Jhystart

建構SSL Web Service時，首先將對方的憑證加入信任憑證區。

可經由執行InstallCert直接加入信任憑證區。

但是執行InstallCert.java所遇到這個錯誤。

javax.net.ssl.SSLException: java.lang.UnsupportedOperationException
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
at sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at tw.gov.ep.payment.InstallCert.main(InstallCert.java:66)
Caused by: java.lang.UnsupportedOperationException
at tw.gov.ep.payment.InstallCert$SavingTrustManager.getAcceptedIssuers(I
nstallCert.java:150)
at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraint
s(Unknown Source)
at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(Unk
nown Source)
at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unkno
wn Source)
at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
at sun.security.ssl.Handshaker.processLoop(Unknown Source)
at sun.security.ssl.Handshaker.process_record(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source
) ... 3 more

將throw new UnsupportedOperationException(); 改成 return new X509Certificate[0];
即可正常執行。

public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
//throw new UnsupportedOperationException();
}

完整InstallCert.java

import java.io.BufferedReader;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileOutputStream;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.OutputStream;

import java.security.KeyStore;

import java.security.MessageDigest;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLException;

import javax.net.ssl.SSLSocket;

import javax.net.ssl.SSLSocketFactory;

import javax.net.ssl.TrustManager;

import javax.net.ssl.TrustManagerFactory;

import javax.net.ssl.X509TrustManager;

public class InstallCert {

    public static void main(final String[] args) throws Exception {

        String host;

        int port;

        char[] passphrase;

        if ((args.length == 1) || (args.length == 2)) {

            final String[] c = args[0].split(":");

            host = c[0];

            port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);

            final String p = (args.length == 1) ? "changeit" : args[1];

            passphrase = p.toCharArray();

        } else {

            System.out.println(

                    "Usage: java InstallCert <host>[:port] [passphrase]");

            return;

        }

        File file = new File("jssecacerts");

        if (file.isFile() == false) {

            final char SEP = File.separatorChar;

            final File dir = new File(System.getProperty("java.home")

                    + SEP + "lib" + SEP + "security");

            file = new File(dir, "jssecacerts");

            if (file.isFile() == false) {

                file = new File(dir, "cacerts");

            }

        }

        System.out.println("Loading KeyStore " + file + "...");

        final InputStream in = new FileInputStream(file);

        final KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

        ks.load(in, passphrase);

        in.close();

        final SSLContext context = SSLContext.getInstance("TLS");

        final TrustManagerFactory tmf =

                TrustManagerFactory.getInstance(TrustManagerFactory

                        .getDefaultAlgorithm());

        tmf.init(ks);

        final X509TrustManager defaultTrustManager =

                (X509TrustManager) tmf.getTrustManagers()[0];

        final SavingTrustManager tm = new SavingTrustManager(

                defaultTrustManager);

        context.init(null, new TrustManager[] { tm }, null);

        final SSLSocketFactory factory = context.getSocketFactory();

        System.out.println("Opening connection to "

                + host + ":" + port + "...");

        final SSLSocket socket = (SSLSocket) factory.createSocket(host, port);

        socket.setSoTimeout(10000);

        try {

            System.out.println("Starting SSL handshake...");

            socket.startHandshake();

            socket.close();

            System.out.println();

            System.out.println("No errors, certificate is already trusted");

        } catch (final SSLException e) {

            System.out.println();

            e.printStackTrace(System.out);

        }

        final X509Certificate[] chain = tm.chain;

        if (chain == null) {

            System.out.println("Could not obtain server certificate chain");

            return;

        }

        final BufferedReader reader =

                new BufferedReader(new InputStreamReader(System.in));

        System.out.println();

        System.out.println("Server sent " + chain.length + " certificate(s):");

        System.out.println();

        final MessageDigest sha1 = MessageDigest.getInstance("SHA1");

        final MessageDigest md5 = MessageDigest.getInstance("MD5");

        for (int i = 0; i < chain.length; i++) {

            final X509Certificate cert = chain[i];

            System.out.println(" " + (i + 1) + " Subject "

                    + cert.getSubjectDN());

            System.out.println("   Issuer  " + cert.getIssuerDN());

            sha1.update(cert.getEncoded());

            System.out.println("   sha1    " + toHexString(sha1.digest()));

            md5.update(cert.getEncoded());

            System.out.println("   md5     " + toHexString(md5.digest()));

            System.out.println();

        }

        System.out.println("Enter certificate to add to trusted keystore"

                + " or 'q' to quit: [1]");

        final String line = reader.readLine().trim();

        int k;

        try {

            k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;

        } catch (final NumberFormatException e) {

            System.out.println("KeyStore not changed");

            return;

        }

        final X509Certificate cert = chain[k];

        final String alias = host + "-" + (k + 1);

        ks.setCertificateEntry(alias, cert);

        final OutputStream out = new FileOutputStream(file);

        ks.store(out, passphrase);

        out.close();

        System.out.println();

        System.out.println(cert);

        System.out.println();

        System.out.println(

                "Added certificate to keystore 'cacerts' using alias '"

                        + alias + "'");

    }

    private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

    private static String toHexString(final byte[] bytes) {

        final StringBuilder sb = new StringBuilder(bytes.length * 3);

        for (int b : bytes) {

            b &= 0xff;

            sb.append(HEXDIGITS[b >> 4]);

            sb.append(HEXDIGITS[b & 15]);

            sb.append(' ');

        }

        return sb.toString();

    }

    private static class SavingTrustManager implements X509TrustManager {

        private final X509TrustManager tm;

        private X509Certificate[] chain;

        SavingTrustManager(final X509TrustManager tm) {

            this.tm = tm;

        }

        @Override

        public X509Certificate[] getAcceptedIssuers() {

            return new X509Certificate[0];

            // throw new UnsupportedOperationException();

        }

        @Override

        public void checkClientTrusted(final X509Certificate[] chain,

                final String authType)

                throws CertificateException {

            throw new UnsupportedOperationException();

        }

        @Override

        public void checkServerTrusted(final X509Certificate[] chain,

                final String authType)

                throws CertificateException {

            this.chain = chain;

            this.tm.checkServerTrusted(chain, authType);

        }

    }

}

資料來源
http://infposs.blogspot.tw/2013/06/installcert-and-java-7.html

Jhystart

2014年8月27日星期三

InstallCert javax.net.ssl.SSLException: java.lang.UnsupportedOperationException in JAVA7

2014年5月13日星期二

IREPORT UUID 之亂

2014年4月6日星期日

WinSCP FTP command script batch file FTP批次下載檔案

2014年8月27日 星期三