较低的Android API的SSL的TrustManager设置较低、Andr、oid、TrustManager
2023-09-06 04:56:14
作者：26．萌界一把手
我有一个HTTPS的RPC的应用程序进行通信。 HTTP服务器使用的是CACERT签名的证书。
我使用的是自定义的TrustManager用于验证证书。
因为我不能肯定，CACERT包含在所有设备的受信任密钥存储区。 因为我想只允许CACERT签收此连接的证书。不过，我跟随谷歌的最佳实践的。 我唯一改变的是：
从一个静态的byte []，而不是一个文件加载CACERT根证书 替换的最后部分，其中例如code加载一个文件，与 HttpsURLConnection.setDefaultSSLSocketFactory（sslContext.getSocketFactory（））; 。对所用的URLConnection顶部的JSONRPC2的API。
设备进行测试：
在工作的Nexus 4 / MAKO运行API18 / CM10.2 在工作API18模拟器 在工作API17模拟器 在工作API14模拟器 不工作在HTC G2运行API10 / CM7。* 不工作在API8模拟器在低API设备失败验证SSL握手过程中的证书。
当试图加载 https://google.com 本的TrustManager 上API18，它未能按预期的，因为没有信任锚可以找到。
所以基本上，这code应该和所有的方法都是API1 ...
我知道，这是URLConnection的一些低级的API打破。
我该如何解决这个问题？
code：
/ **
*仅信任CACERT的CA. CA证书被注入为byte []的。继最佳实践
* https://developer.android.com/training/articles/security-ssl.html#UnknownCa
* /
私有静态无效trustCAcert（）{
尝试 {
从InputStream //装载的CA
CertificateFactory CF = CertificateFactory.getInstance（X.509）;
ByteArrayInputStream的是=新ByteArrayInputStream的（CACERTROOTDER）;
CA证书;
尝试 {
CA = cf.generateCertificate（是）;
Log.d（TAG，CA =，（（x509证书）CA）.getSubjectDN（））;
} 最后 {
is.close（）;
}
//创建一个包含我们的可信CA密钥库
串keyStoreType = KeyStore.getDefaultType（）;
密钥库的keyStore = KeyStore.getInstance（keyStoreType）;
keyStore.load（NULL，NULL）;
keyStore.setCertificateEntry（CA，CA）;
//创建一个的TrustManager一个信任的CA在我们的密钥库
串tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm（）;
的TrustManagerFactory TMF = TrustManagerFactory.getInstance（tmfAlgorithm）;
tmf.init（的keyStore）;
//创建一个使用我们的TrustManager一个的SSLContext
的SSL连接的SSL连接= SSLContext.getInstance（TLS）;
sslContext.init（空，tmf.getTrustManagers（），NULL）;
HttpsURLConnection.setDefaultSSLSocketFactory（
sslContext.getSocketFactory（））;
//添加仅用于测试
网址U =新的URL（
https://myremoteapiurlsignedwiththesamecert.com/v1/doc.html）;
HttpsURLConnection CON =（HttpsURLConnection）u.openConnection（）;
con.setSSLSocketFactory（sslContext.getSocketFactory（））;
BufferedReader中R =新的BufferedReader（
新的InputStreamReader（
con.getInputStream（）））; //异常被抛出在这里
//因为验证失败
串升;
而（（1- = r.readLine（））！= NULL）{
Log.d（TAG，L，L）;
}
}赶上（IOException异常E）{//没有一个例外的是在安装过程中引发
Log.e（TAG，IOException异常，E）;
}赶上（CertificateException E）{
Log.e（TAG，CertificateException，E）;
}赶上（抛出：NoSuchAlgorithmException E）{
Log.e（TAG，抛出：NoSuchAlgorithmException，E）;
}赶上（KeyStoreException E）{
Log.e（TAG，KeyStoreException，E）;
}赶上（KeyManagementException E）{
Log.e（TAG，KeyManagementException，E）;
}
}
日志：
APIUtilsðCA = OID.1.2.840.113549.1.9.1 =＃1612737570706F7274406361636572742E6F7267，CN = CA证书签名授权，OU = HTTP：//www.cacert.org，O =根CA
ËIOException异常
Ëjavax.net.ssl.SSLException：不被信任的服务器证书
Ë在org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake（OpenSSLSocketImpl.java:371）
吃org.apache.harmony.luni.internal.net.www.protocol.http.HttpConnection.getSecureSocket(HttpConnection.java:168)
吃org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:399)
吃org.apache.harmony.luni.internal.net.www.protocol.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:1152)
吃org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:253)
Ë在de.terminbuddy.android.network.APIUtils.trustCAcert（APIUtils.java:294）
Ë在de.terminbuddy.android.network.APIUtils.initRpcSession（APIUtils.java:243）
Ë在de.terminbuddy.android.network.APIUtils.runRPC（APIUtils.java:323）
Ë在de.terminbuddy.android.network.AsyncJSONRPCTask.doInBackground（AsyncJSONRPCTask.java:55）
Ë在de.terminbuddy.android.network.AsyncJSONRPCTask.doInBackground（AsyncJSONRPCTask.java:17）
Ë在android.os.AsyncTask $ 2.call（AsyncTask.java:185）
Ë在java.util.concurrent.FutureTask中$ Sync.innerRun（FutureTask.java:305）
Ë在java.util.concurrent.FutureTask.run（FutureTask.java:137）
Ë在java.util.concurrent.ThreadPoolExecutor.runWorker（ThreadPoolExecutor.java:1068）
Ë在java.util.concurrent.ThreadPoolExecutor中的$ Worker.run（ThreadPoolExecutor.java:561）
Ë在java.lang.Thread.run（Thread.java:1096）
E对：java.security.cert.CertificateException：java.security.cert.CertPathValidatorException：无法验证证书签名。
Ë在org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted（TrustManagerImpl.java:168）
Ë在org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake（OpenSSLSocketImpl.java:366）
Ë... 15个
E对：java.security.cert.CertPathValidatorException：无法验证证书签名。
吃org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:342)
Ë在java.security.cert.CertPathValidator.validate（CertPathValidator.java:202）
Ë在org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted（TrustManagerImpl.java:164）
Ë... 16个
E对：java.security.SignatureException：签名未验证。
Ë在org.apache.harmony.security.provider.cert.X509CertImpl.fastVerify（X509CertImpl.java:601）
Ë在org.apache.harmony.security.provider.cert.X509CertImpl.verify（X509CertImpl.java:544）
吃org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:337)
Ë... 18个
解决方案
我找到了一个解决这个问题：
看起来CRL验证某种断裂（API＆LT; 14/11）的。对CACERT的证书 SNI是涉及不支持的API＆LT; 8基本上我跑我自己的检查对API＆LT; 14与实施在这里找到：使用验证X509证书的Java API
私有静态最后的byte [] CACERTROOTDER =新的字节[] {
48，-126，7，61，48，-126，5，37，-96，3，2，1，2，2，1，0，
// ...
};
/ **
*从字节[]读X509认证的文件。
*
*参数字节DER格式的证书
* @返回证书
* /
私有静态x509证书getCertificate（最后一个字节[]字节）
抛出IOException异常，CertificateException {
CertificateFactory CF = CertificateFactory.getInstance（X.509）;
x509证书CA;
ByteArrayInputStream的是=新ByteArrayInputStream的（字节）;
尝试 {
CA =（x509证书）cf.generateCertificate（是）;
Log.d（TAG，CA =，ca.getSubjectDN（））;
} 最后 {
is.close（）;
}
返回CA;
}
/ **
*仅信任CACERT的CA. CA证书被注入为byte []的。继最佳实践
* https://developer.android.com/training/articles/security-ssl.html#UnknownCa
* /
私有静态无效trustCAcert（）
抛出KeyStoreException，IOException异常，
CertificateException，抛出：NoSuchAlgorithmException，
KeyManagementException {
//创建一个包含我们的可信CA密钥库
串keyStoreType = KeyStore.getDefaultType（）;
最后的密钥库的keyStore = KeyStore.getInstance（keyStoreType）;
keyStore.load（NULL，NULL）;
keyStore.setCertificateEntry（CACERT根，getCertificate（CACERTROOTDER））;
//如果你的httpd不发送完整的链条，3类证书添加到密钥存储区
// keyStore.setCertificateEntry（CACERT-3类，getCertificate（CACERTCLASS3DER））;
//创建一个的TrustManager一个信任的CA在我们的密钥库
最后的TrustManagerFactory TMF = TrustManagerFactory.getInstance（
TrustManagerFactory.getDefaultAlgorithm（））;
tmf.init（的keyStore）;
//创建一个使用我们的TrustManager一个的SSLContext
的SSL连接的SSL连接= SSLContext.getInstance（TLS）;
如果（Build.VERSION.SDK_INT＆GT; = Build.VERSION_ codeS.ICE_CREAM_SANDWICH）{
//可能工作在HC +，但没有AVD或设备，以测试它
sslContext.init（空，tmf.getTrustManagers（），NULL）;
} 其他 {
//貌似CLR是较低的API破碎。在这里实现了自己的检查：X
//看到http://stackoverflow.com/q/18713966/2331953
HttpsURLConnection.setDefaultHostnameVerifier（新的HostnameVerifier（）{
公共布尔验证（最后弦乐主机名，最终的SSLSession会话）{
尝试 {
//检查是否主机名匹配DN
串的dn = session.getPeerCertificateChain（）[0] .getSubjectDN（）的toString（）。
Log.d（TAG，DN =，DN）;
如果（Build.VERSION.SDK_INT＆GT; = Build.VERSION_ codeS.GINGERBREAD）{
返回dn.equals（CN =+主机名）;
} 其他 {
//没有SNI的API＆LT; 9，但我知道的第一个虚拟主机的主机名
返回dn.equals（CN =+主机名）
|| dn.equals（CN =+ hostname.replace（jsonrpc，休息））;
}
}赶上（例外五）{
Log.e（TAG，意外的异常，E）;
返回false;
}
}
}）;
//建立我们自己的信任管理器
X509TrustManager TM =新X509TrustManager（）{
公共x509证书[] getAcceptedIssuers（）{
// 没事做
返回新的X509证书[0];
}
@覆盖
公共无效checkClientTrusted（最终的X509Certificate []链，
最后弦乐的authType）
抛出CertificateException {
// 没事做
}
@覆盖
公共无效checkServerTrusted（最终的X509Certificate []链，
最后弦乐的authType）抛出CertificateException {
// 没事做
Log.d（TAG，checkServerTrusted（链））;
x509证书证书=链[0];
cert.checkValidity（）;
CertificateFactory CF = CertificateFactory.getInstance（X.509）;
ArrayList的＆LT; x509证书＆GT;名单=新的ArrayList＆LT; x509证书＆GT;（）;
list.add（证书）;
证书路径CP = cf.generateCertPath（名单）;
尝试 {
PKIXParameters实例PARAMS =新PKIXParameters实例（用于keyStore）;
params.setRevocationEnabled（假）; // CLR坏了，还记得吗？
的CertPathValidator CPV =的CertPathValidator
.getInstance（CertPathValidator.getDefaultType（））;
cpv.validate（CP，则params）;
}赶上（KeyStoreException E）{
Log.d（TAG，无效的密钥存储，E）;
抛出新CertificateException（E）;
}赶上（InvalidAlgorithmParameterException使用E）{
Log.d（TAG，无效的算法，E）;
抛出新CertificateException（E）;
}赶上（抛出：NoSuchAlgorithmException E）{
Log.d（TAG，没有这样的算法，E）;
抛出新CertificateException（E）;
}赶上（CertPathValidatorException E）{
Log.d（TAG，验证失败）;
抛出新CertificateException（E）;
}
Log.d（TAG，验证成功）;
}
};
sslContext.init（NULL，新X509TrustManager [] {} TM，NULL）;
}
HttpsURLConnection.setDefaultSSLSocketFactory（sslContext.getSocketFactory（））;
}
I have an app communicating with a HTTPS RPC. The HTTP server is using a CAcert signed certificate.
I'm using a custom TrustManager for validating the certificate.
Because I can not be sure, CAcert is included in all devices' trusted key store. Because I want to allow only CAcert to sign a certificate for this connection.However, I'm following Google's best practices. The only thing I changed is:
Load the CAcert root certificate from a static byte[] instead a file Replace the last part, where the example code loads a file, withHttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());. There is a JSONRPC2 API on top of the UrlConnection.
Devices tested:
working on Nexus 4 / mako running API18 / CM10.2 working on API18 emulator working on API17 emulator working on API14 emulator not working on a HTC G2 running API10 / CM7.* not working on API8 emulatorOn low API devices it fails verifying the certificate during SSL handshake.
When trying to load https://google.com with this TrustManager on API18, it fails as expected because no trust anchor could be found.
So basically, this code should work and all of the methods are API1...
I know, that UrlConnection was broken on some lower APIs.
How do I fix this?
Code:
/**
* Trust only CAcert's CA. CA cert is injected as byte[]. Following best practices from
* https://developer.android.com/training/articles/security-ssl.html#UnknownCa
*/
private static void trustCAcert() {
try {
// Load CAs from an InputStream
CertificateFactory cf = CertificateFactory.getInstance("X.509");
ByteArrayInputStream is = new ByteArrayInputStream(CACERTROOTDER);
Certificate ca;
try {
ca = cf.generateCertificate(is);
Log.d(TAG, "ca=", ((X509Certificate) ca).getSubjectDN());
} finally {
is.close();
}
// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);
// Create an SSLContext that uses our TrustManager
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tmf.getTrustManagers(), null);
HttpsURLConnection.setDefaultSSLSocketFactory(
sslContext.getSocketFactory());
// added for testing only
URL u = new URL(
"https://myremoteapiurlsignedwiththesamecert.com/v1/doc.html");
HttpsURLConnection con = (HttpsURLConnection) u.openConnection();
con.setSSLSocketFactory(sslContext.getSocketFactory());
BufferedReader r = new BufferedReader(
new InputStreamReader(
con.getInputStream())); // the exception is thrown here
// because verification fails
String l;
while ((l = r.readLine()) != null) {
Log.d(TAG, "l: ", l);
}
} catch (IOException e) { // none of the exceptions is thrown during setup
Log.e(TAG, "IOException", e);
} catch (CertificateException e) {
Log.e(TAG, "CertificateException", e);
} catch (NoSuchAlgorithmException e) {
Log.e(TAG, "NoSuchAlgorithmException", e);
} catch (KeyStoreException e) {
Log.e(TAG, "KeyStoreException", e);
} catch (KeyManagementException e) {
Log.e(TAG, "KeyManagementException", e);
}
}
Logs:
APIUtils D ca=OID.1.2.840.113549.1.9.1=#1612737570706F7274406361636572742E6F7267, CN=CA Cert Signing Authority, OU=http://www.cacert.org, O=Root CA
E IOException
E javax.net.ssl.SSLException: Not trusted server certificate
E at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:371)
E at org.apache.harmony.luni.internal.net.www.protocol.http.HttpConnection.getSecureSocket(HttpConnection.java:168)
E at org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:399)
E at org.apache.harmony.luni.internal.net.www.protocol.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:1152)
E at org.apache.harmony.luni.internal.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:253)
E at de.terminbuddy.android.network.APIUtils.trustCAcert(APIUtils.java:294)
E at de.terminbuddy.android.network.APIUtils.initRpcSession(APIUtils.java:243)
E at de.terminbuddy.android.network.APIUtils.runRPC(APIUtils.java:323)
E at de.terminbuddy.android.network.AsyncJSONRPCTask.doInBackground(AsyncJSONRPCTask.java:55)
E at de.terminbuddy.android.network.AsyncJSONRPCTask.doInBackground(AsyncJSONRPCTask.java:17)
E at android.os.AsyncTask$2.call(AsyncTask.java:185)
E at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
E at java.util.concurrent.FutureTask.run(FutureTask.java:137)
E at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1068)
E at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:561)
E at java.lang.Thread.run(Thread.java:1096)
E Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Could not validate certificate signature.
E at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:168)
E at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:366)
E ... 15 more
E Caused by: java.security.cert.CertPathValidatorException: Could not validate certificate signature.
E at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:342)
E at java.security.cert.CertPathValidator.validate(CertPathValidator.java:202)
E at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:164)
E ... 16 more
E Caused by: java.security.SignatureException: Signature was not verified.
E at org.apache.harmony.security.provider.cert.X509CertImpl.fastVerify(X509CertImpl.java:601)
E at org.apache.harmony.security.provider.cert.X509CertImpl.verify(X509CertImpl.java:544)
E at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:337)
E ... 18 more
解决方案
I found a solution for this problem:
It looks like CRL verification is some kind of broken (API<14/11) for CAcert's certificates. SNI is involved which is not supported in API<8.Basically I run my own checks on API<14 with the implementation found here: Validate X509 certificates using Java APis
private static final byte[] CACERTROOTDER = new byte[]{
48, -126, 7, 61, 48, -126, 5, 37, -96, 3, 2, 1, 2, 2, 1, 0,
// ...
};
/**
* Read x509 certificated file from byte[].
*
* @param bytes certificate in der format
* @return certificate
*/
private static X509Certificate getCertificate(final byte[] bytes)
throws IOException, CertificateException {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate ca;
ByteArrayInputStream is = new ByteArrayInputStream(bytes);
try {
ca = (X509Certificate) cf.generateCertificate(is);
Log.d(TAG, "ca=", ca.getSubjectDN());
} finally {
is.close();
}
return ca;
}
/**
* Trust only CAcert's CA. CA cert is injected as byte[]. Following best practices from
* https://developer.android.com/training/articles/security-ssl.html#UnknownCa
*/
private static void trustCAcert()
throws KeyStoreException, IOException,
CertificateException, NoSuchAlgorithmException,
KeyManagementException {
// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
final KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("CAcert-root", getCertificate(CACERTROOTDER));
// if your HTTPd is not sending the full chain, add class3 cert to the key store
// keyStore.setCertificateEntry("CAcert-class3", getCertificate(CACERTCLASS3DER));
// Create a TrustManager that trusts the CAs in our KeyStore
final TrustManagerFactory tmf = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm());
tmf.init(keyStore);
// Create an SSLContext that uses our TrustManager
SSLContext sslContext = SSLContext.getInstance("TLS");
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.ICE_CREAM_SANDWICH) {
// may work on HC+, but there is no AVD or device to test it
sslContext.init(null, tmf.getTrustManagers(), null);
} else {
// looks like CLR is broken in lower APIs. implement out own checks here :x
// see http://stackoverflow.com/q/18713966/2331953
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
public boolean verify(final String hostname, final SSLSession session) {
try {
// check if hostname matches DN
String dn = session.getPeerCertificateChain()[0].getSubjectDN().toString();
Log.d(TAG, "DN=", dn);
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.GINGERBREAD) {
return dn.equals("CN=" + hostname);
} else {
// no SNI on API<9, but I know the first vhost's hostname
return dn.equals("CN=" + hostname)
|| dn.equals("CN=" + hostname.replace("jsonrpc", "rest"));
}
} catch (Exception e) {
Log.e(TAG, "unexpected exception", e);
return false;
}
}
});
// build our own trust manager
X509TrustManager tm = new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() {
// nothing to do
return new X509Certificate[0];
}
@Override
public void checkClientTrusted(final X509Certificate[] chain,
final String authType)
throws CertificateException {
// nothing to do
}
@Override
public void checkServerTrusted(final X509Certificate[] chain,
final String authType) throws CertificateException {
// nothing to do
Log.d(TAG, "checkServerTrusted(", chain, ")");
X509Certificate cert = chain[0];
cert.checkValidity();
CertificateFactory cf = CertificateFactory.getInstance("X.509");
ArrayList<X509Certificate> list = new ArrayList<X509Certificate>();
list.add(cert);
CertPath cp = cf.generateCertPath(list);
try {
PKIXParameters params = new PKIXParameters(keyStore);
params.setRevocationEnabled(false); // CLR is broken, remember?
CertPathValidator cpv = CertPathValidator
.getInstance(CertPathValidator.getDefaultType());
cpv.validate(cp, params);
} catch (KeyStoreException e) {
Log.d(TAG, "invalid key store", e);
throw new CertificateException(e);
} catch (InvalidAlgorithmParameterException e) {
Log.d(TAG, "invalid algorithm", e);
throw new CertificateException(e);
} catch (NoSuchAlgorithmException e) {
Log.d(TAG, "no such algorithm", e);
throw new CertificateException(e);
} catch (CertPathValidatorException e) {
Log.d(TAG, "verification failed");
throw new CertificateException(e);
}
Log.d(TAG, "verification successful");
}
};
sslContext.init(null, new X509TrustManager[]{tm}, null);
}
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
}
相关推荐
猜您喜欢
精彩图集
