我有一个Java客户端尝试访问一个具有自签名证书的服务器。
当我尝试向服务器发送Post请求时，我遇到了以下错误：
无法找到到所请求目标的有效认证路径
经过一些研究后，我执行了以下步骤：
将我的服务器域名保存为一个root.cer文件。
在我的Glassfish服务器的JRE中，我运行了以下命令：
keytool -import -alias example -keystore cacerts -file root.cer
为了检查我的证书是否成功添加到cacert中，我执行了以下操作：
keytool -list -v -keystore cacerts
我可以看到证书已经存在。
然后我重新启动了Glassfish并重试了“post”。
我仍然得到相同的错误。
我有一种感觉，这是因为我的Glassfish实际上没有读取我修改的cacert文件，而可能是其他一些文件。
你们有没有遇到过这个问题，能指导我正确的方向吗？
不幸的是，这可能有很多原因。许多应用服务器和其他Java“包装器”容易操作属性、密钥链等等。因此，它可能在查看完全不同的东西。
除了使用truss命令，我建议尝试：
java -Djavax.net.debug=all -Djavax.net.ssl.trustStore=trustStore ...
你可以尝试将其设置为“ssl”，密钥管理器和信任管理器之一，以查看是否有所帮助。在大多数平台上，将其设置为“help”将列出类似以下的内容。
不管怎样，确保您充分了解密钥库（其中包含您用于证明自己身份的私钥和证书）与信任库（确定您信任谁）之间的区别，以及您自己的身份也有到根的“链” - 这与您需要弄清楚“您”信任的任何根链是分开的。
all turn on all debugging
ssl turn on ssl debugging
The following can be used with ssl:
record enable per-record tracing
handshake print each handshake message
keygen print key generation data
session print session activity
defaultctx print default SSL initialization
sslctx print SSLContext tracing
sessioncache print session cache tracing
keymanager print key manager tracing
trustmanager print trust manager tracing
pluggability print pluggability tracing
handshake debugging can be widened with:
data hex dump of each handshake message
verbose verbose handshake message printing
record debugging can be widened with:
plaintext hex dump of record plaintext
packet print raw SSL/TLS packets
来源：# 请参阅http://download.oracle.com/javase/1.5.0/docs/guide/security/jsse/JSSERefGuide.html#Debug
helloWorld.java，而不是使用...。 - vesperto以下是解决方案，按照以下链接逐步操作：
JAVA文件：博客中缺失
/*
* Copyright 2006 Sun Microsystems, Inc. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* - Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* - Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* - Neither the name of Sun Microsystems nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
* IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
import java.io.*;
import java.net.URL;
import java.security.*;
import java.security.cert.*;
import javax.net.ssl.*;
public class InstallCert {
public static void main(String[] args) throws Exception {
String host;
int port;
char[] passphrase;
if ((args.length == 1) || (args.length == 2)) {
String[] c = args[0].split(":");
host = c[0];
port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
String p = (args.length == 1) ? "changeit" : args[1];
passphrase = p.toCharArray();
} else {
System.out.println("Usage: java InstallCert <host>[:port] [passphrase]");
return;
}
File file = new File("jssecacerts");
if (file.isFile() == false) {
char SEP = File.separatorChar;
File dir = new File(System.getProperty("java.home") + SEP
+ "lib" + SEP + "security");
file = new File(dir, "jssecacerts");
if (file.isFile() == false) {
file = new File(dir, "cacerts");
}
}
System.out.println("Loading KeyStore " + file + "...");
InputStream in = new FileInputStream(file);
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(in, passphrase);
in.close();
SSLContext context = SSLContext.getInstance("TLS");
TrustManagerFactory tmf =
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ks);
X509TrustManager defaultTrustManager = (X509TrustManager)tmf.getTrustManagers()[0];
SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
context.init(null, new TrustManager[] {tm}, null);
SSLSocketFactory factory = context.getSocketFactory();
System.out.println("Opening connection to " + host + ":" + port + "...");
SSLSocket socket = (SSLSocket)factory.createSocket(host, port);
socket.setSoTimeout(10000);
try {
System.out.println("Starting SSL handshake...");
socket.startHandshake();
socket.close();
System.out.println();
System.out.println("No errors, certificate is already trusted");
} catch (SSLException e) {
System.out.println();
e.printStackTrace(System.out);
}
X509Certificate[] chain = tm.chain;
if (chain == null) {
System.out.println("Could not obtain server certificate chain");
return;
}
BufferedReader reader =
new BufferedReader(new InputStreamReader(System.in));
System.out.println();
System.out.println("Server sent " + chain.length + " certificate(s):");
System.out.println();
MessageDigest sha1 = MessageDigest.getInstance("SHA1");
MessageDigest md5 = MessageDigest.getInstance("MD5");
for (int i = 0; i < chain.length; i++) {
X509Certificate cert = chain[i];
System.out.println
(" " + (i + 1) + " Subject " + cert.getSubjectDN());
System.out.println(" Issuer " + cert.getIssuerDN());
sha1.update(cert.getEncoded());
System.out.println(" sha1 " + toHexString(sha1.digest()));
md5.update(cert.getEncoded());
System.out.println(" md5 " + toHexString(md5.digest()));
System.out.println();
}
System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
String line = reader.readLine().trim();
int k;
try {
k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
} catch (NumberFormatException e) {
System.out.println("KeyStore not changed");
return;
}
X509Certificate cert = chain[k];
String alias = host + "-" + (k + 1);
ks.setCertificateEntry(alias, cert);
OutputStream out = new FileOutputStream("jssecacerts");
ks.store(out, passphrase);
out.close();
System.out.println();
System.out.println(cert);
System.out.println();
System.out.println
("Added certificate to keystore 'jssecacerts' using alias '"
+ alias + "'");
}
private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();
private static String toHexString(byte[] bytes) {
StringBuilder sb = new StringBuilder(bytes.length * 3);
for (int b : bytes) {
b &= 0xff;
sb.append(HEXDIGITS[b >> 4]);
sb.append(HEXDIGITS[b & 15]);
sb.append(' ');
}
return sb.toString();
}
private static class SavingTrustManager implements X509TrustManager {
private final X509TrustManager tm;
private X509Certificate[] chain;
SavingTrustManager(X509TrustManager tm) {
this.tm = tm;
}
public X509Certificate[] getAcceptedIssuers() {
throw new UnsupportedOperationException();
}
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
throw new UnsupportedOperationException();
}
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
this.chain = chain;
tm.checkServerTrusted(chain, authType);
}
}
}
public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0];}。 - Richardjava -Djavax.net.ssl.trustStore=truststores/client.ts com.progress.Client
或通过Java代码：
import java.util.Properties;
...
Properties systemProps = System.getProperties();
systemProps.put("javax.net.ssl.keyStorePassword","passwordForKeystore");
systemProps.put("javax.net.ssl.keyStore","pathToKeystore.ks");
systemProps.put("javax.net.ssl.trustStore", "pathToTruststore.ts");
systemProps.put("javax.net.ssl.trustStorePassword","passwordForTrustStore");
System.setProperties(systemProps);
...
更多细节请参考RedHat网站。
(来自我的其他答案转载)
使用Java软件发行版中的命令行实用工具keytool导入（和信任！）所需证书。
示例：
从命令行切换到jre\bin目录
检查密钥库（在jre\bin目录中找到的文件）
keytool -list -keystore ..\lib\security\cacerts
密码为changeit
下载并保存所需服务器链中的所有证书。
添加证书（在需要之前要删除文件..\lib\security\cacerts上的“只读”属性），运行：
keytool -alias REPLACE_TO_ANY_UNIQ_NAME -import -keystore .\lib\security\cacerts -file “r:\root.crt”
我偶然发现了这么简单的提示。 其他解决方案需要使用InstallCert.Java和JDK。
来源：http://www.java-samples.com/showtutorial.php?tutorialid=210
keytool -alias REPLACE_TO_ANY_UNIQ_NAME -import -keystore.\lib\security\cacerts -file "r:\root.crt"的帮助，我不需要更改我的Java代码中的CloseableHttpClient httpClient = HttpClients.createDefault()。 - frank我在尝试从应用程序访问一个使用自签名证书的https url时，遇到了这个错误。他们提供的是一个.cert 文件，我不确定应该把它放在哪里。我是按照以下方式解决的：
keytool 的位置位于 JDK/bin 文件夹下。
方法1：将证书添加到默认的Java信任库 - cacerts：
keytool -import -alias myCert -file C://certificate.cert -keystore C://Program Files//Java//jdk1.8.0_271//jre//lib//security//cacerts
密码: changeit
方法二:
创建信任存储:
keytool -import -alias myCert -file C://certificate.cert -keystore myTrustStore
它会给你以下提示，可以按照以下填写：
Enter keystore password:changeit
Re-enter new password:changeit
Trust this certificate?yes
使用信任库：
在运行应用程序/服务器时，请传递以下JVM参数：
-Djavax.net.ssl.trustStore=C://myTrustStore -Djavax.net.ssl.trustStorePassword=changeit
我曾经遇到和 sbt 相同的问题。
它尝试从 repo1.maven.org 通过 SSL 获取依赖项
但是却说“无法找到到请求目标 URL 的有效认证路径”。
所以我按照这篇文章中的建议去尝试，但仍然无法验证连接。
后来我发现根证书不够，正如那篇文章所建议的一样，所以 -
对我有用的方法是将中间 CA 证书导入密钥库。
我实际上添加了链中的所有证书，结果非常成功。
certs
root@c339504909345:/opt/jdk-minimal/jre/lib/security # keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 80 entries
root@c39596768075:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts # keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 151 entries
jlink构建最小的JRE，命令如下：/opt/jdk/bin/jlink \
--module-path /opt/jdk/jmods...因此，以下是不同路径和命令序列：
# Java 8
COPY --from=marcellodesales-springboot-builder-jdk8 /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts /etc/ssl/certs/java/cacerts
# Java 10
RUN rm -f /opt/jdk-minimal/jre/lib/security/cacerts
RUN ln -s /etc/ssl/certs/java/cacerts /opt/jdk-minimal/jre/lib/security/cacerts
来自MyClientProject.java文件的片段：
static {
// Setup the trustStore location and password
System.setProperty("javax.net.ssl.trustStore","trust_store/cacerts.jks");
// comment out below line
System.setProperty("javax.net.ssl.trustStore","trust_store/keystore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
//System.setProperty("javax.net.debug", "all");
// for localhost testing only
javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(new javax.net.ssl.HostnameVerifier() {
public boolean verify(String hostname, javax.net.ssl.SSLSession sslSession) {
return hostname.equals("localhost");
}
});
}
浪费了很多时间在这个问题上。如果你已经导入了证书并且可以在这里列表中看到它。
keytool -list -v -keystore $JAVA_HOME/lib/security/cacerts
然后使用以下命令创建新的内容，将SITE_NAME，SITE_PORT，CERTIFICATE_NAME和保存文件的路径替换为相应内容。
echo -n | openssl s_client -connect SITE_NAME:SITE_PORT \
| openssl x509 > /path/to/save/CERTIFICATE_NAME.cert
在我的情况下，我使用Keycloak和Spring时遇到了问题。在我使用这个命令创建证书并将其导入到密钥库后，问题得到解决，现在它可以正常运行。
我的问题是，一个云访问安全代理软件 NetScope 通过软件更新安装在我的工作笔记本电脑上。这会改变证书链，即使我将整个链导入到 cacerts 密钥库中，我仍然无法通过我的 Java 客户端连接到服务器。我禁用了 NetScope，成功地连接到了服务器。