jdk6请求https的解决方案
·
jdk6请求https的解决方案
jdk6请求https的解决方案
最近公司一个老项目需要对接别人的数据，即调用别人的接口获取数据再存储到我们项目的数据库中，但是碰上一个问题，那就是jdk版本太老了，而对面的接口是https，所以连接不上，目前已经解决，写一个文章记录下自己解决问题的过程。
1、 问题分析
我所用的jdk版本是jdk1.6.0_45，开发工具是MyEclipse。
1.1、报错信息
报错信息如下：
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1822)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1004)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1188)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1215)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1199)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1031)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230)
at com.dimine.datainterface.dc.action.DeviceAction.main(DeviceAction.java:103)
1.2、查看jdk版本支持TLS、SSL
很经典的问题，甚至都不用去分析了，就是ssl、tls版本的问题。（对于低版本jdk来说）
可以用以下代码查看一下自己的jdk支持哪些版本的ssl、tls。
public static void main(String[] args) throws Exception {
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, null, null);
SSLSocketFactory factory = (SSLSocketFactory) context.getSocketFactory();
SSLSocket socket = (SSLSocket) factory.createSocket();
String[] protocols = socket.getSupportedProtocols();
System.out.println("Supported Protocols: " + protocols.length);
for (int i = 0; i < protocols.length; i++) {
System.out.println(" " + protocols[i]);
}
protocols = socket.getEnabledProtocols();
System.out.println("Enabled Protocols: " + protocols.length);
for (int i = 0; i < protocols.length; i++) {
System.out.println(" " + protocols[i]);
}
}
至于查看调用的接口所需ssl、tls版本，则可以用以下网站去测试。
SSL Server Test，链接在这，目前是能用的
我自己的只支持TLS1（图就不贴了），明显和人家不搭。
1.3、进一步查看报错信息
如果是main函数，那么就设置全局参数，如下：
//设置全局参数，必须放在可执行代码之前
System.setProperty("javax.net.debug", "all");
System.setProperty("ssl.debug", "true");
// 下面这个也可以
//System.setProperty("javax.net.debug", "ssl");
//System.setProperty("ssl.debug", "true");
如果是在服务中运行，就设置jvm参数，如下：
注：我是用的MyEclipse，不同的ide，需要自己去百度怎么设置
结果如下：
可以清晰地看到我们向服务端打了个招呼，但是被明确拒绝了。
2、问题处理
2.1、第一次处理
人家高版本的不搭理你，不跟你握手，怎么办，只能提升一下自己再和人家相处了，处理如下：
首先修改默认TLS版本指定是不行了，因为我的不支持1.2。
//该设置会报错
System.setProperty("https.protocols", "TLSv1.2");
2.1.1、处理过程
那就只能重写了，重写如下：
先引入jar包bcprov-jdk15on-1.60，
推荐地址如下：
jar包下载地址
然后创建下面两个类，一个重写工厂，一个工具类，根据自己情况而定，我这里是copy的别的大佬，期望能一举解决问题。
import org.bouncycastle.crypto.tls.*;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import javax.net.ssl.*;
import javax.security.cert.X509Certificate;
import java.io.*;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.KeyStore;
import java.security.Principal;
import java.security.SecureRandom;
import java.security.Security;
import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateFactory;
import java.util.Hashtable;
import java.util.LinkedList;
import java.util.List;
public class TLSSocketConnectionFactory extends SSLSocketFactory {
static {
if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
Security.addProvider(new BouncyCastleProvider());
}
}
@Override
public Socket createSocket(Socket socket, final String host, int port,
boolean arg3) throws IOException {
if (socket == null) {
socket = new Socket();
}
if (!socket.isConnected()) {
socket.connect(new InetSocketAddress(host, port));
}
final TlsClientProtocol tlsClientProtocol = new TlsClientProtocol(socket.getInputStream(), socket.getOutputStream(), new SecureRandom());
return _createSSLSocket(host, tlsClientProtocol);
}
@Override public String[] getDefaultCipherSuites() { return null; }
@Override public String[] getSupportedCipherSuites() { return null; }
@Override public Socket createSocket(String host, int port) throws IOException, UnknownHostException { return null; }
@Override public Socket createSocket(InetAddress host, int port) throws IOException { return null; }
@Override public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { return null; }
@Override public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException { return null; }
private SSLSocket _createSSLSocket(final String host, final TlsClientProtocol tlsClientProtocol) {
return new SSLSocket() {
private java.security.cert.Certificate[] peertCerts;
@Override public InputStream getInputStream() throws IOException { return tlsClientProtocol.getInputStream(); }
@Override public OutputStream getOutputStream() throws IOException { return tlsClientProtocol.getOutputStream(); }
@Override public synchronized void close() throws IOException { tlsClientProtocol.close(); }
@Override public void addHandshakeCompletedListener( HandshakeCompletedListener arg0) { }
@Override public boolean getEnableSessionCreation() { return false; }
@Override public String[] getEnabledCipherSuites() { return null; }
@Override public String[] getEnabledProtocols() { return null; }
@Override public boolean getNeedClientAuth() { return false; }
@Override
public SSLSession getSession() {
return new SSLSession() {
/*原本这些方法都是直接throw UnsupportedOperationException 导致看不到真实异常*/
@Override
public int getApplicationBufferSize() {
return 0;
}
@Override public String getCipherSuite() { return null; }
@Override public long getCreationTime() { return 0; }
@Override public byte[] getId() { return null; }
@Override public long getLastAccessedTime() { return 0; }
@Override public java.security.cert.Certificate[] getLocalCertificates() { return null; }
@Override public Principal getLocalPrincipal() { return null; }
@Override public int getPacketBufferSize() { return 0; }
@Override public X509Certificate[] getPeerCertificateChain() throws SSLPeerUnverifiedException { return null; }
@Override public java.security.cert.Certificate[] getPeerCertificates() throws SSLPeerUnverifiedException { return peertCerts; }
@Override public String getPeerHost() { return null; }
@Override public int getPeerPort() { return 0; }
@Override public Principal getPeerPrincipal() throws SSLPeerUnverifiedException { return null; }
@Override public String getProtocol() { return null; }
@Override public SSLSessionContext getSessionContext() { return null; }
@Override public Object getValue(String arg0) { return null; }
@Override public String[] getValueNames() { return null; }
@Override public void invalidate() { return; }
@Override public boolean isValid() { return true; }
@Override public void putValue(String arg0, Object arg1) { return; }
@Override
public void removeValue(String arg0) {
return;
}
};
}
@Override public String[] getSupportedProtocols() { return null; }
@Override public boolean getUseClientMode() { return false; }
@Override public boolean getWantClientAuth() { return false; }
@Override public void removeHandshakeCompletedListener(HandshakeCompletedListener arg0) { }
@Override public void setEnableSessionCreation(boolean arg0) { }
@Override public void setEnabledCipherSuites(String[] arg0) { }
@Override public void setEnabledProtocols(String[] arg0) { }
@Override public void setNeedClientAuth(boolean arg0) { }
@Override public void setUseClientMode(boolean arg0) { }
@Override public void setWantClientAuth(boolean arg0) { }
@Override public String[] getSupportedCipherSuites() { return null; }
@Override
public void startHandshake() throws IOException {
tlsClientProtocol.connect(new DefaultTlsClient() {
@SuppressWarnings("unchecked")
@Override
public Hashtable<Integer, byte[]> getClientExtensions() throws IOException {
Hashtable<Integer, byte[]> clientExtensions = super.getClientExtensions();
if (clientExtensions == null) {
clientExtensions = new Hashtable<Integer, byte[]>();
}
//Add host_name
byte[] host_name = host.getBytes();
final ByteArrayOutputStream baos = new ByteArrayOutputStream();
final DataOutputStream dos = new DataOutputStream(baos);
dos.writeShort(host_name.length + 3);
dos.writeByte(0);
dos.writeShort(host_name.length);
dos.write(host_name);
dos.close();
clientExtensions.put(ExtensionType.server_name, baos.toByteArray());
return clientExtensions;
}
@Override
public TlsAuthentication getAuthentication() throws IOException {
return new TlsAuthentication() {
@Override
public void notifyServerCertificate(Certificate serverCertificate) throws IOException {
try {
KeyStore ks = _loadKeyStore();
CertificateFactory cf = CertificateFactory.getInstance("X.509");
List<java.security.cert.Certificate> certs = new LinkedList<java.security.cert.Certificate>();
boolean trustedCertificate = false;
for ( org.bouncycastle.asn1.x509.Certificate c : serverCertificate.getCertificateList()) {
java.security.cert.Certificate cert = cf.generateCertificate(new ByteArrayInputStream(c.getEncoded()));
certs.add(cert);
String alias = ks.getCertificateAlias(cert);
if(alias != null) {
if (cert instanceof java.security.cert.X509Certificate) {
try {
( (java.security.cert.X509Certificate) cert).checkValidity();
trustedCertificate = true;
} catch(CertificateExpiredException cee) {
// Accept all the certs!
}
}
} else {
// Accept all the certs!
}
}
if (!trustedCertificate) {
// Accept all the certs!
}
peertCerts = certs.toArray(new java.security.cert.Certificate[0]);
} catch (Exception ex) {
ex.printStackTrace();
throw new IOException(ex);
}
}
@Override
public TlsCredentials getClientCredentials(CertificateRequest certificateRequest) throws IOException {
return null;
}
private KeyStore _loadKeyStore() throws Exception {
FileInputStream trustStoreFis = null;
try {
KeyStore localKeyStore = null;
String trustStoreType = System.getProperty("javax.net.ssl.trustStoreType")!=null?System.getProperty("javax.net.ssl.trustStoreType"):KeyStore.getDefaultType();
String trustStoreProvider = System.getProperty("javax.net.ssl.trustStoreProvider")!=null?System.getProperty("javax.net.ssl.trustStoreProvider"):"";
if (trustStoreType.length() != 0) {
if (trustStoreProvider.length() == 0) {
localKeyStore = KeyStore.getInstance(trustStoreType);
} else {
localKeyStore = KeyStore.getInstance(trustStoreType, trustStoreProvider);
}
char[] keyStorePass = null;
String str5 = System.getProperty("javax.net.ssl.trustStorePassword")!=null?System.getProperty("javax.net.ssl.trustStorePassword"):"";
if (str5.length() != 0) {
keyStorePass = str5.toCharArray();
}
localKeyStore.load(trustStoreFis, keyStorePass);
if (keyStorePass != null) {
for (int i = 0; i < keyStorePass.length; i++) {
keyStorePass[i] = 0;
}
}
}
return localKeyStore;
} finally {
if (trustStoreFis != null) {
trustStoreFis.close();
}
}
}
};
}
});
} // startHandshake
};
}
}
import javax.net.ssl.HttpsURLConnection;
import java.io.*;
import java.net.MalformedURLException;
import java.net.URL;
import com.dimine.util.security.TLSSocketConnectionFactory;
public class HttpsUtils {
/**
* content-type类型为xml方式发送post请求
*
* @param urlPath
* @param data
* @param charSet
* @return
*/
public static String postXml(String urlPath, String data, String charSet) {
String result = httpPostData(urlPath, data, charSet, null, "application/xml", "application/xml");
return result;
}
public static String httpPostData(String urlPath, String data, String charSet, String[] header, String contentType, String accpect) {
String result = null;
URL url = null;
HttpsURLConnection httpurlconnection = null;
OutputStreamWriter out = null;
BufferedReader reader = null;
try {
url = new URL(urlPath);
httpurlconnection = (HttpsURLConnection) url.openConnection();
httpurlconnection.setSSLSocketFactory(new TLSSocketConnectionFactory());
httpurlconnection.setDoInput(true);
httpurlconnection.setDoOutput(true);
/* if (header != null) {
for (int i = 0; i < header.length; i++) {
String[] content = header[i].split(":");
httpurlconnection.setRequestProperty(content[0], content[1]);
}
}*/
httpurlconnection.setRequestMethod("POST");
httpurlconnection.setRequestProperty("Content-Type", "application/xml");
httpurlconnection.setRequestProperty("Authorization", "Basic d3NhcGkuc3lzdGVtYWNjb3VudEB5bnl3LmNvbTphYmNkMTIzNA==");
/* if (null != accpect) {
httpurlconnection.setRequestProperty("Accpect", accpect);
}*/
httpurlconnection.connect();
out = new OutputStreamWriter(httpurlconnection.getOutputStream(), charSet); // utf-8编码
out.append(data);
out.flush();
out.close();
int code = httpurlconnection.getResponseCode();
if (code == 200) {
// 读取响应
int length = (int) httpurlconnection.getContentLength();// 获取长度
InputStream is = httpurlconnection.getInputStream();
reader = new BufferedReader(new InputStreamReader(is));
String line = reader.readLine();
StringBuilder builder = new StringBuilder();
while (line != null) {
builder.append(line);
line = reader.readLine();
}
result = builder.toString();
} else {
// TODO
}
} catch (Exception e) {
e.printStackTrace();
} finally {
url = null;
if (httpurlconnection != null) {
httpurlconnection.disconnect();
}
try {
if (out != null) {
out.close();
}
if (reader != null) {
reader.close();
}
} catch (IOException e) {
e.printStackTrace();
}
}
return result;
}
public static String Send(String signData,String signURL) {
StringBuffer sb = new StringBuffer();
URL myurl = null;
try {
myurl = new URL(signURL);
} catch (MalformedURLException e1) {
System.out.println("myurl error:"+e1);
}
HttpsURLConnection con = null;
try {
con = (HttpsURLConnection) myurl.openConnection();
con.setSSLSocketFactory(new TLSSocketConnectionFactory());
System.setProperty("sun.net.client.defaultConnectTimeout","300000");
System.setProperty("sun.net.client.defaultReadTimeout", "300000");
con.setRequestMethod("POST");
con.setDoOutput(true);
con.setDoInput(true);
con.setUseCaches(false);
con.setInstanceFollowRedirects(true);
con.setRequestProperty("Content-type", "text/xml;charset=utf-8");
con.setRequestProperty("User-Agent", "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)");
System.out.println("start connect");
con.connect();
System.out.println("end connect");
} catch (IOException e1) {
System.err.println("HttpsURLConnection error:"+e1);
}
OutputStream out = null;
//OutputStreamWriter os = null;
try {
out = con.getOutputStream();
//os = new OutputStreamWriter(out);
out.write(signData.getBytes("utf-8"));
out.flush();
out.close();
//os.write(signData);
//os.flush();
} catch (IOException e1) {
System.out.println("IOException:"+e1);
}catch(Exception ex){
System.out.println("HTTPS Exception:"+ex);
System.out.println(ex.getStackTrace());
}
//接收响应
try {
System.out.println("responsecode="+con.getResponseCode());
BufferedReader reader = new BufferedReader(new InputStreamReader(con.getInputStream(), "utf-8"));
sb.append("");
String s = reader.readLine();
while(s!=null){
sb.append(s);
s=reader.readLine();
}
reader.close();
con.disconnect();
} catch (IOException ioex) {
System.err.println("https write file error:"+ioex);
}
return sb.toString();
}
}
2.1.2、处理结果
没得说，凉凉，后来又换了各种jar包版本，也不行
2.2、第二次处理
2.2.1、处理过程
怎么办嘞，只能听大佬们的抓包看看，我是main函数去测试，所以直接在main函数里设置抓包软件代理了，我用的Fiddler2，怎么设置代理度娘上一搜就有。
不过下面的话是我给萌新提供的一些帮助：
-
keytool指令
如果keytool和keystore不在同一个文件夹下，记得用相对路径或者绝对路径，不要在网上直接复制一个语句就完事了。
例如我的keytool在D:\Program Files\Java\jdk1.6.0_45\jre\bin下面，keystore在D:\Program Files\Java\jdk1.6.0_45\jre\lib\security下面，那么我想要查看密钥库时就是在D:\Program Files\Java\jdk1.6.0_45\jre\bin下打开cmd，输入指令keytool -list -v -keystore ../lib/security/cacerts，密码默认是changeit -
设置代理参数
如果是调用http接口就设置如下：
System.setProperty(“http.proxySet”, “true”);
System.setProperty(“http.proxyHost”, “127.0.0.1”);
System.setProperty(“http.proxyPort”, “8888”);
如果是调用https接口就设置如下：
System.setProperty(“http.proxySet”, “true”);
System.setProperty(“https.proxyHost”,“127.0.0.1”);
System.setProperty(“https.proxyPort”,“8888”);
一般是都设置，设置好后，启动fiddler，启动main函数，就可以在fiddler中看到想要的东西了。
2.2.2、处理结果
神奇的事情发生了，代理之后直接调用接口成功了，我还指望着能看出点什么错误，我看了下fiddler的tls配置和我的jdk是一样的，这下不能理解了。总之失败。
2.3、第三次处理
第二次处理以草草失败告终，没有一点有用信息，而后各种咨询度娘，各种修改，无果。这下只能放大招了，只能拿出万能的Nginx了。
没得说，下载解压，直接开始配置
#如果启动报错，可能是空格格式问题，去掉所有空格即可
server {
listen 8090;
server_name test;
location / {
root html;
autoindex on;
index index.html index.htm;
}
location /test {
#该处改成自己需要的接口
proxy_pass https://test.cn/test1/test2?WSDL;
}
#将404的页面重定向到https的首页
error_page 404 https://test.cn/test1/test2?WSDL;
}
将原本的接口在代码中改成，localhost:8090/test，在本地测试过后，搞定，如果有多个接口也不怕，路径分发是Nginx的拿手戏。如果是get类型的接口，不要用url拼接参数（除非是固定参数），不然Nginx可不留情。
3、总结
- 旧项目真烦真烦真烦
- 别人的方法也不一定能直接拿来用，还是得自己想办法，懂一点的还好，不懂的改都不会改（特指我这种）
- Nginx真好
北京人形旗下天工造物具身智能开源社区，聚焦具身天工与慧思开物两大平台
更多推荐
1
0- 0
已为社区贡献1条内容
所有评论(0)