通過HTTPS進行REST風格的Web服務

我已通過讓我們的加密擴展在Plesk中爲我的域安裝了SSL證書。 HTTPS的默認端口是。它工作正常。通過HTTPS進行REST風格的Web服務

現在我想在Tomcat 7安裝證書，我跟着這個答案https://community.letsencrypt.org/t/how-to-use-the-certificate-for-tomcat/3677/2創建JKS密鑰庫（從Plesk中使用的相同咱們加密證書）和端口不同的端口上配置Tomcat的連接器。當我在瀏覽器（https://mywebsite.com:445）上打開tomcat頁面時，該頁面是安全的。

問題是，當我嘗試用下面的Java客戶端

public static void main(String[] args) { 

    try { 

    URL url = new URL("https://mywebsite.com:445"); 
    HttpsURLConnection conn = (HttpsURLConnection) url.openConnection(); 
    conn.setRequestMethod("GET"); 
    conn.setRequestProperty("Accept", "text/plain"); 

    if (conn.getResponseCode() != 200) { 
     throw new RuntimeException("Failed : HTTP error code : " 
       + conn.getResponseCode()); 
    } 

    BufferedReader br = new BufferedReader(new InputStreamReader(
     (conn.getInputStream()))); 

    String output; 
    System.out.println("Output from Server .... \n"); 
    while ((output = br.readLine()) != null) { 
     System.out.println(output); 
    } 

    conn.disconnect(); 

    } catch (MalformedURLException e) { 

    e.printStackTrace(); 

    } catch (IOException e) { 

    e.printStackTrace(); 

    } 

}

結果是一個例外，連接到它（但如果我嘗試（https://mywebsite.com:443）它的工作原理）

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.ssl.Alerts.getSSLException(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) 
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source) 
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) 
    at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) 
    at sun.security.ssl.Handshaker.processLoop(Unknown Source) 
    at sun.security.ssl.Handshaker.process_record(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) 
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source) 
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) 
    at java.net.HttpURLConnection.getResponseCode(Unknown Source) 
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source) 
    at main.NetClient.print_https_cert(NetClient.java:98) 
    at main.NetClient.testIt(NetClient.java:79) 
    at main.NetClient.main(NetClient.java:66) 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.validator.PKIXValidator.doBuild(Unknown Source) 
    at sun.security.validator.PKIXValidator.engineValidate(Unknown Source) 
    at sun.security.validator.Validator.validate(Unknown Source) 
    at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source) 
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) 
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) 
    ... 17 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) 
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) 
    at java.security.cert.CertPathBuilder.build(Unknown Source) 
    ... 23 more 
****** Content of the URL ******** 
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) 
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) 
    at java.lang.reflect.Constructor.newInstance(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source) 
    at java.security.AccessController.doPrivileged(Native Method) 
    at sun.net.www.protocol.http.HttpURLConnection.getChainedException(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) 
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source) 
    at main.NetClient.print_content(NetClient.java:131) 
    at main.NetClient.testIt(NetClient.java:82) 
    at main.NetClient.main(NetClient.java:66) 
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.ssl.Alerts.getSSLException(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) 
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source) 
    at sun.security.ssl.Handshaker.fatalSE(Unknown Source) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) 
    at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source) 
    at sun.security.ssl.Handshaker.processLoop(Unknown Source) 
    at sun.security.ssl.Handshaker.process_record(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source) 
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source) 
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source) 
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) 
    at java.net.HttpURLConnection.getResponseCode(Unknown Source) 
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source) 
    at main.NetClient.print_https_cert(NetClient.java:98) 
    at main.NetClient.testIt(NetClient.java:79) 
    ... 1 more 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.validator.PKIXValidator.doBuild(Unknown Source) 
    at sun.security.validator.PKIXValidator.engineValidate(Unknown Source) 
    at sun.security.validator.Validator.validate(Unknown Source) 
    at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source) 
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) 
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) 
    ... 17 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) 
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) 
    at java.security.cert.CertPathBuilder.build(Unknown Source) 
    ... 23 more

我需要通過HTTPS訪問我的RESTful Web服務的資源。請幫幫我。在此先感謝。

來源

2017-10-19 Pasquale Pio Pazienza

備份您的CACERT從JAVA_HOME：

$cp $JAVA_HOME/jre/lib/security/cacerts $JAVA_HOME/jre/lib/security/jssecacerts

然後從服務中導入證書。

$keytool -import -trustcacerts -keystore $JAVA_HOME/jre/lib/security/jssecacerts -storepass 
changeit -noprompt -alias {cert alias} -file {cert file}

然後重新啓動您的應用程序。

來源

2017-10-19 18:43:10 AndresMontj

非常感謝......它的作品......最後一個問題：如果我想使用另一種類型的客戶端（如Android，IOS，智能設備），我應該先導入我的服務證書嗎？ –

是的，我認爲SSL證書是一個自簽名的，這就是你得到PKIX錯誤，當你導入證書，Java檢查作爲受信任的證書。 – AndresMontj

Java沒有所需的證書。

默認情況下，Java附帶了可以信任的證書列表。它在JAVA_HOME/jre/lib/security/cacerts文件中可用。

就你而言，由於這是一個新的/自簽名證書，因此你需要告訴Java它可以被信任。你可以這樣做，通過添加證書到cacerts文件：

keytool -import -trustcacerts -alias <unique alias name>-file <certificate file path> -keystore <cacerts file path>

來源

2017-10-20 04:53:38 atom

非常感謝您的回答！ –

最後一個問題：如果我想要使用其他類型的客戶端（例如Android，IOS，智能設備），我應該先導入我的服務證書嗎？ –

通過HTTPS進行REST風格的Web服務

回答

相關問題