使用Netty的单向SSL身份验证

Question

I'm trying to build a one-way authentication socket server using Netty.
First I used keytool to generate keystore, self signed certificate, truststore for both server and client, and I wrote some code in my server/client, the SSL authentication is working.

Here is my question:
Is there any way that I don't need to add truststore to my client, I only add the keystore to my server, and it would still work well? I thought one-way authentication means that only server holds the certificate?

The following is what I wrote in my server/client to add the SslHandler so far:
server:

private void addSslHandlerOneWay(SocketChannel ch) throws Exception {
    SSLContext sslContext = SSLContext.getInstance("TLS");

    KeyStore ks = KeyStore.getInstance("JKS");
    ks.load(new FileInputStream(new File("svrks.jks")), "kspassword1".toCharArray());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
    kmf.init(ks, "kspassword2".toCharArray());

    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
    tmf.init(ks);

    sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
    SSLEngine sslEngine = sslContext.createSSLEngine();
    sslEngine.setUseClientMode(false);
    sslEngine.setNeedClientAuth(false);//one-way
    sslEngine.setEnabledProtocols(sslEngine.getSupportedProtocols());
    sslEngine.setEnabledCipherSuites(sslEngine.getSupportedCipherSuites());
    sslEngine.setEnableSessionCreation(true);

    ch.pipeline().addFirst("SSL", new SslHandler(sslEngine));
}

client:

private void addSslHandlerOneWay(SocketChannel ch) throws Exception {
    SSLContext sslContext = SSLContext.getInstance("TLS");

    KeyStore ts = KeyStore.getInstance("JKS");
    ts.load(getInputStream("clits.jks"), "tspassword2".toCharArray());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
    kmf.init(ts, "tspassword1".toCharArray());

    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
    tmf.init(ts);

    sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
    SSLEngine sslEngine = sslContext.createSSLEngine();
    sslEngine.setUseClientMode(true);//client

    sslEngine.setEnabledProtocols(sslEngine.getSupportedProtocols());
    sslEngine.setEnabledCipherSuites(sslEngine.getSupportedCipherSuites());
    sslEngine.setEnableSessionCreation(true);

    ch.pipeline().addFirst("SSL", new SslHandler(sslEngine));
}

Thanks, guys.

Answer 1

I thought one-way authentication means that only server holds the certificate?

The server needs to authenticate itself with the certificate. For this it needs certificate and matching private key.
The client needs to verify the authentication, ie that the certificate send by the server is actually the expected one. For this it needs to know either the certificate itself or the CA which issued the certificate - which is the same in case of self-signed certificates.

What you seem to expect is that the client does not need any previous knowledge of the servers certificate or the issuer CA. If this would be the case then the client would just accept any certificate, both corrects ones from the server and also fake ones from an attacker. Without previous knowledge (ie a local trust anchor) what to expect the server cannot distinguish between correct and fake certificates.