Java implementation of SSL mutual authentication
SSL protocol handshake agreement into a two-way one-way authentication and certification, including mutual authentication with a variety of implementations, the following describes how Java implementation of SSL mutual authentication.
Simulation scenarios:
Server-side and Client-side communications, the need for identity verification and authorization, that only accept messages Client Server and Client Server can only accept messages.
Technical realization:
JSSE ( the Java Security the Socket Extension)
is the Sun in order to solve secure communications on the Internet and the introduction of solutions. It implements the SSL and the TSL (Transport Layer Security) protocol. JSSE includes the data encryption, server authentication, client authentication, and message integrity techniques. By using JSSE, developers can TCP / IP protocol to transfer data between the client and secure server.
In order to achieve message authentication.
Server requires:
1) KeyStore: where to save the server's private key
2) Trust KeyStore: which authority certificates saved the client
the same, Client needs:
1) KeyStore: which hold the client's private key
2) Trust KeyStore: which authority certificates stored server-side
Here I recommend the use of Java comes with keytool command to generate such information file. Of course, the current generation of very popular open source SSL certificate as well as for OpenSSL. OpenSSL using C language written across systems. But we may consider the convenience of java program used to generate the certificate at a later process, or use the built-in JDK keytool.
1) generation server private key, and imported to the server KeyStore file
keytool -genkey -alias serverkey -keystore kserver.keystore
process, they are required to complete, according to the needs of their own settings on the line
keystore password: 123456
Name and Last Name: jin
organizational unit name: none
organization name: none
city or region name: BJ
state or province name: BJ
country Code: CN
serverkey private key password, and do not fill the same keystore password. We should be careful here, directly to Enter on the line, do not change your password. Otherwise, in the back of the program and can not be applied directly to the private key error.
You can generate kserver.keystore file
server.keystore to the server is used, which holds its own private key
2) According to the private key, export the server certificate
the keytool -export -alias -file serverkey -keystore kserver.keystore server.crt
server.crt end of that Certificate Services
3) The server certificate into the client's Trust KeyStore in
the keytool -import -alias -file serverkey server.crt -keystore tclient.keystore
tclient.keystore to the client is used, which holds a trusted certificate
Using the same method, the client generates a private key, the client certificate, and introduced into the service side of the Trust KeyStore
. 1) the keytool -alias -genkey ClientKey -keystore kclient.keystore
2) the keytool -export -alias ClientKey -keystore kclient.keystore - client.crt File
3) the keytool -import -alias -file client.crt -keystore tserver.keystore ClientKey
Thus, the resulting file into two
server save: kserver.keystore tserver.keystore
client save: kclient.keystore tclient.kyestore
The following is by Java Socket communication program to validate our generated certificate is available.
Client:
Client code
package examples.ssl;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.KeyStore;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.TrustManagerFactory;
/**
* SSL Client
*
*/
public class SSLClient {
private static final String DEFAULT_HOST = “127.0.0.1”;
private static final int DEFAULT_PORT = 7777;
private static final String CLIENT_KEY_STORE_PASSWORD = “123456”;
private static final String CLIENT_TRUST_KEY_STORE_PASSWORD = “123456”;
private SSLSocket sslSocket;
/**
* Start the client program
*
* @param args
*/
public static void main(String[] args) {
SSLClient client = new SSLClient();
init();
process();
}
/**
* Connected via ssl socket with the server, and sends a message
*/
public void process() {
if (sslSocket == null) {
out.println(“ERROR”);
return;
}
try {
InputStream input = sslSocket.getInputStream();
OutputStream output = sslSocket.getOutputStream();
BufferedInputStream bis = new BufferedInputStream(input);
BufferedOutputStream bos = new BufferedOutputStream(output);
write(“Client Message”.getBytes());
flush();
byte[] buffer = new byte[20];
read(buffer);
out.println(new String(buffer));
close();
} catch (IOException e) {
out.println(e);
}
}
/**
* <ul>
* <Li> Key ssl connection: </ li>
* <Li> Initialization SSLSocket </ li>
* <Li> Import private client KeyStore, import KeyStore (the certificate server) client trusted </ li>
* </ul>
*/
public void init() {
try {
SSLContext ctx = SSLContext.getInstance(“SSL”);
KeyManagerFactory kmf = KeyManagerFactory.getInstance(“SunX509”);
TrustManagerFactory tmf = TrustManagerFactory.getInstance(“SunX509”);
KeyStore ks = KeyStore.getInstance(“JKS”);
KeyStore tks = KeyStore.getInstance(“JKS”);
load(new FileInputStream(“E://kclient.keystore”), CLIENT_KEY_STORE_PASSWORD.toCharArray());
load(new FileInputStream(“E://tclient.keystore”), CLIENT_TRUST_KEY_STORE_PASSWORD.toCharArray());
init(ks, CLIENT_KEY_STORE_PASSWORD.toCharArray());
init(tks);
init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
sslSocket = (SSLSocket) ctx.getSocketFactory().createSocket(DEFAULT_HOST, DEFAULT_PORT);
} catch (Exception e) {
out.println(e);
}
}
}
Service-Terminal:
Java code
package examples.ssl;
import java.io.BufferedInputStream;
import java.io.BufferedOutputStream;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;
import java.security.KeyStore;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.TrustManagerFactory;
/***********************************************************************************************************************
* <ul>
* <Li> 1) to generate private server </ li>
* <li>keytool -genkey -alias serverkey -keystore kserver.keystore</li>
* <Li> 2) according to the private key, the server certificate around </ li>
* <li>keytool -exoport -alias serverkey -keystore kserver.keystore -file server.crt</li>
* <Li> 3) the certificate is added to the client trusted in the keystore </ li>
* <li>keytool -import -alias serverkey -file server.crt -keystore tclient.keystore</li>
* </ul>
**********************************************************************************************************************/
/**
* SSL Server
*
*/
public class SSLServer {
private static final int DEFAULT_PORT = 7777;
private static final String SERVER_KEY_STORE_PASSWORD = “123456”;
private static final String SERVER_TRUST_KEY_STORE_PASSWORD = “123456”;
private SSLServerSocket serverSocket;
/**
* starting program
*
* @param args
*/
public static void main(String[] args) {
SSLServer server = new SSLServer();
init();
start();
}
/**
* <ul>
* <li>听SSL Server Socket</li>
* <Li> Since the demonstration program is not Socket monitor, a simple form of single-threaded, and only accept messages of the client, the client and returns the specified message </ li>
* </ul>
*/
public void start() {
if (serverSocket == null) {
out.println(“ERROR”);
return;
}
while (true) {
try {
Socket s = serverSocket.accept();
InputStream input = s.getInputStream();
OutputStream output = s.getOutputStream();
BufferedInputStream bis = new BufferedInputStream(input);
BufferedOutputStream bos = new BufferedOutputStream(output);
byte[] buffer = new byte[20];
read(buffer);
out.println(new String(buffer));
write(“Server Echo”.getBytes());
flush();
close();
} catch (Exception e) {
out.println(e);
}
}
}
/**
* <ul>
* <Li> Key ssl connection: </ li>
* <Li> Initialization SSLServerSocket </ li>
* <Li> Importing server private key KeyStore, import KeyStore (the client's certificate) </ li> Trusted server
* </ul>
*/
public void init() {
try {
SSLContext ctx = SSLContext.getInstance(“SSL”);
KeyManagerFactory kmf = KeyManagerFactory.getInstance(“SunX509”);
TrustManagerFactory tmf = TrustManagerFactory.getInstance(“SunX509”);
KeyStore ks = KeyStore.getInstance(“JKS”);
KeyStore tks = KeyStore.getInstance(“JKS”);
load(new FileInputStream(“E://kserver.keystore”), SERVER_KEY_STORE_PASSWORD.toCharArray());
load(new FileInputStream(“E://tserver.keystore”), SERVER_TRUST_KEY_STORE_PASSWORD.toCharArray());
init(ks, SERVER_KEY_STORE_PASSWORD.toCharArray());
init(tks);
init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
serverSocket = (SSLServerSocket) ctx.getServerSocketFactory().createServerSocket(DEFAULT_PORT);
setNeedClientAuth(true);
} catch (Exception e) {
printStackTrace ();
}
}
}