如何通过 GET REST API 调用传递 ssl 证书

Question

我有一个网络服务器在不同的机器上运行。我能够使用邮递员客户端并加载 cert.pem 和 key.pem 文件并成功执行获取请求。

现在我想用 Java 以编程方式执行此操作。为此，我将 PKCS12 添加到密钥库，如下所示：

keytool -importkeystore -destkeystore keystore.jks -srcstoretype PKCS12 -srckeystore keystore.p12

keytool -list -keystore keystore.jks

现在在代码中我这样做了：

String url = "https://localhost:9443/server/api/v1/"+id+"/_history/"+history;
URL obj = new URL(url);
System.setProperty("javax.net.ssl.keyStore", "/Users/rc/Downloads/test101/jks/keystore.jks");

System.setProperty("javax.net.ssl.keyStorePassword", "asdfgh");
System.setProperty("javax.net.ssl.keyStoreType", "JKS");            


HttpURLConnection con = (HttpURLConnection) obj.openConnection();

    con.setRequestMethod("GET");

        //add request header
con.setRequestProperty("Content-Type", "application/json");
con.setRequestProperty("Accept", "application/json");

int responseCode = con.getResponseCode();       
System.out.println("\nSending 'GET' request to URL : " + url);      
System.out.println("Response Code : " + responseCode);

我得到：

  Exception in thread "main" javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1514)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:961)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1564)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:347)
at com.ibm.fhir.celgene.poc.GetMetadata.main(GetMetadata.java:38)
 Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:214)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
... 14 more

解决方案：

我必须生成 jssecacerts 并将其保存在特定位置。我缺少的部分在这个链接中：

 http://www.mkyong.com/webservices/jax-ws/suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/

Answer 1

您正在尝试通过

http://

连接，但应该使用

https://

。看看你的网址：

String url = "http://localhost:9443/server/api/v1/"+id+"/_history/"+history;

“java.net.SocketException: Unexpected end of file”表示服务器接受然后关闭连接而不发送响应。我相信 HTTPS 连接的端口 9443 尚未准备好接受 HTTP 连接。

Answer 2

按照以下步骤在您的应用程序 API 调用中添加 SSL 证书。

步骤 : 1 按照以下步骤从网络下载 SSL 证书

• 前往您的网站
• 单击地址栏中的锁定按钮
• 将出现一个弹出窗口 -> 单击 -> 连接是安全的
• 点击证书按钮
• 单击详细信息选项卡 -> 导出并保存。
• 例如证书.crt

步骤：2

• 进入android studio项目
• 在res/raw中添加证书文件
• 在 res/xml 中创建 xml 资源目录
• 在 res/xml 目录中创建 network_security_config.xml 文件。

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config>
        <domain includeSubdomains="true">yourdomain.com</domain>
        <trust-anchors>
            <certificates src="@raw/certificate"/>
        </trust-anchors>
    </domain-config>
</network-security-config>

步骤：3

• 转到AndroidManifest.xml
• 在应用程序标签内添加以下行

android:networkSecurityConfig="@xml/network_security_config"