使用Volley进行Android双向SSL身份验证

Question

我正在尝试对服务器进行双向SSL身份验证。

服务器已实现SSL，我需要与服务器建立HTTPS连接。 服务器与第三方供应商，所以我没有服务器访问权限。 虽然他们给了我一个服务器证书test.crt 。

然后，按照以下命令创建自己的自签名证书。

• 生成密钥库

   keytool -genkey -alias myssl -keystore /home/user/mykey.keystore -validity 365 

• 生成cer文件

   keytool -export -alias myssl -keystore /home/user/mykey.keystore -file /home/user/mykey.cer 

• 将cer文件导入bks文件

   keytool -import -alias test_cer -file /home/user/mykey.cer -keystore /home/user/mykey.bks -storetype BKS -providerClass org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath /home/user/bcprov-jdk15on-146.jar 

现在我有3个文件： mykey.keystore，mykey.cer和mykey.bks 。

所以我将.cer文件提供给服务器供应商，他们将证书导入到他们的信任库中。

现在，在我的Android应用程序中，我尝试连接到服务器。 我将证书从服务器test.crt放入信任库，将mykey.cer放入密钥库，并将信任管理器和密钥管理器传递给SSLContext。

以下是相关代码。

 allowTrustedSSL(this.activity);

 JsonObjectRequest jsonObjectRequest = new JsonObjectRequest(method,url,dataToSend, onResponseListener,onErrorListener);

/**
 * Method implements self-signed certificates
 * @param context
 */
public static void allowTrustedSSL(Context context){

    /**
     * We shall accept traffic with any host names
     */
    HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            Logger.d(TAG, "verify() called with: hostname = [" + hostname + "], session = [" + session + "]");
            return true;
        }
    });
    try{
        //the NoSSLv3SocketFactory will disable the SSLv3 
        SSLSocketFactory noSSLv3Factory = new NoSSLv3SocketFactory(sslSocketFactoryGenerator(context));
        HttpsURLConnection.setDefaultSSLSocketFactory(noSSLv3Factory);
    } catch (Exception e) {
        Logger.e(TAG, "allowTrustedSSL: "+e.getMessage());
        e.printStackTrace();
    }

}
public static SSLSocketFactory sslSocketFactoryGenerator(Context context) throws
        UnrecoverableKeyException, CertificateException, NoSuchAlgorithmException,
        KeyStoreException, IOException, KeyManagementException {
    //the test.crt file 
    TrustManagerFactory trustManagerFactory = getTrustManagerFactory(context.getResources().openRawResource(R.raw.test));
    //the mykey.cer file
    KeyManagerFactory keyManagerFactory = getKeyManagerFactory(context.getResources().openRawResource(R.raw.mykey),
            MYKEY_PASS.toCharArray());

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(),null);

    return sslContext.getSocketFactory();
}

public static TrustManagerFactory getTrustManagerFactory(InputStream fileInput) throws CertificateException, IOException, KeyStoreException, NoSuchAlgorithmException {
    // Load CAs from an InputStream
    // (could be from a resource or ByteArrayInputStream or ...)
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    Certificate ca;
    try {
        ca = cf.generateCertificate(fileInput);
        System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
    } finally {
        fileInput.close();
    }

    // Create a KeyStore containing our trusted CAs
    String keyStoreType = KeyStore.getDefaultType();
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(null, null);
    keyStore.setCertificateEntry("ca", ca);

    // Create a TrustManager that trusts the CAs in our KeyStore
    String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
    tmf.init(keyStore);

    return tmf;
}

public static KeyManagerFactory getKeyManagerFactory(InputStream fileInput,char[] password)
        throws CertificateException, IOException, KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
    // Load CAs from an InputStream
    // (could be from a resource or ByteArrayInputStream or ...)
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    Certificate ca;
    try {
        ca = cf.generateCertificate(fileInput);
        System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
    } finally {
        fileInput.close();
    }

    // Create a KeyStore containing our trusted CAs
    String keyStoreType = KeyStore.getDefaultType();
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(null, null);
    keyStore.setCertificateEntry("ca", ca);

    // Create a TrustManager that trusts the CAs in our KeyStore
    String keyManAlgorithm = KeyManagerFactory.getDefaultAlgorithm();
    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(keyManAlgorithm);
    keyManagerFactory.init(keyStore, password);
    return  keyManagerFactory;
}

但是，当我开始连接到服务器时，我得到的是SSLException：Connection被peer关闭 。 我已经google了很多关于从android实现双向ssl的正确文档或示例。 而且我已经失去了很多宝贵的日子来弄清楚自己。

我创建证书的过程是否不正确？