HttpClient를 사용하는 x509 인증서를 사용한 상호 인증 4.0.1

Question

HTTPClient 4.0.1을 사용하는 x509 인증서를 통해 클라이언트 인증을 수행하는 방법에 대한 조언이 있습니까?

감사합니다.

Answer 1

다음은 몇 가지 코드입니다. KeyStore은 클라이언트 인증서가 들어있는 개체입니다. 서버가 자체 서명 된 인증서 또는 포함 된 cacerts 파일의 JVM에서 인식 한대로 CA가 서명하지 않은 인증서를 사용하는 경우 TrustStore을 사용해야합니다. 그렇지 않으면 기본 cacerts 파일을 사용하는 .. 트러스트 스토어 인수 SSLSockeFactory에 null에

import org.apache.http.conn.scheme.Scheme; 
import org.apache.http.conn.scheme.SchemeRegistry; 
import org.apache.http.conn.ssl.SSLSocketFactory; 
import org.apache.http.impl.client.DefaultHttpClient; 
import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager; 
import org.apache.http.params.BasicHttpParams; 
import org.apache.http.params.HttpParams; 

... 

final HttpParams httpParams = new BasicHttpParams(); 

// load the keystore containing the client certificate - keystore type is probably jks or pkcs12 
final KeyStore keystore = KeyStore.getInstance("pkcs12"); 
InputStream keystoreInput = null; 
// TODO get the keystore as an InputStream from somewhere 
keystore.load(keystoreInput, "keystorepassword".toCharArray()); 

// load the trustore, leave it null to rely on cacerts distributed with the JVM - truststore type is probably jks or pkcs12 
KeyStore truststore = KeyStore.getInstance("pkcs12"); 
InputStream truststoreInput = null; 
// TODO get the trustore as an InputStream from somewhere 
truststore.load(truststoreInput, "truststorepassword".toCharArray()); 

final SchemeRegistry schemeRegistry = new SchemeRegistry(); 
schemeRegistry.register(new Scheme("https", new SSLSocketFactory(keystore, keystorePassword, truststore), 443)); 

final DefaultHttpClient httpClient = new DefaultHttpClient(new ThreadSafeClientConnManager(httpParams, schemeRegistry), httpParams); 

Answer 2

(또 다른 예에서 복사) 또 다른 해결책을 전달합니다. 저는 'trusting'(trustStore)과 자신을 인증 (keyStore)하기 위해 동일한 키 스토어를 사용했습니다.

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); 
FileInputStream instream = new FileInputStream(new File("miller.keystore")); 
try { 
    trustStore.load(instream, "pw".toCharArray()); 
} finally { 
    instream.close(); 
} 

SSLContext sslcontext = SSLContexts.custom() 
     .loadTrustMaterial(trustStore) /* this key store must contain the certs needed & trusted to verify the servers cert */ 
     .loadKeyMaterial(trustStore, "pw".toCharArray()) /* this keystore must contain the key/cert of the client */ 
     .build(); 

SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext, 
     SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER); 
CloseableHttpClient httpclient = HttpClients.custom() 
     .setSSLSocketFactory(sslsf) 
     .build(); 
try { 

    HttpGet httpget = new HttpGet("https://localhost"); 

    System.out.println("executing request" + httpget.getRequestLine()); 

    CloseableHttpResponse response = httpclient.execute(httpget); 
    try { 
     HttpEntity entity = response.getEntity(); 

     System.out.println("----------------------------------------"); 
     System.out.println(response.getStatusLine()); 
     if (entity != null) { 
      System.out.println("Response content length: " + entity.getContentLength()); 
     } 
     EntityUtils.consume(entity); 
    } finally { 
     response.close(); 
    } 
} finally { 
    httpclient.close(); 
} 

Answer 3

HttpClient의 웹 사이트 (정확하게 기억하는 경우 사용자 지정 SSL 컨텍스트)의 샘플 코드에서 다음을 사용했습니다.

{ 
    KeyStore keyStore = KeyStore.getInstance("PKCS12"); //client certificate holder 
    FileInputStream instream = new FileInputStream(new File(
      "client-p12-keystore.p12")); 
    try { 
     trustStore.load(instream, "password".toCharArray()); 
    } finally { 
     instream.close(); 
    } 

    // Trust own CA and all self-signed certs 
    SSLContext sslcontext = SSLContexts.custom() 
      .loadKeyMaterial(keyStore, "password".toCharArray()) 
      // .loadTrustMaterial(trustStore, new TrustSelfSignedStrategy()) //if you have a trust store 
      .build(); 
    // Allow TLSv1 protocol only 
    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
      sslcontext, new String[] { "TLSv1" }, null, 
      SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
    CloseableHttpClient httpclient = HttpClients 
      .custom() 
      .setHostnameVerifier(
        SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER) //todo 
      .setSSLSocketFactory(sslsf).build(); 
    try { 

     HttpGet httpget = new HttpGet("https://localhost:8443/secure/index"); 

     System.out.println("executing request" + httpget.getRequestLine()); 

     CloseableHttpResponse response = httpclient.execute(httpget); 
     try { 
      HttpEntity entity = response.getEntity(); 

      System.out.println("----------------------------------------"); 
      System.out.println(response.getStatusLine()); 
      if (entity != null) { 
       System.out.println("Response content length: " 
         + entity.getContentLength()); 
      } 
      EntityUtils.consume(entity); 
     } finally { 
      response.close(); 
     } 
    } finally { 
     httpclient.close(); 
    } 
}