如果有很多密鑰庫和信任庫，將使用哪個密鑰和證書？

Question

我的密鑰庫中有兩個密鑰：

D:\javasslstores2>keytool -list -keystore keystore.jks -storepass passwd123

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

ssl_key_2, Jun 14, 2018, PrivateKeyEntry,
Certificate fingerprint (SHA1): 36:A4:FB:E6:47:12:59:D6:C3:E1:06:21:4B:21:79:7E:33:86:48:52
ssl_key, Jun 13, 2018, PrivateKeyEntry,
Certificate fingerprint (SHA1): 03:08:2C:CA:A4:84:DD:61:20:05:F7:56:F5:44:4C:A4:35:2B:8C:6C

以及我的受托人中相應的兩個證書：

D:\javasslstores2>keytool -list -keystore truststore.jks -storepass passwd123

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

ssl_key_2, Jun 14, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): 36:A4:FB:E6:47:12:59:D6:C3:E1:06:21:4B:21:79:7E:33:86:48:52
ssl_key, Jun 14, 2018, trustedCertEntry,
Certificate fingerprint (SHA1): 03:08:2C:CA:A4:84:DD:61:20:05:F7:56:F5:44:4C:A4:35:2B:8C:6C

我已經編寫了簡單的Java ssl客戶端和服務器：

服務器

public class Server {
    static KeyStore ks;
    static KeyManagerFactory kmf;
    static TrustManagerFactory tmf;
    static SSLContext sc;
    static TrustManager[] trustManagers;

    static {
        try {
            ks = KeyStore.getInstance("JKS");
            ks.load(new FileInputStream("D:\\javasslstores\\keystore.jks"), "passwd123".toCharArray());

            kmf = KeyManagerFactory.getInstance("SunX509");
            kmf.init(ks, "passwd123".toCharArray());

            tmf = TrustManagerFactory.getInstance("SunX509"); 
            tmf.init(ks);

            sc = SSLContext.getInstance("TLS"); 
            sc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null); 
        } catch (Exception e) {
            System.out.println(e.getMessage());
            System.out.println(e.getStackTrace());
        }
    }

    public static void main(String[] args) throws IOException {
        System.out.println("SSL Server");
        SSLServerSocketFactory ssf = sc.getServerSocketFactory(); 
        SSLServerSocket s = (SSLServerSocket) ssf.createServerSocket(8089);
        System.out.println("Listening on port 8089");
        SSLSocket socket = (SSLSocket) s.accept();


        PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
        try (BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(socket.getInputStream()))) {
            String line;
            System.out.println("Data from client:");
            while((line = bufferedReader.readLine()) != null){
                System.out.println(line);
                out.println(line);
            }
        }
        System.out.println("Closed");
    }
}

客戶

public class Client {
    static KeyStore ks;
    static KeyManagerFactory kmf;
    static TrustManagerFactory tmf;
    static SSLContext sc;
    static TrustManager[] trustManagers;

    static 
    {
        try 
        {
            ks = KeyStore.getInstance("JKS");
            ks.load(new FileInputStream("D:\\javasslstores\\keystore.jks"), "passwd123".toCharArray());

            kmf = KeyManagerFactory.getInstance("SunX509");
            kmf.init(ks, "passwd123".toCharArray());

            tmf = TrustManagerFactory.getInstance("SunX509"); 
            tmf.init(ks);

            sc = SSLContext.getInstance("TLS"); 
            sc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
        } catch (Exception e) {
            System.out.println(e.getMessage());
            System.out.println(e.getStackTrace());
        }
    }

    public static void main(String[] args) throws IOException {
        SSLSocketFactory ssf = sc.getSocketFactory();
        SSLSocket socket = (SSLSocket) ssf.createSocket("localhost", 8089);
        socket.startHandshake();

        PrintWriter out = new PrintWriter
                                (new BufferedWriter
                                (new OutputStreamWriter
                                (socket.getOutputStream())));

        System.out.println("SSL Client");

        out.println("GET / HTTP/1.0");
        out.println("From java ssl client");
        out.println("written by me");
        out.flush();

        if (out.checkError())
            System.out.println("SSLSocketClient:  java.io.PrintWriter error");

        BufferedReader in = new BufferedReader(
                                new InputStreamReader(
                                socket.getInputStream()));

        String inputLine;

        while ((inputLine = in.readLine()) != null)
            System.out.println(inputLine);

        in.close();
        out.close();
        socket.close();
    }
}

上面的代碼運行正常。

疑問：

1. 有兩個密鑰和證書，名稱分別為ssl_key和ssl_key_2 。 他們使用哪一個？
2. 他們如何最終使用同一對密鑰和證書？

Answer 1

好問題。 SunX509 KeyManager（ SunX509KeyManagerImpl ）的實現使用它找到的第一個別名，該別名具有一個專用密鑰和一個RSA類型的密鑰 。 您可以在main方法上調試由Server類調用的SunX509KeyManagerImpl.chooseServerAlias ，以驗證邏輯。 要更改SunX509KeyManager的行為，可以編寫擴展X509ExtendedKeyManager並將其傳遞給SSLContext.init自己的keyManager。