Https雙向認證Android客戶端配置

阿新 • • 發佈：2019-01-12

Https雙向認證啊做了兩遍，第一遍懵懂狀態處於好不容易做好了，換伺服器，一下子懵了，使出渾身解數又找了一遍，這下終於好了快哭啦快哭了，必須滴要記錄一下，以免以後遇到繼續懵，這裡用retrofit2+okhttp3為例子來簡單說明下

先來說說證書：

服務端提供的證書有四個(我這裡四個就夠用了，有的上面介紹說有一個p12證書，原來提供過，表示沒用到，可能是我用的驗證方法不一樣吧)

轉化步驟：

1）生成客戶端證書

keytool -genkeypair -alias client -keyalg RSA -validity 3650 -keypass123456 -storepass 123456 -keystore client.jks

這裡要說一下，client.jks後端的同事已經提供給我，這一步我就省啦，如果沒提供的話走一步就行啦

2）生成服務端keystore

keytool -genkeypair -alias server -keyalg RSA -validity 3650 -keypass 123456 -storepass123456 -keystore server.keystore

這個也提供啦，我也省了哈

3）匯出客戶端證書
keytool -export -alias client -file client.cer -keystore client.jks -storepass 123456

這裡根據本人理解是將客戶端的jks證書匯入到服務端cer證書中

4）匯出服務端證書
keytool -export -alias server -file server.cer -keystore server.keystore -storepass 123456

這裡本人理解是將cer證書匯入到keystore中（這裡感覺理解的不是很透徹，勿噴）

5）證書交換
將客戶端證書匯入服務端keystore中，再將服務端證書匯入客戶端keystore中，一個keystore可以匯入多個證書，生成證書列表。
生成客戶端信任證書庫(由服務端證書生成的證書庫)：
keytool -import -v -alias server -file server.cer -keystore truststore.jks -storepass 123456

將客戶端證書匯入到伺服器證書庫(使得伺服器信任客戶端證書)：
keytool -import -v -alias client -file client.cer -keystore server.keystore -storepass 123456

6）轉換jks證書為Android能夠識別的BKS證書

將client.jks和truststore.jks通過portecle-1.9軟體轉換為.bks檔案

步驟：開啟portecle.jar檔案(window系統的，直接開啟是壓縮包哦，要選擇開啟方式用java方式開啟，或者直接切換到mac系統轉換好了再貼上回來即可)

注意：我這裡轉換client.jks的時候回報錯的哦

java.security.KeyStoreException: java.io.IOException: Error initialising store of key store: java.security.InvalidKeyException: Illegal key size 這個尚未明白什麼意思，就換了一個方法生成client.bks檔案了 7）生成客戶端bks檔案
keytool -importcert -trustcacerts -keystore E:\newkey\client.bks -file E:\keyhttps\server.cer -storetype BKS -provider org.bouncycastle.jce.provider.BouncyCastleProvider 這個要在JDK目錄下：C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext中新增bcprov-ext-jdk15on-146.jar包檔案（這個根據不同的jdk版本找對應的，這個搜一下就行啦） 8）將client.bks,truststore.bks，以及server.cercopy到工程的Assets下完成驗證 9）專案中的配置 Application檔案

import android.app.Application;
import android.os.Environment;
import android.os.Process;
import android.util.Log;

import com.baidu.mapapi.SDKInitializer;
import com.franmontiel.persistentcookiejar.ClearableCookieJar;
import com.franmontiel.persistentcookiejar.PersistentCookieJar;
import com.franmontiel.persistentcookiejar.cache.SetCookieCache;
import com.franmontiel.persistentcookiejar.persistence.SharedPrefsCookiePersistor;
import com.zhy.http.okhttp.OkHttpUtils;
import com.zhy.http.okhttp.https.HttpsUtils;
import com.zhy.http.okhttp.log.LoggerInterceptor;

import org.wlf.filedownloader.FileDownloadConfiguration;
import org.wlf.filedownloader.FileDownloader;

import java.io.File;
import java.io.IOException;
import java.io.InputStream;
import java.util.concurrent.TimeUnit;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;

import okhttp3.OkHttpClient;

import static android.content.ContentValues.TAG;
/**
 * Created by Jane on 2017/6/23.
 */
public class HNAPPlication extends Application {
    private final static String CLIENT_PRI_KEY = "client.bks";
    private final static String TRUSTSTORE_PUB_KEY = "truststore.bks";
    private final static String SERVER_KEY = "server.cer";

    @Override
    public void onCreate() {
        super.onCreate();
        initOkhttp();
        // 在使用 SDK 各組間之前初始化 context 資訊，傳入 ApplicationContext
       
        checkAppReplacingState();

    }

    private void checkAppReplacingState() {
        if (getResources() == null) {
            Log.w(TAG, "app is replacing...kill");
            Process.killProcess(Process.myPid());
        }
    }

    private void initOkhttp() {
        //InputStream [] inputStreams=null;
        ClearableCookieJar cookieJar1 = new PersistentCookieJar(new SetCookieCache(), new SharedPrefsCookiePersistor(getApplicationContext()));
//        inputStreams = new InputStream[4];
//        try {
////        inputStreams[0] = getClass().getResourceAsStream("/assets/newkey.cer");
//            inputStreams[0] = getAssets().open("newkey.cer");
//        } catch (IOException e) {
//            e.printStackTrace();
//        }
        //讀取證書
        try {
            InputStream clientkey = getAssets().open(CLIENT_PRI_KEY);
            InputStream serverkey = getAssets().open(TRUSTSTORE_PUB_KEY);
            InputStream[] inputStreams = new InputStream[4];
//            inputStreams[0] = getClass().getResourceAsStream("/assets/" + SERVER_KEY);
                inputStreams[0] = getAssets().open(SERVER_KEY);


            HttpsUtils.SSLParams sslParams = HttpsUtils.getSslSocketFactory(inputStreams, clientkey, "Eastcom_1");
//        CookieJarImpl cookieJar1 = new CookieJarImpl(new MemoryCookieStore());
            OkHttpClient okHttpClient = new OkHttpClient.Builder()
                    .connectTimeout(10000L, TimeUnit.MILLISECONDS)
                    .readTimeout(10000L, TimeUnit.MILLISECONDS)
                    .addInterceptor(new LoggerInterceptor("TAG"))
                    .cookieJar(cookieJar1)
                    .hostnameVerifier(new HostnameVerifier() {
                        @Override
                        public boolean verify(String hostname, SSLSession session) {
                            return true;
                        }
                    })
                    .sslSocketFactory(sslParams.sSLSocketFactory, sslParams.trustManager)
                    .build();
            OkHttpUtils.initClient(okHttpClient);
        } catch (IOException e) {
            e.printStackTrace();
        }


    }




}

HttpsUtil類

public class HttpsUtils
{
    public static class SSLParams
    {
        public SSLSocketFactory sSLSocketFactory;
        public X509TrustManager trustManager;
    }

    public static SSLParams getSslSocketFactory(InputStream[] certificates, InputStream bksFile, String password)
    {
        SSLParams sslParams = new SSLParams();
        try
        {
            TrustManager[] trustManagers = prepareTrustManager(certificates);
            KeyManager[] keyManagers = prepareKeyManager(bksFile, password);
            SSLContext sslContext = SSLContext.getInstance("TLS");
            X509TrustManager trustManager = null;
            if (trustManagers != null)
            {
                trustManager = new MyTrustManager(chooseTrustManager(trustManagers));
            } else
            {
                trustManager = new UnSafeTrustManager();
            }
            sslContext.init(keyManagers, new TrustManager[]{trustManager},null);
            sslParams.sSLSocketFactory = sslContext.getSocketFactory();
            sslParams.trustManager = trustManager;
            return sslParams;
        } catch (NoSuchAlgorithmException e)
        {
            throw new AssertionError(e);
        } catch (KeyManagementException e)
        {
            throw new AssertionError(e);
        } catch (KeyStoreException e)
        {
            throw new AssertionError(e);
        }
    }

    private class UnSafeHostnameVerifier implements HostnameVerifier
    {
        @Override
        public boolean verify(String hostname, SSLSession session)
        {
            return true;
        }
    }

    private static class UnSafeTrustManager implements X509TrustManager
    {
        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException
        {
        }

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType)
                throws CertificateException
        {
        }

        @Override
        public X509Certificate[] getAcceptedIssuers()
        {
            return new java.security.cert.X509Certificate[]{};
        }
    }

    private static TrustManager[] prepareTrustManager(InputStream... certificates)
    {
        if (certificates == null || certificates.length <= 0) return null;
        try
        {

            CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            keyStore.load(null);
            int index = 0;
            for (InputStream certificate : certificates)
            {
                String certificateAlias = Integer.toString(index++);
                keyStore.setCertificateEntry(certificateAlias, certificateFactory.generateCertificate(certificate));
                try
                {
                    if (certificate != null)
                        certificate.close();
                } catch (IOException e)

                {
                }
            }
            TrustManagerFactory trustManagerFactory = null;

            trustManagerFactory = TrustManagerFactory.
                    getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(keyStore);

            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();

            return trustManagers;
        } catch (NoSuchAlgorithmException e)
        {
            e.printStackTrace();
        } catch (CertificateException e)
        {
            e.printStackTrace();
        } catch (KeyStoreException e)
        {
            e.printStackTrace();
        } catch (Exception e)
        {
            e.printStackTrace();
        }
        return null;

    }

    private static KeyManager[] prepareKeyManager(InputStream bksFile, String password)
    {
        try
        {
            if (bksFile == null || password == null) return null;

            KeyStore clientKeyStore = KeyStore.getInstance("BKS");
            clientKeyStore.load(bksFile, password.toCharArray());
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(clientKeyStore, password.toCharArray());
            return keyManagerFactory.getKeyManagers();

        } catch (KeyStoreException e)
        {
            e.printStackTrace();
        } catch (NoSuchAlgorithmException e)
        {
            e.printStackTrace();
        } catch (UnrecoverableKeyException e)
        {
            e.printStackTrace();
        } catch (CertificateException e)
        {
            e.printStackTrace();
        } catch (IOException e)
        {
            e.printStackTrace();
        } catch (Exception e)
        {
            e.printStackTrace();
        }
        return null;
    }

    private static X509TrustManager chooseTrustManager(TrustManager[] trustManagers)
    {
        for (TrustManager trustManager : trustManagers)
        {
            if (trustManager instanceof X509TrustManager)
            {
                return (X509TrustManager) trustManager;
            }
        }
        return null;
    }


    private static class MyTrustManager implements X509TrustManager
    {
        private X509TrustManager defaultTrustManager;
        private X509TrustManager localTrustManager;

        public MyTrustManager(X509TrustManager localTrustManager) throws NoSuchAlgorithmException, KeyStoreException
        {
            TrustManagerFactory var4 = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            var4.init((KeyStore) null);
            defaultTrustManager = chooseTrustManager(var4.getTrustManagers());
            this.localTrustManager = localTrustManager;
        }


        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException
        {

        }

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException
        {
            try
            {
                defaultTrustManager.checkServerTrusted(chain, authType);
            } catch (CertificateException ce)
            {
                localTrustManager.checkServerTrusted(chain, authType);
            }
        }


        @Override
        public X509Certificate[] getAcceptedIssuers()
        {
            return new X509Certificate[0];
        }
    }
}

Net請求配置

/**
 * Created by Jane on 2017/6/16.
 * 網路請求Api
 */
public class NetHttpApi {
    private Retrofit retrofit;
    //請求超時時間
    private static final int REQUEST_TIME = 10;
    private static NetHttpApi instance;
    private Context context;
    private OkHttpClient okHttpClient;
    private   InputStream[] inputStreams;
    private SSLSocketFactory sslSocketFactory;

    /**
     * @param urlType url訪問地址型別
     **/
    private NetHttpApi(int urlType, Context context) {
        this.context = context;
//        //日誌顯示級別
        Gson gson = new GsonBuilder()
                .setLenient()
                .create();
        OkHttpClient client = aa();
        if (urlType == Contants.OLD_URL_TYPE) {
            retrofit = new Retrofit.Builder().client(client)
                    .addConverterFactory(GsonConverterFactory.create(gson))
                    .addCallAdapterFactory(RxJavaCallAdapterFactory.create())
                    .baseUrl(Contants.APP_OLD_URL).build();
        } else if (urlType == Contants.NEW_URL_TYPE) {
            retrofit = new Retrofit.Builder().client(client)
                    .addConverterFactory(GsonConverterFactory.create(gson))
                    .addCallAdapterFactory(RxJavaCallAdapterFactory.create())
                    .baseUrl(Contants.APP_URL).build();
        }
    }

    private OkHttpClient aa() {
        //日誌顯示級別
        HttpLoggingInterceptor.Level level = HttpLoggingInterceptor.Level.BODY;
        //新建log攔截器
        HttpLoggingInterceptor loggingInterceptor = new HttpLoggingInterceptor(new HttpLoggingInterceptor.Logger() {
            @Override
            public void log(String message) {
                Log.d("vvvvvvvvv", "OkHttp====Message==:" + message);
            }
        });
        loggingInterceptor.setLevel(level);
        OkHttpClient okHttpClient = new OkHttpClient.Builder()
                .sslSocketFactory(SSLHelper.getSSLCertifcation(context))
                .hostnameVerifier(new UnSafeHostnameVerifier())
                .addInterceptor(loggingInterceptor)
                .build();
        return okHttpClient;
    }
    /**
     * 建立單例模式，避免重複建立物件
     **/
    public static NetHttpApi getInstance(final int urlType, Context context) {
//        if (instance == null) {
//            synchronized (NetHttpApi.class) {
//                if (instance == null) {
//                    instance = new NetHttpApi(urlType,context);
//                }
//            }
//        }
        NetHttpApi netHttpApi = new NetHttpApi(urlType, context);
        return netHttpApi;
    }

    /**
     * 獲取一個service物件
     */
    public <T> T getService(Class<T> service) {
        return retrofit.create(service);
    }
}

SSLHelper

public class SSLHelper {
    private final static String CLIENT_PRI_KEY = "client.bks";
    private final static String TRUSTSTORE_PUB_KEY = "truststore.bks";
    private final static String CLIENT_BKS_PASSWORD = "Eastcom_1";
    private final static String TRUSTSTORE_BKS_PASSWORD = "Eastcom_1";
    private final static String KEYSTORE_TYPE = "BKS";
    private final static String PROTOCOL_TYPE = "TLS";
    private final static String CERTIFICATE_STANDARD = "X509";

    public static SSLSocketFactory getSSLCertifcation(Context context) {
        SSLSocketFactory sslSocketFactory = null;
        try {
            // 伺服器端需要驗證的客戶端證書，其實就是客戶端的keystore
            KeyStore keyStore = KeyStore.getInstance(KEYSTORE_TYPE);
            // 客戶端信任的伺服器端證書
            KeyStore trustStore = KeyStore.getInstance(KEYSTORE_TYPE);
            //讀取證書
            InputStream ksIn = context.getAssets().open(CLIENT_PRI_KEY);
            InputStream tsIn = context.getAssets().open(TRUSTSTORE_PUB_KEY);

            //載入證書
            keyStore.load(ksIn, CLIENT_BKS_PASSWORD.toCharArray());
            trustStore.load(tsIn, TRUSTSTORE_BKS_PASSWORD.toCharArray());
            ksIn.close();
            tsIn.close();

            //初始化SSLContext
            SSLContext sslContext = SSLContext.getInstance(PROTOCOL_TYPE);
            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(CERTIFICATE_STANDARD);
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(CERTIFICATE_STANDARD);
            trustManagerFactory.init(trustStore);
            keyManagerFactory.init(keyStore, CLIENT_BKS_PASSWORD.toCharArray());
            sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);
            sslSocketFactory = sslContext.getSocketFactory();
        } catch (KeyStoreException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        } catch (CertificateException e) {
            e.printStackTrace();
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (UnrecoverableKeyException e) {
            e.printStackTrace();
        } catch (KeyManagementException e) {
            e.printStackTrace();
        }
        return sslSocketFactory;
    }
}

這是配置檔案，其他專案類需要的話私我

Https雙向認證Android客戶端配置

Https雙向認證Android客戶端配置

JAX-RS RESTful webservice 服務端及客戶端實現(基於HTTPS雙向認證)

如何用Tomcat和Openssl構建HTTPS雙向認證環境（HTTPS客戶端認證）

OpenLDAP客戶端配置，實現用戶認證(原創)

XMPP學習——Android客戶端與openfire伺服器單雙向TLS通訊

實現PHP伺服器+Android客戶端（Retrofit+RxJava）第三天Retrofit的配置以及快取的實現

Tomcat伺服器配置https雙向認證

Android 客戶端 okhttp3 與伺服器之間的雙向驗證

Apache下配置https雙向認證

Android Https雙向認證 + GRPC

tomcat8配置https雙向認證

SSL--用Tomcat伺服器配置https雙向認證過程實戰

android客戶端直接呼叫芝麻信用的人臉認證

微軟Windows2008 AD+NPS配合無線控制器採用PEAP認證無線客戶端的配置（1）

Android客戶端與Java tomcat之間HTTPS通訊

用Tomcat伺服器配置https雙向認證過程實戰

HTTPS雙向認證+USB硬體加密鎖（加密狗）配置

NTP服務器搭建和客戶端配置

CnetOS 6.6 rsync 的服務端和客戶端配置

WSUS服務器客戶端配置說明

Https雙向認證Android客戶端配置

相關推薦