如何忽略定製JMX客戶端中的SSL證書

我想編寫定製的JMX客戶端。客戶端連接到我信任的服務器。我絕對不想使用keytool導入密鑰。在與SsLHandshakeException建立連接時失敗。如何忽略定製JMX客戶端中的SSL證書

String username = "admin"; 
String password = "admin"; 
String[] credentials = new String[] { username, password }; 
Map<String, Object> env = new HashMap<>(); 
env.put(JMXConnector.CREDENTIALS, credentials); 
// Only required for SSL Connections 
env.put("com.sun.jndi.rmi.factory.socket", new SslRMIClientSocketFactory()); 
// MBeanServer mbs = ManagementFactory.getPlatformMBeanServer(); 
JMXServiceURL url = new JMXServiceURL("service:jmx:rmi:///jndi/rmi://trustedhost:10010/jmxrmi"); 
JMXConnector jmxc = JMXConnectorFactory.connect(url, env);

例外，我得到：

Exception in thread "main" java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.CommunicationException [Root exception is java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is: 
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake] 
    at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:369) 
    at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270) 
    at my.monitor.TestMbean.main(TestMbean.java:32) 
Caused by: javax.naming.CommunicationException [Root exception is java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is: 
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake] 
    at com.sun.jndi.rmi.registry.RegistryContext.lookup(RegistryContext.java:122) 
    at com.sun.jndi.toolkit.url.GenericURLContext.lookup(GenericURLContext.java:205) 
    at javax.naming.InitialContext.lookup(InitialContext.java:417) 
    at javax.management.remote.rmi.RMIConnector.findRMIServerJNDI(RMIConnector.java:1957) 
    at javax.management.remote.rmi.RMIConnector.findRMIServer(RMIConnector.java:1924) 
    at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:287) 
    ... 2 more 
Caused by: java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is: 
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake 
    at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:304) 
    at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:202) 
    at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:342) 
    at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source) 
    at com.sun.jndi.rmi.registry.RegistryContext.lookup(RegistryContext.java:118) 
    ... 7 more 
Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake 
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:980) 
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1363) 
    at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:735) 
    at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) 
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) 
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) 
    at java.io.DataOutputStream.flush(DataOutputStream.java:123) 
    at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:229) 
    ... 11 more 
Caused by: java.io.EOFException: SSL peer shut down incorrectly 
    at sun.security.ssl.InputRecord.read(InputRecord.java:505) 
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:961) 
    ... 18 more

來源

2015-04-17 bastian

我不知道有辦法破解SSL安全的Java要求，但我認爲你應該重新考慮「我絕對不希望自己的立場使用keytool導入密鑰。「問題不在於您是否信任服務器。重要的問題是：

你想明文通信與服務器。有多少人可以聽到這個？如果你的客戶在本地網絡中運行，那麼只有同一公司的每個人都能夠監視你。如果你離開受保護的網絡，未知數量的人會突然看到你在做什麼。
如果您在客戶端禁用SSL，服務器應該如何確保命令來自您？沒有SSL，有人可能會劫持您的通信並控制服務器。
沒有SSL，密碼將作爲純文本傳輸。 A TV station recently found具有後它的密碼注意到牆上，而接受採訪是不是在2015年

明智之舉所以正確的問題應該是：我如何設置SSL正確，以確保JMX？請參閱http://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html搜索「使用SSL」

來源

2015-04-17 14:56:04

由於之前。我相信，因爲我希望我公司的網絡管理員能夠很好地將我們網絡中的惡人排除在外。我沒有監控生產系統。我面臨的問題是密鑰是由開發系統上的每個部署生成的。我將不得不爲每個監測活動導入密鑰，而每次監測活動都需要每天進行數次。無論如何，我會檢查保持證書穩定的可能性。 – bastian

順便說一句：我不會「接受」你的答案，但給你+1 :) – bastian

所以你連接到開發系統？您是否嘗試使用'-Dcom.sun.management.jmxremote.ssl = false'在服務器上禁用SSL？ –

客戶端連接到我信任的服務器。

你怎麼知道的？證書驗證的全部目的是確保您實際連接到您想要的服務器而不是某個中間人。

來源

2015-04-17 14:56:18

嘗試把這個代碼

TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() { 
    public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
     return null; 
    } 

    public void checkClientTrusted(X509Certificate[] certs, String authType) { 
    } 

    public void checkServerTrusted(X509Certificate[] certs, String authType) { 
    } 
} 
}; 

try { 
    logger.info("Hacking SSL Validation"); 
    SSLContext sc = SSLContext.getInstance("SSL"); 
    sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
    SSLContext.setDefault(sc); 
    logger.info("SSL Validation hacked"); 
} catch (Exception e) { 
    throw new RuntimeException(e); 
}

來源

2016-02-11 15:26:28 pranahata

如何忽略定製JMX客戶端中的SSL證書

回答

相關問題