[英]SSL Socket Connection working even though client is not sending certificate?
I am very new to Cryptography using Java. 我是使用Java进行密码学的新手。 I have to build a program that exchanges certificate before any data communication takes place. 我必须构建一个程序,在进行任何数据通信之前交换证书。 I am using sslSockets to build basic client-server program and I am not using HTTP/S, this is just to get extra security. 我正在使用sslSockets构建基本的客户端 - 服务器程序,我没有使用HTTP / S,这只是为了获得额外的安全性。 (Would like to know difference between Socket and SSLSocket.. does it mean everything is automatically encrypted?) (想知道Socket和SSLSocket之间的区别..它是否意味着一切都是自动加密的?)
Here's my UPDATED Server Code: 这是我更新的服务器代码:
public class SSLServerExample {
final static String pathToStores = "C:/Users/XXX/Desktop/sslserverclientprogram";
final static String keyStoreFile = "keystore.jks";
final static String passwd = "changeit";
final static int theServerPort = 8443;
static boolean debug = false;
public static void main(String args[]) throws Exception {
String trustFilename = pathToStores + "/" + keyStoreFile;
// System.out.println("Verifying KeyStore File of Client..");
System.setProperty("javax.net.ssl.keyStore", trustFilename);
System.setProperty("javax.net.ssl.keyStorePassword", passwd);
if (debug)
System.setProperty("javax.net.debug", "all");
System.out.println("Setting up SSL parameters");
// Initialize socket connection
SSLServerSocketFactory sslssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslServerSocket = (SSLServerSocket)sslssf.createServerSocket(theServerPort);
System.out.println("Server Started..Waiting for clients");
sslServerSocket.setNeedClientAuth(true);
SSLSocket sslSocket = (SSLSocket)sslServerSocket.accept();
//sslSocket.startHandshake();
System.out.println("Client Connected!");
InputStream sslIS = sslSocket.getInputStream();
OutputStream sslOS = sslSocket.getOutputStream();
sslServerSocket.setNeedClientAuth(true);
final int RSAKeySize = 1024;
final String newline = "\n";
Key pubKey = null;
Key privKey = null;
boolean flag = sslSocket.getNeedClientAuth();
System.out.println("Flag value: "+ flag);
The flag results in False, even though I set it as true and client sends data which is decrypted by the server without authenticating each other. 该标志导致False,即使我将其设置为true并且客户端发送由服务器解密而未相互验证的数据。
Am I missing something? 我错过了什么吗?
Please help. 请帮忙。
PS: My Client code: PS:我的客户代码:
public class SSLClientExample {
final static String pathToStores = "C:/Users/XXX/Desktop/sslserverclientprogram";
final static String trustStoreFile = "cacerts.jks";
final static String passwd = "changeit";
final static String INPUT_FILE = "E:/workspace/input.txt";
final static String theServerName = "localhost";
final static int theServerPort = 8443;
static boolean debug = false;
public static void main(String args[]) throws Exception {
String trustFilename = pathToStores + "/" + trustStoreFile;
System.out.println("Validating KeyStore file of Server..");
System.setProperty("javax.net.ssl.trustStore", trustFilename);
System.setProperty("javax.net.ssl.trustStorePassword", passwd);
if (debug)
System.setProperty("javax.net.debug", "all");
SSLSocketFactory sslssf = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket sslSocket = (SSLSocket)sslssf.createSocket(theServerName, 8443);
System.out.println("Connected to Server!");
You have to invoke sslServerSocket.setNeedClientAuth(true);
你必须调用sslServerSocket.setNeedClientAuth(true);
before accepting incoming client connections. 在接受传入的客户端连接之前。 You are modifying the server socket's configuration after the connection has already been established. 您已在建立连接后修改服务器套接字的配置。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.