketFactory(getSSLSocketFactory(password,keyStorePath, 
 trustKeyStorePath)); 
 } 
 } 

增加了 configSSLSocketFactory方法供外界调用，该方法为HttpsURLConnection配置了SSLSocketFactory。当HttpsURLConnection配置了SSLSocketFactory后，我们就可以通过HttpsURLConnection的getInputStream、getOutputStream，像往常使用HttpURLConnection做操作了。尤其要说明一点，未配置SSLSocketFactory前，HttpsURLConnection的getContentLength()获得值永远都是 -1。

给出相应测试类：

    Java代码
     
   
 importstaticorg.junit.Assert.*; 
  
 importjava.io.DataInputStream; 
 importjava.io.InputStream; 
 importjava.net.URL; 
  
 importjavax.net.ssl.HttpsURLConnection; 
  
 importorg.junit.Test; 
  
 /** 
 * 
 *@author梁栋 
 *@version1.0 
 *@since1.0 
 */ 
 publicclassCertificateCoderTest{ 
 privateStringpassword="123456"; 
 privateStringalias="www.zlex.org"; 
 privateStringcertificatePath="d:/zlex.cer"; 
 privateStringkeyStorePath="d:/zlex.keystore"; 
 privateStringclientKeyStorePath="d:/zlex-client.keystore"; 
 privateStringclientPassword="654321"; 
  
 @Test 
 publicvoidtest()throwsException{ 
 System.err.println("公钥加密——私钥解密"); 
 StringinputStr="Ceritifcate"; 
 byte[]data=inputStr.getBytes(); 
  
 byte[]encrypt=CertificateCoder.encryptByPublicKey(data, 
 certificatePath); 
  
 byte[]decrypt=CertificateCoder.decryptByPrivateKey(encrypt, 
 keyStorePath,alias,password); 
 StringoutputStr=newString(decrypt); 
  
 System.err.println("加密前:"+inputStr+"\n\r"+"解密后:"+outputStr); 
  
 //验证数据一致 
 assertArrayEquals(data,decrypt); 
  
 //验证证书有效 
 assertTrue(CertificateCoder.verifyCertificate(certificatePath)); 
  
 } 
  
 @Test 
 publicvoidtestSign()throwsException{ 
 System.err.println("私钥加密——公钥解密"); 
  
 StringinputStr="sign"; 
 byte[]data=inputStr.getBytes(); 
  
 byte[]encodedData=CertificateCoder.encryptByPrivateKey(data, 
 keyStorePath,alias,password); 
  
 byte[]decodedData=CertificateCoder.decryptByPublicKey(encodedData, 
 certificatePath); 
  
 StringoutputStr=newString(decodedData); 
 System.err.println("加密前:"+inputStr+"\n\r"+"解密后:"+outputStr); 
 assertEquals(inputStr,outputStr); 
  
 System.err.println("私钥签名——公钥验证签名"); 
 //产生签名 
 Stringsign=CertificateCoder.sign(encodedData,keyStorePath,alias, 
 password); 
 System.err.println("签名:\r"+sign); 
  
 //验证签名 
 booleanstatus=CertificateCoder.verify(encodedData,sign, 
 certificatePath); 
 System.err.println("状态:\r"+status); 
 assertTrue(status); 
  
 } 
  
 @Test 
 publicvoidtestHttps()throwsException{ 
 URLurl=newURL("https://www.zlex.org/examples/"); 
 HttpsURLConnectionconn=(HttpsURLConnection)url.openConnection(); 
  
 conn.setDoInput(true); 
 conn.setDoOutput(true); 
  
 CertificateCoder.configSSLSocketFactory(conn,clientPassword, 
 clientKeyStorePath,clientKeyStorePath); 
  
 InputStreamis=conn.getInputStream(); 
  
 intlength=conn.getContentLength(); 
  
 DataInputStreamdis=newDataInputStream(is); 
 byte[]data=newbyte[length]; 
 dis.readFully(data); 
  
 dis.close(); 
 System.err.println(newString(data)); 
 conn.disconnect(); 
 } 
 } 

注意 testHttps方法，几乎和我们往常做HTTP访问没有差别，我们来看控制台输出：

    Console代码
     
   
 <!-- 
 LicensedtotheApacheSoftwareFoundation(ASF)underoneormore 
 contributorlicenseagreements.SeetheNOTICEfiledistributedwith 
 thisworkforadditionalinformationregardingcopyrightownership. 
 TheASFlicensesthisfiletoYouundertheApacheLicense,Version2.0 
 (the"License");youmaynotusethisfileexceptincompliancewith 
 theLicense.YoumayobtainacopyoftheLicenseat 
  
 http://www.apache.org/licenses/LICENSE-2.0 
  
 Unlessrequiredbyapplicablelaworagreedtoinwriting,software 
 distributedundertheLicenseisdistributedonan"ASIS"BASIS, 
 WITHOUTWARRANTIESORCONDITIONSOFANYKIND,eitherexpressorimplied. 
 SeetheLicenseforthespecificlanguagegoverningpermissionsand 
 limitationsundertheLicense. 
 --> 
 <!DOCTYPEHTMLPUBLIC"-//W3C//DTDHTML4.0Transitional//EN"> 
 <HTML><HEAD><TITLE>ApacheTomcatExamples</TITLE> 
 <METAhttp-equiv=Content-Typecontent="text/html"> 
 </HEAD> 
 <BODY> 
 <P> 
 <H3>ApacheTomcatExamples</H3> 
 <P></P> 
 <ul> 
 <li><ahref="servlets">Servletsexamples</a></li> 
 <li><ahref="jsp">JSPExamples</a></li> 
 </ul> 
 </BODY></HTML> 

通过浏览器直接访问 https://www.zlex.org/examples/你也会获得上述内容。也就是说应用甲方作为服务器构建tomcat服务，乙方可以通过上述方式访问甲方受保护的SSL应用，并且不需要考虑具体的加密解密问题。甲乙双方可以经过相应配置，通过双方的tomcat配置有效的SSL服务，简化上述代码实现，完全通过证书配置完成SSL双向认证！