Jetty 9-為域驗證證書啟用OCSP裝訂

Question

我在Jetty 9中啟用OCSP裝訂時遇到一些問題，我真的希望有人能在這里為我提供幫助...希望！

為了進行測試，我從PositiveSSL（Comodo）購買了SSL證書，該證書給了我有效/受信任的證書。 在此示例中的域是“ dev.mydomain.com”，它將僅指向我的本地IP（127.0.0.1）。

然后，我將提供的證書轉換為Java密鑰庫格式。

# Convert certificate to pkcs12
openssl pkcs12 -export -out dev.mydomain.com.pkcs12 -inkey dev.mydomain.com.key -in dev_mydomain_com.crt

# Create java keystore
keytool -importkeystore -srckeystore dev.mydomain.com.pkcs12 -srcstoretype pkcs12 -destkeystore dev.mydomain.com.keystore -deststoretype JKS

這是我用來創建Jetty服務器，激活證書，偵聽443端口（https）以及理論上激活OCSP的簡化Java代碼：

Server _server = new Server(); // org.eclipse.jetty.server.Server

HttpConfiguration httpsConfig = new HttpConfiguration();
HttpConnectionFactory http1 = new HttpConnectionFactory(httpsConfig);

SslContextFactory sslContextFactory = new SslContextFactory();
sslContextFactory.setKeyStorePath("dev.mydomain.com.keystore");
sslContextFactory.setKeyStorePassword("mypass");
sslContextFactory.setKeyManagerPassword("mypass");

// sslContextFactory.setValidateCerts(true); // tested
sslContextFactory.setEnableOCSP(true);

SslConnectionFactory ssl = new SslConnectionFactory(sslContextFactory, http1.getProtocol());

// SSL Connector
ServerConnector sslConnector = new ServerConnector(_server, ssl, http1);

sslConnector.setHost("127.0.0.1");
sslConnector.setPort(443);

_server.addConnector(sslConnector);

_server.start();
_server.join();

在Java VM啟動時，我還將啟用以下系統屬性：

Security.setProperty("ocsp.enable", "true");
System.setProperty("jdk.tls.server.enableStatusRequestExtension", "true");
System.setProperty("com.sun.net.ssl.checkRevocation", "true");

經過幾次嘗試，我也嘗試將證書鏈導入密鑰庫，但是對結果沒有任何影響。

keytool -import -trustcacerts -alias ca -file COMODORSAAddTrustCA.crt -keystore dev.mydomain.com.keystore
keytool -import -trustcacerts -alias dv -file COMODORSADomainValidationSecureServerCA.crt -keystore dev.mydomain.com.keystore
keytool -import -trustcacerts -alias te -file AddTrustExternalCARoot.crt -keystore dev.mydomain.com.keystore

為了測試OCSP是否正確啟用，我使用了一個名為sslyze的工具，但是我嘗試對OCSP做出的響應始終是負面的：

OCSP Stapling - NOT SUPPORTED - Server did not send back an OCSP response

這是sslyze的完整輸出：

C:\Tools\sslyze-1_4_1>sslyze --certinfo dev.mydomain.com:443


 AVAILABLE PLUGINS
 -----------------

  OpenSslCipherSuitesPlugin
  RobotPlugin
  CertificateInfoPlugin
  FallbackScsvPlugin
  SessionRenegotiationPlugin
  HeartbleedPlugin
  CompressionPlugin
  OpenSslCcsInjectionPlugin
  SessionResumptionPlugin
  HttpHeadersPlugin



 CHECKING HOST(S) AVAILABILITY
 -----------------------------

   dev.mydomain.com:443                       => 127.0.0.1




 SCAN RESULTS FOR DEV.MYDOMAIN.COM:443 - 127.0.0.1
 ------------------------------------------------

 * Certificate Information:
     Content
       SHA1 Fingerprint:                  7c398c59bac3a231efc9823c6958a7bc711bfc0e
       Common Name:                       dev.mydomain.com
       Issuer:                            COMODO RSA Domain Validation Secure Server CA
       Serial Number:                     103185809289011988533713848804380317148
       Not Before:                        2018-04-18 00:00:00
       Not After:                         2019-04-18 23:59:59
       Signature Algorithm:               sha256
       Public Key Algorithm:              RSA
       Key Size:                          2048
       Exponent:                          65537 (0x10001)
       DNS Subject Alternative Names:     ['dev.mydomain.com', 'www.dev.mydomain.com']

     Trust
       Hostname Validation:               OK - Certificate matches dev.mydomain.com
       Android CA Store (8.1.0_r9):       FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       iOS CA Store (11):                 FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       macOS CA Store (High Sierra):      FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       Mozilla CA Store (2018-01-14):     FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       Windows CA Store (2018-02-09):     FAILED - Certificate is NOT Trusted: unable to get local issuer certificate
       Symantec 2018 Deprecation:         OK - Not a Symantec-issued certificate
       Received Chain:                    dev.mydomain.com
       Verified Chain:                    ERROR - Could not build verified chain (certificate untrusted?)
       Received Chain Contains Anchor:    ERROR - Could not build verified chain (certificate untrusted?)
       Received Chain Order:              OK - Order is valid
       Verified Chain contains SHA1:      ERROR - Could not build verified chain (certificate untrusted?)

     Extensions
       OCSP Must-Staple:                  NOT SUPPORTED - Extension not found
       Certificate Transparency:          WARNING - Only 2 SCTs included but Google recommends 3 or more

     OCSP Stapling
                                          NOT SUPPORTED - Server did not send back an OCSP response


 SCAN COMPLETED IN 0.78 S
 ------------------------

抱歉，很長的帖子，但我嘗試提供盡可能多的細節！

謝謝！ 尤維

Answer 1

實際上，Jetty對OSCP配置值所做的工作並不多。

3個關鍵配置值...

1.啟用OCSP

SslContextFactory.setEnableOCSP(true)

該配置僅設置ocsp.enable JVM Security屬性。

2.設置OCSP響應者URL

SslContextFactory.setOcspResponderURL(ocspResponderURL)

如果setEnableOSCP(true)和OcspResponderURL設置，那么ocsp.responderURL JVM的安全屬性設置。

碼頭代碼

    if (_enableOCSP)
    {
        // Enable On-Line Certificate Status Protocol (OCSP) support
        Security.setProperty("ocsp.enable", "true");

        if (_ocspResponderURL != null)
        {
            // Override location of OCSP Responder
            Security.setProperty("ocsp.responderURL", _ocspResponderURL);
        }
    }

這2個是JVM級別的配置，這時JVM負責將OCSP內容添加到TLS / SSL協商中。

3.自定義證書驗證器

SslContextFactory.setValidateCerts(true)

如果已設置，則將其他兩個值傳遞到定制的Eclipse Jetty CertificateValidator 。

更多碼頭代碼

if (isValidateCerts())
{
    CertificateValidator validator = new CertificateValidator(trustStore, crls);
    validator.setMaxCertPathLength(getMaxCertPathLength());
    validator.setEnableCRLDP(isEnableCRLDP());
    validator.setEnableOCSP(isEnableOCSP());
    validator.setOcspResponderURL(getOcspResponderURL());
    validator.validate(keyStore, x509C);
}

這是服務器端組件，僅驗證服務器在啟動時將使用的證書。 加載密鑰庫/信任庫時，它只會發生一次。