在JVM中注册多个密钥库
我有两个应用程序在同一个Java虚拟机上运行，并使用不同的密钥库和信任库。
一个可行的select是使用单个密钥库，并将其他所有的密钥库导入到共享密钥库（例如keytool -import）中，但是如果我可以将单独的密钥库用于在同一个jvm中运行的独立应用程序，那么这真的会有所帮助。
我可以将keystore和truststore设置为jvm参数或系统属性，如下所示：
java -Djavax.net.ssl.keyStore=serverKeys -Djavax.net.ssl.keyStorePassword=password -Djavax.net.ssl.trustStore=serverTrust -Djavax.net.ssl.trustStorePassword=password SSLApplication 要么
System.setProperty("javax.net.ssl.keyStore","serverKeys")
但是这种方法的问题在于它指定了要在JVM级别使用的密钥库/信任库，因此在同一个JVM中运行的所有应用程序都获得相同的密钥库/信任库。
我也尝试创build一个自定义的SSLContext并将其设置为默认，但它也为在同一个JVM中运行的所有应用程序设置上下文。
SSLContext context = SSLContext.getInstance("SSL"); context.init(kms, tms, null); SSLContext.setDefault(context);
我希望能够使用不同的密钥库/信任库而不修改个别应用程序代码。
一个可以dynamic注册多个密钥库的解决scheme，除了jvm中的默认密钥库/证书之外，还是很棒的。
解决scheme将以这种方式工作：
- 当JVM引导时，它从jre / certs文件夹加载所有默认的certs / keystore（当没有指定keystores时默认的java行为）。
- 当应用程序1加载它注册其密钥库时，
- 然后当应用程序2加载注册其密钥库…
请让我知道你的想法或解决scheme。 提前致谢！
拉兹的回答是一个很好的开始，但没有足够的灵活性来满足我的需求。 MultiStoreKeyManager显式检查自定义KeyManager，如果操作失败，则返回到jvm KeyManager。 我实际上首先要检查jvm证书; 最好的解决scheme应该能够处理这两种情况。 此外，答案无法提供可用的TrustManager。
我已经写了几个更灵活的类，CompositeX509KeyManager和CompositeX509TrustManager，以任意顺序添加对任意数量的密钥库的支持。
CompositeX509KeyManager
package com.mycompany.ssl; import java.net.Socket; import java.security.Principal; import java.security.PrivateKey; import java.security.cert.X509Certificate; import java.util.List; import javax.annotation.Nullable; import javax.net.ssl.X509KeyManager; import com.google.common.collect.ImmutableList; import com.google.common.collect.Iterables; /** * Represents an ordered list of {@link X509KeyManager}s with most-preferred managers first. * * This is necessary because of the fine-print on {@link SSLContext#init}: * Only the first instance of a particular key and/or trust manager implementation type in the * array is used. (For example, only the first javax.net.ssl.X509KeyManager in the array will be used.) * * @author codyaray * @since 4/22/2013 * @see http://stackoverflow.com/questions/1793979/registering-multiple-keystores-in-jvm */ public class CompositeX509KeyManager implements X509KeyManager { private final List keyManagers; /** * Creates a new {@link CompositeX509KeyManager}. * * @param keyManagers the X509 key managers, ordered with the most-preferred managers first. */ public CompositeX509KeyManager(List keyManagers) { this.keyManagers = ImmutableList.copyOf(keyManagers); } /** * Chooses the first non-null client alias returned from the delegate * {@link X509TrustManagers}, or {@code null} if there are no matches. */ @Override public @Nullable String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) { for (X509KeyManager keyManager : keyManagers) { String alias = keyManager.chooseClientAlias(keyType, issuers, socket); if (alias != null) { return alias; } } return null; } /** * Chooses the first non-null server alias returned from the delegate * {@link X509TrustManagers}, or {@code null} if there are no matches. */ @Override public @Nullable String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) { for (X509KeyManager keyManager : keyManagers) { String alias = keyManager.chooseServerAlias(keyType, issuers, socket); if (alias != null) { return alias; } } return null; } /** * Returns the first non-null private key associated with the * given alias, or {@code null} if the alias can't be found. */ @Override public @Nullable PrivateKey getPrivateKey(String alias) { for (X509KeyManager keyManager : keyManagers) { PrivateKey privateKey = keyManager.getPrivateKey(alias); if (privateKey != null) { return privateKey; } } return null; } /** * Returns the first non-null certificate chain associated with the * given alias, or {@code null} if the alias can't be found. */ @Override public @Nullable X509Certificate[] getCertificateChain(String alias) { for (X509KeyManager keyManager : keyManagers) { X509Certificate[] chain = keyManager.getCertificateChain(alias); if (chain != null && chain.length > 0) { return chain; } } return null; } /** * Get all matching aliases for authenticating the client side of a * secure socket, or {@code null} if there are no matches. */ @Override public @Nullable String[] getClientAliases(String keyType, Principal[] issuers) { ImmutableList.Builder aliases = ImmutableList.builder(); for (X509KeyManager keyManager : keyManagers) { aliases.add(keyManager.getClientAliases(keyType, issuers)); } return emptyToNull(Iterables.toArray(aliases.build(), String.class)); } /** * Get all matching aliases for authenticating the server side of a * secure socket, or {@code null} if there are no matches. */ @Override public @Nullable String[] getServerAliases(String keyType, Principal[] issuers) { ImmutableList.Builder aliases = ImmutableList.builder(); for (X509KeyManager keyManager : keyManagers) { aliases.add(keyManager.getServerAliases(keyType, issuers)); } return emptyToNull(Iterables.toArray(aliases.build(), String.class)); } @Nullable private static <T> T[] emptyToNull(T[] arr) { return (arr.length == 0) ? null : arr; } }
CompositeX509TrustManager
package com.mycompany.ssl; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.util.List; import javax.net.ssl.X509TrustManager; import com.google.common.collect.ImmutableList; import com.google.common.collect.Iterables; /** * Represents an ordered list of {@link X509TrustManager}s with additive trust. If any one of the * composed managers trusts a certificate chain, then it is trusted by the composite manager. * * This is necessary because of the fine-print on {@link SSLContext#init}: * Only the first instance of a particular key and/or trust manager implementation type in the * array is used. (For example, only the first javax.net.ssl.X509KeyManager in the array will be used.) * * @author codyaray * @since 4/22/2013 * @see http://stackoverflow.com/questions/1793979/registering-multiple-keystores-in-jvm */ public class CompositeX509TrustManager implements X509TrustManager { private final List trustManagers; public CompositeX509TrustManager(List trustManagers) { this.trustManagers = ImmutableList.copyOf(trustManagers); } @Override public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { for (X509TrustManager trustManager : trustManagers) { try { trustManager.checkClientTrusted(chain, authType); return; // someone trusts them. success! } catch (CertificateException e) { // maybe someone else will trust them } } throw new CertificateException("None of the TrustManagers trust this certificate chain"); } @Override public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { for (X509TrustManager trustManager : trustManagers) { try { trustManager.checkServerTrusted(chain, authType); return; // someone trusts them. success! } catch (CertificateException e) { // maybe someone else will trust them } } throw new CertificateException("None of the TrustManagers trust this certificate chain"); } @Override public X509Certificate[] getAcceptedIssuers() { ImmutableList.Builder certificates = ImmutableList.builder(); for (X509TrustManager trustManager : trustManagers) { certificates.add(trustManager.getAcceptedIssuers()); } return Iterables.toArray(certificates.build(), X509Certificate.class); } }
用法
对于一个keystore + jvm keystore的标准情况，可以像这样连线。 我再次使用番石榴，但这次是一个Guicey包装：
@Provides @Singleton SSLContext provideSSLContext(KeyStore keystore, char[] password) { String defaultAlgorithm = KeyManagerFactory.getDefaultAlgorithm(); X509KeyManager customKeyManager = getKeyManager("SunX509", keystore, password); X509KeyManager jvmKeyManager = getKeyManager(defaultAlgorithm, null, null); X509TrustManager customTrustManager = getTrustManager("SunX509", keystore); X509TrustManager jvmTrustManager = getTrustManager(defaultAlgorithm, null); KeyManager[] keyManagers = { new CompositeX509KeyManager(ImmutableList.of(jvmKeyManager, customKeyManager)) }; TrustManager[] trustManagers = { new CompositeX509TrustManager(ImmutableList.of(jvmTrustManager, customTrustManager)) }; SSLContext context = SSLContext.getInstance("SSL"); context.init(keyManagers, trustManagers, null); return context; } private X509KeyManager getKeyManager(String algorithm, KeyStore keystore, char[] password) { KeyManagerFactory factory = KeyManagerFactory.getInstance(algorithm); factory.init(keystore, password); return Iterables.getFirst(Iterables.filter( Arrays.asList(factory.getKeyManagers()), X509KeyManager.class), null); } private X509TrustManager getTrustManager(String algorithm, KeyStore keystore) { TrustManagerFactory factory = TrustManagerFactory.getInstance(algorithm); factory.init(keystore); return Iterables.getFirst(Iterables.filter( Arrays.asList(factory.getTrustManagers()), X509TrustManager.class), null); }
我从我的博客文章中提取了这个问题，这个问题有更多的细节，动机等等。所有的代码都在那里，所以它是独立的。 🙂
玩了ZZ Coder，sylvarking和Software Monkey的代码后，我发现了一个解决scheme：
首先，我写了一个结合了自定义密钥库和默认密钥库的X509KeyManager。
class MultiKeyStoreManager implements X509KeyManager { private static final Logger logger = Logger.getLogger(MultiKeyStoreManager.class); private final X509KeyManager jvmKeyManager; private final X509KeyManager customKeyManager; public MultiKeyStoreManager(X509KeyManager jvmKeyManager, X509KeyManager customKeyManager ) { this.jvmKeyManager = jvmKeyManager; this.customKeyManager = customKeyManager; } @Override public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) { // try the first key manager String alias = customKeyManager.chooseClientAlias(keyType, issuers, socket); if( alias == null ) { alias = jvmKeyManager.chooseClientAlias(keyType, issuers, socket); logger.warn("Reverting to JVM CLIENT alias : " + alias); } return alias; } @Override public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) { // try the first key manager String alias = customKeyManager.chooseServerAlias(keyType, issuers, socket); if( alias == null ) { alias = jvmKeyManager.chooseServerAlias(keyType, issuers, socket); logger.warn("Reverting to JVM Server alias : " + alias); } return alias; } @Override public X509Certificate[] getCertificateChain(String alias) { X509Certificate[] chain = customKeyManager.getCertificateChain(alias); if( chain == null || chain.length == 0) { logger.warn("Reverting to JVM Chain : " + alias); return jvmKeyManager.getCertificateChain(alias); } else { return chain; } } @Override public String[] getClientAliases(String keyType, Principal[] issuers) { String[] cAliases = customKeyManager.getClientAliases(keyType, issuers); String[] jAliases = jvmKeyManager.getClientAliases(keyType, issuers); logger.warn("Supported Client Aliases Custom: " + cAliases.length + " JVM : " + jAliases.length); return ArrayUtils.join(cAliases,jAliases); } @Override public PrivateKey getPrivateKey(String alias) { PrivateKey key = customKeyManager.getPrivateKey(alias); if( key == null ) { logger.warn("Reverting to JVM Key : " + alias); return jvmKeyManager.getPrivateKey(alias); } else { return key; } } @Override public String[] getServerAliases(String keyType, Principal[] issuers) { String[] cAliases = customKeyManager.getServerAliases(keyType, issuers); String[] jAliases = jvmKeyManager.getServerAliases(keyType, issuers); logger.warn("Supported Server Aliases Custom: " + cAliases.length + " JVM : " + jAliases.length); return ArrayUtils.join(cAliases,jAliases); } }
然后，您可以在创buildSSL Context或SocketFactory时使用此密钥存储pipe理器。 代码需要一些重构和整理，但它完美的工作。
/** * Returns an array of KeyManagers, set up to use the required keyStore. * This method does the bulk of the work of setting up the custom trust managers. * * @param props * * @return an array of KeyManagers set up accordingly. */ private static KeyManager[] getKeyManagers(Properties props) throws IOException, GeneralSecurityException { // First, get the default KeyManagerFactory. String alg = KeyManagerFactory.getDefaultAlgorithm(); KeyManagerFactory kmFact = KeyManagerFactory.getInstance(alg); // Next, set up the KeyStore to use. We need to load the file into // a KeyStore instance. FileInputStream fis = new FileInputStream(props.getProperty(SSL_KEYSTORE)); logger.info("Loaded keystore"); KeyStore ks = KeyStore.getInstance("jks"); String keyStorePassword = props.getProperty(SSL_KEYSTORE_PASSWORD); ks.load(fis, keyStorePassword.toCharArray()); fis.close(); // Now we initialise the KeyManagerFactory with this KeyStore kmFact.init(ks, keyStorePassword.toCharArray()); // default KeyManagerFactory dkmFact = KeyManagerFactory.getInstance(alg); dkmFact.init(null,null); // Get the first X509KeyManager in the list X509KeyManager customX509KeyManager = getX509KeyManager(alg, kmFact); X509KeyManager jvmX509KeyManager = getX509KeyManager(alg, dkmFact); KeyManager[] km = { new MultiKeyStoreManager(jvmX509KeyManager, customX509KeyManager) }; logger.debug("Number of key managers registered:" + km.length); return km; } /** * Find a X509 Key Manager compatible with a particular algorithm * @param algorithm * @param kmFact * @return * @throws NoSuchAlgorithmException */ private static X509KeyManager getX509KeyManager(String algorithm, KeyManagerFactory kmFact) throws NoSuchAlgorithmException { KeyManager[] keyManagers = kmFact.getKeyManagers(); if (keyManagers == null || keyManagers.length == 0) { throw new NoSuchAlgorithmException("The default algorithm :" + algorithm + " produced no key managers"); } X509KeyManager x509KeyManager = null; for (int i = 0; i < keyManagers.length; i++) { if (keyManagers[i] instanceof X509KeyManager) { x509KeyManager = (X509KeyManager) keyManagers[i]; break; } } if (x509KeyManager == null) { throw new NoSuchAlgorithmException("The default algorithm :"+ algorithm + " did not produce a X509 Key manager"); } return x509KeyManager; } private static void initialiseManager(Properties props) throws IOException, GeneralSecurityException { // Next construct and initialise a SSLContext with the KeyStore and // the TrustStore. We use the default SecureRandom. SSLContext context = SSLContext.getInstance("SSL"); context.init(getKeyManagers(props), getTrustManagers(props), null); SSLContext.setDefault(context); }
让我知道是否有人有任何问题或需要任何示范代码。
看看我对这个问题的回答，
我怎样才能有一个Java服务器的多个SSL证书
如果使用MyKeyManager，则可以拥有多个密钥库，也可以将多个上下文用于单个密钥库。
