具有相互身份验证的 Https 请求通过 curl 但因 java 失败

Question

Someone on github asked me a question regarding my library. github 上有人问我一个关于我的图书馆的问题。 This library provides some factory classes to easily create a sslcontext.这个库提供了一些工厂类来轻松创建 sslcontext。 I make sure not the share the details of the library and just share plain java code and the additional library which I used.我确保不共享库的详细信息，只共享普通的 java 代码和我使用的附加库。 I tried to debug it and also tried reformatting of the certificates but it does not work.我尝试调试它并尝试重新格式化证书，但它不起作用。 The exception which I got is:我得到的例外是：

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The java trustmanager is basically saying I received the certificate of the server and I just checked in your list of trusted certificates and I couldn't find a matching certificate. java 信任管理器基本上是说我收到了服务器的证书，我刚刚检查了您的受信任证书列表，但找不到匹配的证书。 So I don't trust this server and therefor I am stopping this request.所以我不信任这个服务器，因此我停止了这个请求。 When I debugged it I could understand why the trustmanager throw an exception because there was no matching certificate at all which was the same as the server.当我调试它时，我可以理解为什么信任管理器会抛出异常，因为根本没有与服务器相同的匹配证书。 However when I use the same files with curl it works, so I was not quite sure if there is an issue with the certificates and the key material, or maybe java ssl implementation has some limitations or maybe I am not configuring it correctly... I hope someone can explain me the difference in behaviour of why it fails with java and passes with curl.但是，当我将相同的文件与 curl 一起使用时，它可以工作，所以我不太确定证书和密钥材料是否存在问题，或者 java ZF9D5C16A7F42203F8C195432354A 可能存在一些限制或未正确配置它......我希望有人可以向我解释为什么它在 java 中失败并在 curl 中通过的行为差异。

The private key content of the client:客户端的私钥内容：

The certificate chain content of the client:客户端的证书链内容：

The trusted certificate, ca受信任的证书，ca

So the following curl command will successfully execute and gives me the correct response body:因此，以下 curl 命令将成功执行并为我提供正确的响应正文：

curl --cacert ca.pem --key client-key.pem --cert client-cert.pem https://prod.idrix.eu/secure/

To load these files in Java I use Bouncy Castle, below is the full snippet of parsing it, loading it into TrustManager, KeyManager, creating the SSLContext and executing the request:为了在 Java 中加载这些文件，我使用 Bouncy Castle，下面是解析它的完整片段，将其加载到 TrustManager、KeyManager、创建 SSLContext 并执行请求：

import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openssl.PEMKeyPair;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.Reader;
import java.io.StringReader;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.Objects;
import java.util.stream.Collectors;

public class App {

    private static final BouncyCastleProvider BOUNCY_CASTLE_PROVIDER = new BouncyCastleProvider();
    private static final JcaPEMKeyConverter KEY_CONVERTER = new JcaPEMKeyConverter().setProvider(BOUNCY_CASTLE_PROVIDER);
    private static final JcaX509CertificateConverter CERTIFICATE_CONVERTER = new JcaX509CertificateConverter().setProvider(BOUNCY_CASTLE_PROVIDER);

    public static void main(String[] args) throws Exception {
        String clientKeyContent = App.getContent(App.class.getClassLoader().getResourceAsStream("client-key.pem"));
        String clientCertificateChainContent = App.getContent(App.class.getClassLoader().getResourceAsStream("client-cert.pem"));
        String caCertificateContent = App.getContent(App.class.getClassLoader().getResourceAsStream("ca.pem"));

        Reader reader = new StringReader(clientKeyContent);
        PEMParser pemParser = new PEMParser(reader);
        Object object = pemParser.readObject();

        PrivateKeyInfo privateKeyInfo = ((PEMKeyPair) object).getPrivateKeyInfo();
        PrivateKey clientKey = KEY_CONVERTER.getPrivateKey(privateKeyInfo);
        reader.close();
        pemParser.close();

        reader = new StringReader(clientCertificateChainContent);
        pemParser = new PEMParser(reader);

        object = pemParser.readObject();
        X509Certificate clientCertificateChain = CERTIFICATE_CONVERTER.getCertificate((X509CertificateHolder) object);
        reader.close();
        pemParser.close();

        reader = new StringReader(caCertificateContent);
        pemParser = new PEMParser(reader);

        object = pemParser.readObject();
        X509Certificate caCertificate = CERTIFICATE_CONVERTER.getCertificate((X509CertificateHolder) object);
        reader.close();
        pemParser.close();

        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null, "password".toCharArray());
        keyStore.setKeyEntry("client", clientKey, "".toCharArray(), new Certificate[]{clientCertificateChain});
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, "".toCharArray());

        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(null, "password".toCharArray());
        trustStore.setCertificateEntry("ca", caCertificate);
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);

        HttpClient httpClient = HttpClient.newBuilder()
                .sslContext(sslContext)
                .build();

        HttpRequest request = HttpRequest.newBuilder()
                .GET()
                .uri(URI.create("https://prod.idrix.eu/secure/"))
                .build();

        HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    public static String getContent(InputStream inputStream) throws IOException {
        try (InputStreamReader inputStreamReader = new InputStreamReader(Objects.requireNonNull(inputStream), StandardCharsets.UTF_8);
             BufferedReader bufferedReader = new BufferedReader(inputStreamReader)) {

            return bufferedReader.lines()
                    .collect(Collectors.joining(System.lineSeparator()));
        }
    }

}

I am using Java 11 and Bouncy Castle, see below for the specific artifact-id:我正在使用 Java 11 和 Bouncy Castle，具体的 artifact-id 见下文：

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.68</version>
</dependency>

So for me it is not clear why the curl command works and the setup in java fails.所以对我来说，不清楚为什么 curl 命令有效并且 java 中的设置失败。 Did I configured something wrong, any help would be great.我是否配置错误，任何帮助都会很棒。 I tried to provide as much as details possible.我试图提供尽可能多的细节。 The private key is a test key so it won't harm to share it here.私钥是一个测试密钥，所以在这里分享它不会有害。

Answer 1

I discovered what the issue was and so I wanted to share with others who have this in common.我发现了问题所在，因此我想与其他有共同点的人分享。

It looks like on mac os x curl is by default using the system trusted certificates and on java side this is not the case.看起来在 mac os x curl 上默认使用系统受信任的证书，而在 java 方面并非如此。 I am not sure what the behaviour of curl is with other operating systems.我不确定 curl 与其他操作系统的行为是什么。 https://prod.idrix.eu/secure/ has a certificate which is signed by DST Root CA X3 I disabled this and rerun the exact same setup as described on my initial question and the curl https request fails, just like it also failed on java side. https://prod.idrix.eu/secure/有一个由DST Root CA X3签名的证书我禁用了这个并重新运行与我最初问题中描述的完全相同的设置，curl Z5E056C500A1C47BADEZ 请求也失败了，就像它一样失败在 java 侧。

I disabled it from keychain as shown here:我从钥匙串中禁用了它，如下所示：

具有相互身份验证的 Https 请求通过 curl 但因 java 失败

问题描述

1 个解决方案

解决方案1
1 已采纳 2021-01-23 10:16:02

具有相互身份验证的 Https 请求通过 curl 但因 java 失败

问题描述

1 个解决方案

解决方案1 1 已采纳 2021-01-23 10:16:02

解决方案1
1 已采纳 2021-01-23 10:16:02