Java使用SSLSocket通信
2016-04-01 20:14
573 查看
JSSE(Java Security Socket Extension)是Sun公司为了解决互联网信息安全传输提出的一个解决方案,它实现了SSL和TSL协议,包含了数据加密、服务器验证、消息完整性和客户端验证等技术。通过使用JSSE简洁的API,可以在客户端和服务器端之间通过SSL/TSL协议安全地传输数据。
首先,需要将OpenSSL生成根证书CA及签发子证书一文中生成的客户端及服务端私钥和数字证书进行导出,生成Java环境可用的keystore文件。
客户端私钥与证书的导出:
服务器端私钥与证书的导出:
受信任的CA证书的导出:
之后,便会在certs文件夹下生成ca-trust.keystore文件。加上上面生成的server.keystore和client.keystore,certs下会生成这三个文件:
Java实现的SSL通信客户端:
初始化时,首先取得SSLContext、KeyManagerFactory、TrustManagerFactory实例,然后加载客户端的密钥库和信任库到相应的KeyStore,对KeyManagerFactory和TrustManagerFactory进行初始化,最后用KeyManagerFactory和TrustManagerFactory对SSLContext进行初始化,并创建SSLSocket。
Java实现的SSL通信服务器端:
先运行服务器端,再运行客户端。服务器端执行结果:
客户端执行结果:
首先,需要将OpenSSL生成根证书CA及签发子证书一文中生成的客户端及服务端私钥和数字证书进行导出,生成Java环境可用的keystore文件。
客户端私钥与证书的导出:
openssl pkcs12 -export -clcerts -name www.mydomain.com \ -inkey private/client-key.pem -in certs/client.cer -out certs/client.keystore
服务器端私钥与证书的导出:
openssl pkcs12 -export -clcerts -name www.mydomain.com \ -inkey private/server-key.pem -in certs/server.cer -out certs/server.keystore
受信任的CA证书的导出:
keytool -importcert -trustcacerts -alias www.mydomain.com -file certs/ca.cer \ -keystore certs/ca-trust.keystore
之后,便会在certs文件夹下生成ca-trust.keystore文件。加上上面生成的server.keystore和client.keystore,certs下会生成这三个文件:
Java实现的SSL通信客户端:
package com.demo.ssl; import java.io.FileInputStream; import java.io.InputStream; import java.io.OutputStream; import java.security.KeyStore; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSocket; import javax.net.ssl.TrustManagerFactory; public class SSLClient { private SSLSocket sslSocket; public static void main(String[] args) throws Exception { SSLClient client = new SSLClient(); client.init(); System.out.println("SSLClient initialized."); client.process(); } //客户端将要使用到client.keystore和ca-trust.keystore public void init() throws Exception { String host = "127.0.0.1"; int port = 1234; String keystorePath = "/home/user/CA/certs/client.keystore"; String trustKeystorePath = "/home/user/CA/certs/ca-trust.keystore"; String keystorePassword = "abc123_"; SSLContext context = SSLContext.getInstance("SSL"); //客户端证书库 KeyStore clientKeystore = KeyStore.getInstance("pkcs12"); FileInputStream keystoreFis = new FileInputStream(keystorePath); clientKeystore.load(keystoreFis, keystorePassword.toCharArray()); //信任证书库 KeyStore trustKeystore = KeyStore.getInstance("jks"); FileInputStream trustKeystoreFis = new FileInputStream(trustKeystorePath); trustKeystore.load(trustKeystoreFis, keystorePassword.toCharArray()); //密钥库 KeyManagerFactory kmf = KeyManagerFactory.getInstance("sunx509"); kmf.init(clientKeystore, keystorePassword.toCharArray()); //信任库 TrustManagerFactory tmf = TrustManagerFactory.getInstance("sunx509"); tmf.init(trustKeystore); //初始化SSL上下文 context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null); sslSocket = (SSLSocket)context.getSocketFactory().createSocket(host, port); } public void process() throws Exception { //往SSLSocket中写入数据 String hello = "hello boy!"; OutputStream out = sslSocket.getOutputStream(); out.write(hello.getBytes(), 0, hello.getBytes().length); out.flush(); //从SSLSocket中读取数据 InputStream in = sslSocket.getInputStream(); byte[] buffer = new byte[50]; in.read(buffer); System.out.println(new String(buffer)); } }
初始化时,首先取得SSLContext、KeyManagerFactory、TrustManagerFactory实例,然后加载客户端的密钥库和信任库到相应的KeyStore,对KeyManagerFactory和TrustManagerFactory进行初始化,最后用KeyManagerFactory和TrustManagerFactory对SSLContext进行初始化,并创建SSLSocket。
Java实现的SSL通信服务器端:
package com.demo.ssl; import java.io.FileInputStream; import java.io.InputStream; import java.io.OutputStream; import java.net.Socket; import java.security.KeyStore; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLServerSocket; import javax.net.ssl.TrustManagerFactory; public class SSLServer { private SSLServerSocket sslServerSocket; public static void main(String[] args) throws Exception { SSLServer server = new SSLServer(); server.init(); System.out.println("SSLServer initialized."); server.process(); } //服务器端将要使用到server.keystore和ca-trust.keystore public void init() throws Exception { int port = 1234; String keystorePath = "/home/user/CA/certs/server.keystore"; String trustKeystorePath = "/home/user/CA/certs/ca-trust.keystore"; String keystorePassword = "abc123_"; SSLContext context = SSLContext.getInstance("SSL"); //客户端证书库 KeyStore keystore = KeyStore.getInstance("pkcs12"); FileInputStream keystoreFis = new FileInputStream(keystorePath); keystore.load(keystoreFis, keystorePassword.toCharArray()); //信任证书库 KeyStore trustKeystore = KeyStore.getInstance("jks"); FileInputStream trustKeystoreFis = new FileInputStream(trustKeystorePath); trustKeystore.load(trustKeystoreFis, keystorePassword.toCharArray()); //密钥库 KeyManagerFactory kmf = KeyManagerFactory.getInstance("sunx509"); kmf.init(keystore, keystorePassword.toCharArray()); //信任库 TrustManagerFactory tmf = TrustManagerFactory.getInstance("sunx509"); tmf.init(trustKeystore); //初始化SSL上下文 context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null); //初始化SSLSocket sslServerSocket = (SSLServerSocket)context.getServerSocketFactory().createServerSocket(port); //设置这个SSLServerSocket需要授权的客户端访问 sslServerSocket.setNeedClientAuth(true); } public void process() throws Exception { String bye = "Bye!"; byte[] buffer = new byte[50]; while(true) { Socket socket = sslServerSocket.accept(); InputStream in = socket.getInputStream(); in.read(buffer); System.out.println("Received: " + new String(buffer)); OutputStream out = socket.getOutputStream(); out.write(bye.getBytes()); out.flush(); } } }
先运行服务器端,再运行客户端。服务器端执行结果:
客户端执行结果:
相关文章推荐
- java对世界各个时区(TimeZone)的通用转换处理方法(转载)
- java-注解annotation
- java-模拟tomcat服务器
- java-用HttpURLConnection发送Http请求.
- java-WEB中的监听器Lisener
- Android IPC进程间通讯机制
- Android Native 绘图方法
- Android java 与 javascript互访(相互调用)的方法例子
- 介绍一款信息管理系统的开源框架---jeecg
- 聚类算法之kmeans算法java版本
- java实现 PageRank算法
- 访问Nginx发生SSL connection error的一种情况
- PropertyChangeListener简单理解
- c++11 + SDL2 + ffmpeg +OpenAL + java = Android播放器
- 插入排序
- 冒泡排序
- 堆排序