Java ssl握手，无需下载证书

Question

During an SSL handshake, the step 3, which is downloading the certificate from the server, is optional.

So if I have distributed the certificate with my client, how can I skip the downloading to improve the performance?

Note that I know how to load a local certificate and how to trust it. But I don't know how to skip the downloading process and I haven't found anything useful in the java document.

Thanks in advance.

EDIT

My question is NOT about using a cipher suite which does not require a certificate. I still have a certificate and wish to use its public key for symmetric key exchange.

Answer 1

My question is NOT about using a cipher suite which does not require a certificate. I still have a certificate and wish to use its public key for encryption.

I think you are missing the role of a certificate in TLS. The main task is to provide authentication so that the connection is protected against man in the middle attacks (ie man in the middle claiming to be the server).

Payload encryption is not done by the certificate at all. At most it is used to exchange the encryption key in RSA based key exchange. But for currently recommended key exchanges (ECDHE and maybe DHE) the certificate is not needed at all.

Which means that using a certificate only for key exchange but not for authentication makes no sense and for this reason there is no cipher which supports this.

Answer 2

During an SSL handshake, the step 3, which is downloading the certificate from the server, is optional.

I don't know where you get your step numbers from, but sending the server certificate is mandatory unless the client states in the ClientHello message that it will accept a non-authenticating cipher suite, and this is specifically described in RFC 2246 as insecure.

So if I have distributed the certificate with my client, how can I skip the downloading to improve the performance?

You can't.

Note that I know how to load a local certificate and how to trust it. But I don't know how to skip the downloading process and I haven't found anything useful in the java document.

Of course you haven't found it. It isn't there. There isn't anything about it at all in the Java documentation, or RFC 2246 either. You've invented this requirement. That doesn't mean that either Java JSSE or SSL itself supports it. It doesn't.

My question is NOT about using a cipher suite which does not require a certificate. I still have a certificate and wish to use its public key for symmetric key exchange.

SSL does not perform symmetric key exchange. Once again you are talking about something that doesn't exist. If you want to understand SSL, read RFC 2246. If you want to invent your own, feel free, but don't call it SSL, and don't kid yourself that it will be either as performant or as secure as SSL, which has had nearly 25 years of development. It won't.