[英]Websocket (spring) ssl connection (empty chain)
Good day! 美好的一天! I have a simple chat application with websocket (STOMP). 我有一个带有websocket(STOMP)的简单聊天应用程序。 I have configured ssl connection with mutal auth. 我已使用mutal auth配置了ssl连接。
Server side: 服务器端:
server.port=8443
server.ssl.key-store=path/to/server.jks
server.ssl.trust-store=path/to/trusted.jks
server.ssl.key-store-password=22222222
server.ssl.trust-store-password=22222222
server.ssl.client-auth=need
client : 客户:
System.setProperty("javax.net.ssl.keyStore","path/to/client.jks");
System.setProperty("javax.net.ssl.keyStorePassword","22222222");
System.setProperty("javax.net.ssl.trustStore","path/to/trusted.jks");
System.setProperty("javax.net.ssl.trustStorePassword","22222222");
server trusted.jks and client trusted.jks are the same. 服务器trusted.jks和客户端trusted.jks是相同的。
so when I try to connect with 所以当我尝试与
-Djavax.net.debug=ssl
I get lots of output and some strange situation - I can see two(?) key-agreements. 我得到了很多输出和一些奇怪的情况-我可以看到两个(?)密钥协议。 The first one goes ok - 第一个没问题-
trustStore is: /path/to/trusted.jks
adding as trusted cert:
Subject: EMAILADDRESS=ca@ca.com, CN=ca, OU=ca, O=ca, L=ca, ST=ca, C=RU
Issuer: EMAILADDRESS=ca@ca.com, CN=ca, OU=ca, O=ca, L=ca, ST=ca, C=RU
Algorithm: RSA; Serial number: 0x9952f188496b2545
Valid from Wed Jun 28 15:39:04 MSK 2017 until Sat Jun 26 15:39:04 MSK 2027
So my CA cert is added as trusted. 因此,我的CA证书被添加为受信任的证书。 Then 然后
*** ClientHello, TLSv1.2
//ok
*** ServerHello, TLSv1.2
//ok
*** Certificate chain
//my localhost server cert
***
Found trusted certificate:
Version: V3
Subject: EMAILADDRESS=ca@ca.com, CN=ca, OU=ca, O=ca, L=ca, ST=ca, C=RU
Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
So my client found trusted certificate for this server certificate. 因此,我的客户端找到了该服务器证书的受信任证书。
*** ECDH ServerKeyExchange
//ok
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Cert Authorities:
*** ServerHelloDone
And I can find my CHAIN - 我可以找到我的链-
*** Certificate chain
chain [0] = [
[
Version: V3
Subject: EMAILADDRESS=client3@mail.ru, CN=client3, OU=client3, O=client3, L=client3, ST=client3, C=RU
Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
chain [1] = [
[
Version: V3
Subject: EMAILADDRESS=ca@ca.com, CN=ca, OU=ca, O=ca, L=ca, ST=ca, C=RU
Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
*** ECDHClientKeyExchange
*** CertificateVerify
*** Finished
As far as I know - this is ok. 据我所知-没关系。 Then I can see: 然后我可以看到:
DEBUG org.springframework.web.client.RestTemplate - GET request for "https://localhost:8443/chat/info" resulted in 200 (null)
DEBUG org.springframework.web.socket.sockjs.client.WebSocketTransport - Starting WebSocket session on wss://localhost:8443/chat/437/f6158d1ee84b4c53ba55a6810b2f92a8/websocket
DEBUG org.springframework.web.socket.client.standard.StandardWebSocketClient -
Connecting to wss://localhost:8443/chat/437/f6158d1ee84b4c53ba55a6810b2f92a8/websocket
Again adding trust store certificate and so on, all is the same, but 再次添加信任库证书等等,都是一样的,但是
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Cert Authorities:
<EMAILADDRESS=ca@ca.com, CN=ca, OU=ca, O=ca, L=ca, ST=ca, C=RU>
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
***
So the server says to me 所以服务器对我说
ttps-jsse-nio-8443-exec-9, fatal error: 42: null cert chain
javax.net.ssl.SSLHandshakeException: null cert chain
Any thoughts about problem? 对问题有什么想法吗? If it is needed I can post my keystores and client implementation here. 如果需要,我可以在此处发布我的密钥库和客户端实现。 Thank you for help! 谢谢你的帮助!
UPDATE with curl output 使用curl输出进行更新
env -i curl -E ./chain.pem --key ./client.key --cacert ca.crt --verbose --user test:test https://localhost:8443/
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8443 (#0)
* found 1 certificates in ca.crt
* found 704 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: localhost (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject:
C=RU,ST=localhost,
L=localhost,O=localhost,OU=localhost,
CN=localhost,EMAIL=localhost@mail.com
* start date: Wed, 28 Jun 2017 13:07:14 GMT
* expire date: Thu, 28 Jun 2018 13:07:14 GMT
* issuer: C=RU,ST=ca,L=ca,O=ca,OU=ca,CN=ca,EMAIL=ca@ca.com
* compression: NULL
* ALPN, server did not agree to a protocol
* Server auth using Basic with user 'kitcpp'
> GET / HTTP/1.1
> Host: localhost:8443
> Authorization: Basic a2l0Y3BwOmtpdGNwcA==
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 200
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 1; mode=block
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate
< Pragma: no-cache
< Expires: 0
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
< X-Frame-Options: DENY
< Set-Cookie: JSESSIONID=67BACDE78AF68627516075B29C987C86; Path=/; Secure; HttpOnly
< Last-Modified: Wed, 28 Jun 2017 16:29:53 GMT
< Accept-Ranges: bytes
< Content-Type: text/html;charset=UTF-8
< Content-Language: en-US
< Content-Length: 6935
< Date: Fri, 30 Jun 2017 09:30:02 GMT
<
<!DOCTYPE html>
<html>
<head>
//and so on (my web chat page)
You are using Tomcat's WebSocket client. 您正在使用Tomcat的WebSocket客户端。 Its documentation describes how it should be configured to use SSL: 它的文档描述了如何配置它以使用SSL:
When using the WebSocket client to connect to secure server endpoints, the client SSL configuration is controlled by the userProperties of the provided
javax.websocket.ClientEndpointConfig
. 使用WebSocket客户端连接到安全服务器端点时,客户端SSL配置由所提供的javax.websocket.ClientEndpointConfig
的userProperty控制。 The following user properties are supported: 支持以下用户属性:
org.apache.tomcat.websocket.SSL_CONTEXT
org.apache.tomcat.websocket.SSL_PROTOCOLS
org.apache.tomcat.websocket.SSL_TRUSTSTORE
org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD
… ...
If the
org.apache.tomcat.websocket.SSL_CONTEXT
property is set then theorg.apache.tomcat.websocket.SSL_TRUSTSTORE
andorg.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD
properties will be ignored. 如果org.apache.tomcat.websocket.SSL_CONTEXT
设置属性,则org.apache.tomcat.websocket.SSL_TRUSTSTORE
和org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD
属性将被忽略。
You're using Spring's WebSocket and it is creating the ClientEndpointConfig
for you. 您正在使用Spring的WebSocket,它正在为您创建ClientEndpointConfig
。 To configure its user properties you set them on the StandardWebSocketClient
and it will then use them when it creates the ClientEndpointConfig
. 要配置其用户属性,请在StandardWebSocketClient
上进行设置,然后在创建ClientEndpointConfig
时将使用它们。 For example, assuming that the default SSL context is sufficient: 例如,假设默认的SSL上下文已足够:
StandardWebSocketClient simpleWebSocketClient =
new StandardWebSocketClient();
Map<String, Object> userProperties = new HashMap<>();
userProperties.put("org.apache.tomcat.websocket.SSL_CONTEXT", SSLContext.getDefault());
simpleWebSocketClient.setUserProperties(userProperties);
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.