Java中的SSL握手

Question

我的Java客戶端需要訪問通過TLS連接提供服務的資源。資源提供者使用自籤密鑰，即MM_Base64.cer。我將他們的密鑰導入到Java密鑰庫和Java信任庫中。

密鑰庫，我發出

keytool -import -keystore D:\mptkeystore.jks -file D:\MM_Base64.cer -alias mpt

，其結果是

Enter keystore password: 
Re-enter new password: 
Owner: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN 
Issuer: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN 
Serial number: 55702f20 
Valid from: Thu Jun 04 17:27:36 MMT 2015 until: Sat May 11 17:27:36 MMT 2115 
Certificate fingerprints: 
     MD5: F5:8E:12:58:AC:97:53:CB:8B:B6:E2:DB:C3:F2:48:3D 
     SHA1: F2:09:23:4C:9A:30:A6:4C:2D:F8:B0:F4:1D:06:41:5C:3A:3E:16:5A 
     SHA256: 2B:51:BA:48:52:59:82:22:3C:E3:79:93:9E:C5:57:24:A5:9A:6E:08:A2: 
7A:C6:FD:02:60:EB:3C:F2:14:53:AB 
     Signature algorithm name: SHA1withRSA 
     Version: 3 
Trust this certificate? [no]: yes 
Certificate was added to keystore 

對於trusrstore，

keytool -import -file D:\MM_Base64.cer -alias mit -keystore D:\truststore.jks

結果：

Enter keystore password: 
Re-enter new password: 
Owner: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN 
Issuer: CN=client, OU=huawei, O=huawei, L=shenzhen, C=CN 
Serial number: 55702f20 
Valid from: Thu Jun 04 17:27:36 MMT 2015 until: Sat May 11 17:27:36 MMT 2115 
Certificate fingerprints: 
     MD5: F5:8E:12:58:AC:97:53:CB:8B:B6:E2:DB:C3:F2:48:3D 
     SHA1: F2:09:23:4C:9A:30:A6:4C:2D:F8:B0:F4:1D:06:41:5C:3A:3E:16:5A 
     SHA256: 2B:51:BA:48:52:59:82:22:3C:E3:79:93:9E:C5:57:24:A5:9A:6E:08:A2: 
7A:C6:FD:02:60:EB:3C:F2:14:53:AB 
     Signature algorithm name: SHA1withRSA 
     Version: 3 
Trust this certificate? [no]: yes 
Certificate was added to keystore 

看起來多餘，但以防萬一，冗餘是必要的。

這是該計劃得到執行方式：

java -jar CPS.jar -Djavax.net.ssl.trustStore=D:\truststore.jks -Djavax.net.ssl.trustStorePassword=password -Djavax.net.ssl.keyStore=D:\mptkeystore.jks -Djavax.net.ssl.keyStorePassword=password -Ddeployment.security.SSLv2Hello=false -Ddeployment.security.SSLv3=false -Ddeployment.security.TLSv1=false -Ddeployment.security.TLSv1.1=true -Ddeployment.security.TLSv1.2=true 

TLS V1不能與服務一起使用，所以我禁用它。

看起來握手錯誤仍然存​​在。有沒有人看到我做事情的方式有問題？

Answer 1

用於添加到信任庫中，我認爲你需要添加

-trustcacerts

https://docs.oracle.com/cd/E19830-01/819-4712/ablqw/index.html有例子 -

keytool -import -v -trustcacerts 
-alias keyAlias 
-file server.cer 
-keystore cacerts.jks 
-keypass changeit 
-storepass changeit