未设置getAttribute("javax.servlet.request.X509Certificate")(Spring,CXF,Jetty,JAX-RSv1.1)

Question

我的客户端通过以下方式实现双向SSL:

    private final static String KEYSTORE = "/security/client.jks";
    private final static String KEYSTORE_PASSWORD = "secret";
    private final static String KEYSTORE_TYPE = "JKS";
    private final static String TRUSTSTORE = "/security/certificates.jks";
    private final static String TRUSTSTORE_PASSWORD = "secret";
    private final static String TRUSTSTORE_TYPE = "JKS";
    ...
    KeyStore keystore = KeyStore.getInstance(KEYSTORE_TYPE);
    FileInputStream keystoreInput = new FileInputStream(new File(KEYSTORE));
    keystore.load(keystoreInput, KEYSTORE_PASSWORD.toCharArray());
    KeyStore truststore = KeyStore.getInstance(TRUSTSTORE_TYPE);
    FileInputStream truststoreIs = new FileInputStream(new File(TRUSTSTORE));
    truststore.load(truststoreIs, TRUSTSTORE_PASSWORD.toCharArray());
    SSLSocketFactory socketFactory = new SSLSocketFactory(keystore, KEYSTORE_PASSWORD, truststore);
    Scheme scheme = new Scheme("https", 8543, socketFactory);
    SchemeRegistry registry = new SchemeRegistry();
    registry.register(scheme);
    ClientConnectionManager ccm = new PoolingClientConnectionManager(registry);
    httpclient = new DefaultHttpClient(ccm);
    HttpResponse response = null;
    HttpGet httpget = new HttpGet("https://mylocalhost.com:8543/test");
    response = httpclient.execute(httpget);
    ...

我尝试通过javax.servlet.http.HttpServletRequest.getAttribute("javax.servlet.request.X509Certificate")从客户端检索服务器端的X.509证书,如下所述:http:// tomcat. apache.org/tomcat-5.5-doc/servletapi/javax/servlet/ServletRequest.html#getAttribute%28java.lang.String%29.

我通过以下方式在服务器端获得HttpServletRequest:
HttpServletRequest servletRequest =(HttpServletRequest)msg.get("HTTP.REQUEST"); 通过我的拦截器类的handleMessage(Message msg)方法,它扩展了AbstractPhaseInterceptor <Message>.我必须在服务器端使用JAX-RS 1.1.1,因为我不允许更改一些Maven依赖项,所以我不能使用ContainerRequestFilter(从JAX-RS 2.0支持).

我的问题是服务器端的getAttribute("javax.servlet.request.X509Certificate")一直返回null.如果我验证服务器和客户端之间的流量,我可以看到来自服务器的证书被发送到客户端,该握手有效.但我看不到客户端证书被发送到服务器,我认为这是getAttribute("javax.servlet.request.X509Certificate")返回的原因null.有人知道如何解决这个问题吗？我已经在客户端尝试了其他一些实现,但没有任何改变.

我究竟做错了什么？提前谢谢了!

其他信息:我看到在服务器的一侧javax.servlet.request.ssl_session_id,javax.servlet.request.key_size和javax.servlet.request.cipher_suite设置,但关键javax.servlet.request.X509Certificate未设置.我正在使用Jetty Server 8.1.15,Apache CXF 2.7.x和JAX-RS 1.1.1.我通过http://cxf.apache.org/docs/jetty-configuration.html和http://cxf.apache.org/docs/secure-jax-rs-services.html#SecureJAX-RSServices-尝试使用Jetty配置 - Configuringendpoints,该属性仍未设置.

Answer 1

问题解决了.这不是代码中的问题,只是证书问题.我的问题是我是X509证书的初学者,这是服务器和客户端之间的握手问题.在这种情况下,只有SSL/Handshake调试帮助了我.调试日志告知服务器仅接受来自特定CA的客户端证书,服务器在ServerHello消息期间告知客户端证书请求中所需的CA. 由于客户端没有来自该CA的证书,因此它没有发送内容,并且客户端和服务器之间的连接已关闭,结果是未设置javax.servlet.request.X509Certificate.

对于可能在某个时间加入同一问题的所有其他人(这似乎是关于IBM的常见SSL配置问题,如下面的第一个链接中所述),以下来源对我有很大帮助:
- http:// www-01 .ibm.com/support/docview.wss？uid = swg27038122&aid = 1 (第16和17页)
- http://java.dzone.com/articles/how-analyze-java-ssl-errors(显示为握手应该看看)
- 需要帮助在tomcat中调试SSL握手(演示如何在Java中调试ssl错误)
- https://thomas-leister.de/internet/eigene-openssl-certificate-authority-ca-erstellen-und-zertifikate-signieren /(用德语,但也许你可以找到一个等同的英语)
- https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/6.0/html/Web_Services_Security_Guide/files/i382674.html(继续德国文章)
- http://www.webfarmr.eu/2010/04/import-pkcs12-private-keys-into-jks-keystores-using-java-keytool/(如何创建密钥库和信任库)

在创建自己的CA,服务器和客户端证书之后,在为两者创建密钥库和信任库之后,现在设置了该属性:
- Here15_1:javax.servlet.request.X509Certificate
- Here16_2:class [Ljava.security.cert.X509Certificate;
- Here16_3:[Ljava.security.cert.X509Certificate; @ 43b8f002
服务器代码现在也能够提取客户端证书信息.