Java11实现X509TrustManager报错SSLHandshakeException分析及解决办法

最近在学习用java实现HTTPS协议，Client用HttpsURLConnection来发起访问。传给SSLContext的TrustManager是我自己实现的一个简单的X509TrustManager，按照以往经验将checkClientTrusted和checkServerTrusted重写为空函数，getAcceptedIssuers方法直接返回null。本以为不会再有认证服务器的错误，但依然报错如下：

Exception in thread "main" javax.net.ssl.SSLHandshakeException: No subject alternative names presentat java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:352)at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:295)at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:290)at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:171)at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1359)at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1268)at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:401)at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:373)at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:567)at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1592)at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1520)at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:250)at com.company.SimpleHTTPClient.main(SimpleHTTPClient.java:52)
Caused by: java.security.cert.CertificateException: No subject alternative names presentat java.base/sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:142)at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:101)at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:429)at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1544)at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1511)at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)... 17 more

我使用的Java版本是Java 11.0.10，先给出解决办法：

X509TrustManager trustManager = new X509TrustManager() {

...

}

改为

X509TrustManager trustManager = new X509ExtendedTrustManager() {

...

}

有兴趣了解分析过程的小伙伴可以接着看下面内容。

调试观察函数调用栈，发现调用CertificateMessage.checkServerCerts()方法时，会调用tm.checkServerTrusted()，但这个tm是sun.security.ssl.X509TrustManagerImpl，而不是我传进去自己实现的X509TrustManager。

为了找出原因，再跟踪SSLContext.init()过程。sun.security.ssl.SSLContextImpl.engineInit()方法中通过this.trustManager = this.chooseTrustManager(tm)的带SSL上下文的trustManager。下面是chooseTrustManager方法的代码。

private X509TrustManager chooseTrustManager(TrustManager[] tm) throws KeyManagementException {for(int i = 0; tm != null && i < tm.length; ++i) {if (tm[i] instanceof X509TrustManager) {if (SunJSSE.isFIPS() && !(tm[i] instanceof X509TrustManagerImpl)) {throw new KeyManagementException("FIPS mode: only SunJSSE TrustManagers may be used");}if (tm[i] instanceof X509ExtendedTrustManager) {return (X509TrustManager)tm[i];}return new AbstractTrustManagerWrapper((X509TrustManager)tm[i]);}}return DummyX509TrustManager.INSTANCE;
}

可以看到，如果我们实现的是X509TrustManager，而不是一个X509ExtendedTrustManager，调用返回new AbstractTrustManagerWrapper((X509TrustManager)tm[i])；因此我需要实现的是X509ExtendedTrustManager而不止是X509TrustManager。

Java11实现X509TrustManager报错SSLHandshakeException分析及解决办法相关推荐

MySQL server has gone away报错原因分析及解决办法
原因1. MySQL 服务宕了判断是否属于这个原因的方法很简单,执行以下命令,查看mysql的运行时长 $ mysql -uroot -p -e "show global status l ...
oracle中00604,【案例】Oracle无法启动报错ORA-00604 ORA-01578官方解决办法
天萃荷净 Oracle研究中心案例分析:运维DBA反映Oracle数据库无法启动并报错ORA-00604 ORA-01578,分析原因为遇核心对象bootstrap$有坏块的解决办法.change b ...
oracle 6508,【案例】Oracle报错ORA-06552 ORA-06553 ORA-006508解决办法
天萃荷净 Oracle研究中心案例分析:运维DBA反映Oracle数据库alert日志中出现大量ORA-06552 ORA-06553 ORA-006508报错,分析原因为存储过程异常导致,结合MOS ...
安装32位mysql报错_在CentOS中安装32位或64位MySql报错error: Failed dependencies解决办法...
在CentOS中安装MySql报错error: Failed dependencies解决办法安装64位MySql报错内容如下: error: Failed dependencies: libaio ...
java 报错404_Javaweb工程运行报错HTTP Status 404解决办法
最近在学习jsp和servlet,避免不了的要和tomcat打交道,但tomcat经常会出现各式各样的错误,下面是我总结的一些常见的解决方法,希望对大家有用. 1．未部署web应用 2．url输入错误 ...
pandas.read_csv() 报错 OSError: Initializing from file failed，报错原因分析和解决方法
今天调用pandas读取csv文件时,突然报错" OSError: Initializing from file failed ",我是有点奇怪的,以前用的好好的,read_csv ...
mysql报错 DuplicateKeyException分析与解决
在做数据库同步的时候,发现一个错误,mysql报错如下: org.springframework.dao.DuplicateKeyException: ### Error updating datab ...
lamuda表达式 list移除空元素_java8 Lambda表达式遍历并移除元素，报错：ConcurrentModificationException的解决办法...
1.情景展示已知json对象MainExt 需要把值为空数组的key移除掉,下面是执行代码执行结果报错:java.util.ConcurrentModificationException 2.原因 ...
Cannot assign to read only property ‘0’ of string的报错原因之一及解决办法
一. 需求场景现有项目,需要对提交资料的人员进行审核,审核不过的时候向服务器提交数据,数据结构中的certificationStatus需为JSON格式 1.1 资料信息结构如下: auditFai ...

Java11实现X509TrustManager报错SSLHandshakeException分析及解决办法

Java11实现X509TrustManager报错SSLHandshakeException分析及解决办法相关推荐

最新文章

热门文章