|
@@ -0,0 +1,90 @@
|
|
|
+package com.persagy.util;
|
|
|
+
|
|
|
+import lombok.extern.slf4j.Slf4j;
|
|
|
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
|
|
|
+import org.bouncycastle.openssl.PEMReader;
|
|
|
+
|
|
|
+import javax.net.ssl.KeyManagerFactory;
|
|
|
+import javax.net.ssl.SSLContext;
|
|
|
+import javax.net.ssl.SSLSocketFactory;
|
|
|
+import javax.net.ssl.TrustManagerFactory;
|
|
|
+import java.io.ByteArrayInputStream;
|
|
|
+import java.io.InputStreamReader;
|
|
|
+import java.nio.file.Files;
|
|
|
+import java.nio.file.Paths;
|
|
|
+import java.security.KeyPair;
|
|
|
+import java.security.KeyStore;
|
|
|
+import java.security.Security;
|
|
|
+import java.security.cert.X509Certificate;
|
|
|
+
|
|
|
+/**
|
|
|
+ * @author lgy
|
|
|
+ * @date 2022/03/22 11:25
|
|
|
+ */
|
|
|
+@Slf4j
|
|
|
+public class SslUtils {
|
|
|
+ public static SSLSocketFactory getSocketFactory(final String caCrtFile, final String clientCrtFile, final String keyFile,
|
|
|
+ final String password) throws Exception {
|
|
|
+ log.warn("caCrtFile:[{}],clientCrtFile:[{}],keyFile:[{}],password:[{}],",caCrtFile,clientCrtFile,keyFile,password);
|
|
|
+ Security.addProvider(new BouncyCastleProvider());
|
|
|
+ X509Certificate caCert = null;
|
|
|
+ X509Certificate cert = null;
|
|
|
+ KeyPair key = null;
|
|
|
+ if (caCrtFile != null) {
|
|
|
+ // 加载 CA 证书
|
|
|
+ log.info("加载CA证书 路径:{}",caCrtFile);
|
|
|
+ PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(caCrtFile)))));
|
|
|
+ caCert = (X509Certificate) reader.readObject();
|
|
|
+ reader.close();
|
|
|
+ }
|
|
|
+
|
|
|
+ if (clientCrtFile != null) {
|
|
|
+ // 加载 客户端 证书
|
|
|
+ log.info("加载客户端证书 路径:{}",clientCrtFile);
|
|
|
+
|
|
|
+ PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(clientCrtFile)))));
|
|
|
+ cert = (X509Certificate) reader.readObject();
|
|
|
+ reader.close();
|
|
|
+ }
|
|
|
+
|
|
|
+ if (keyFile != null) {
|
|
|
+ // 加载 客户端 私钥
|
|
|
+ log.info("加载客户端私钥 路径:{}",clientCrtFile);
|
|
|
+ PEMReader reader = new PEMReader(
|
|
|
+ new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(keyFile)))),
|
|
|
+ password::toCharArray);
|
|
|
+ key = (KeyPair) reader.readObject();
|
|
|
+ reader.close();
|
|
|
+ }
|
|
|
+
|
|
|
+ TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
|
|
|
+ if (caCert != null) {
|
|
|
+ // CA证书用于对服务器进行认证
|
|
|
+ log.info("CA证书用于对服务器进行认证");
|
|
|
+ KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
|
|
|
+ caKs.load(null, null);
|
|
|
+ caKs.setCertificateEntry("ca-certificate", caCert);
|
|
|
+ tmf.init(caKs);
|
|
|
+ } else {
|
|
|
+ log.info("使用系统默认的安全证书");
|
|
|
+ //使用系统默认的安全证书
|
|
|
+ tmf.init((KeyStore) null);
|
|
|
+ }
|
|
|
+ KeyManagerFactory kmf = null;
|
|
|
+ if (key != null && cert != null) {
|
|
|
+ kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
|
|
|
+ // 客户端密钥和证书被发送到服务器,以便服务器对我们进行身份验证
|
|
|
+ KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
|
|
|
+ ks.load(null, null);
|
|
|
+ ks.setCertificateEntry("certificate", cert);
|
|
|
+ ks.setKeyEntry("private-key", key.getPrivate(), password.toCharArray(), new java.security.cert.Certificate[]{cert});
|
|
|
+ kmf.init(ks, password.toCharArray());
|
|
|
+ }
|
|
|
+ log.info("创建SSL套接字");
|
|
|
+ // 最后,创建SSL套接字,注意协议版本
|
|
|
+ SSLContext context = SSLContext.getInstance("SSL");
|
|
|
+ context.init(kmf == null ? null : kmf.getKeyManagers(), tmf.getTrustManagers(), null);
|
|
|
+ return context.getSocketFactory();
|
|
|
+ }
|
|
|
+}
|
|
|
+
|