構建ca證書鏈

我們首先要創建 client/server 使用的證書。創建證書的方法有很多種：有不怕麻煩，直接通過openssl創建的，有通過 cfssl 創建的。這里要介紹的是我認為最簡單的一種：tls-gen

tls-gen是一個用 Python 編寫的、非常易用的工具。它定義了三種 profile。這里我們選擇最簡單的一種：一個根證書和一組證書、私鑰對。

在 shell 里面執行一下的命令:

#注意需要的環境是python3.5+ 
git clone https://github.com/michaelklishin/tls-gen
cd tls-gen/basic
make PASSWORD=123456 DAYS_OF_VALIDITY=3650 CN=www.open-api.io

就這樣，我們就為域名 www.open-api.io 創建了一套證書。觀察一下當前路徑的內容，我們會發現4個新的目錄：testca、result、client和server。
前者里面存放了剛剛創建的根證書 (root CA)，后者里面存放了我們服務程序要用的的證書和私鑰。

• cacert.cer:
  可以導入到瀏覽器中，然后就可以正常訪問https頁面
• cacert.pem:
  各個 OS 添加根證書的方法是不同的。對于 Linux 系統 (以 Ubuntu 為例) 來說，把證書文件放到相應的目錄即可：

sudo cp testca/cacert.pem /etc/ssl/certs

• keycert.p12
  導入到springboot項目中

• 查看別名

#查看證書的具體信息，包括tomcat必須用的別名
keytool -list -v -keystore keycert.p12 -storepass 123456

[root@localhost server]# tree ../server/
../server/
├── cert.pem
├── keycert.p12
├── key.pem
└── req.pem

0 directories, 4 files
[root@localhost server]# tree ../testca/
../testca/
├── cacert.cer
├── cacert.pem
├── certs
│   ├── 01.pem
│   └── 02.pem
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── private
│   └── cakey.pem
├── serial
└── serial.old

[root@localhost basic]# tree client/
client/
├── cert.pem
├── keycert.p12
├── key.pem
└── req.pem

0 directories, 4 files

服務器構建

修改properties配置文件

http.port=8080
# Define a custom port instead of the default 8080
server.port = 8443
# The format used for the keystore
server.ssl.key-store-type=PKCS12
# The path to the keystore containing the certificate
server.ssl.key-store=classpath:keycert.p12
# The password used to generate the certificate
server.ssl.key-store-password=123456
# The alias mapped to the certificate
server.ssl.key-alias=1

修改Application代碼

    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                // 如果要強制使用https，請松開以下注釋
                 SecurityConstraint constraint = new SecurityConstraint();
                 constraint.setUserConstraint("CONFIDENTIAL");
                 SecurityCollection collection = new SecurityCollection();
                 collection.addPattern("/*");
                 constraint.addCollection(collection);
                 context.addConstraint(constraint);
            }
        };
        // 添加http
        tomcat.addAdditionalTomcatConnectors(createStandardConnector());
        return tomcat;
    }
    
    // 配置http
    private Connector createStandardConnector() {
        // 默認協議為org.apache.coyote.http11.Http11NioProtocol
        Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
        connector.setSecure(false);
        connector.setScheme("http");
        connector.setPort(port);
        // 當http重定向到https時的https端口號
        connector.setRedirectPort(httpsPort);
        return connector;
    }

客戶端調用

這里用的client目錄下的私鑰

# 使用client目錄下的私鑰 keycert.p12
[root@localhost basic]# tree client/
client/
├── cert.pem
├── keycert.p12
├── key.pem
└── req.pem

編寫RestTemplate

import com.google.common.collect.Lists;
import io.micrometer.core.instrument.util.StringUtils;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.support.ResourcePatternResolver;
import org.springframework.http.MediaType;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.http.converter.xml.Jaxb2RootElementHttpMessageConverter;
import org.springframework.web.client.RestTemplate;

import javax.net.ssl.*;
import java.io.InputStream;
import java.security.KeyStore;
import java.util.ArrayList;
import java.util.List;

/**
 * @date 2019-12-23 20:05:03
 * @since 1.0.0
 */
@Configuration
public class ServiceConfigConfiguration {

    @Autowired
    SSLProperties sslProperties;

    @Autowired
    ResourcePatternResolver resourcePatternResolver;

    /**
     * 訪問SSL的Template
     *
     * @throws Exception
     */
    @Bean("sslRestTemplate")
    public RestTemplate tmsRestTemplate() throws Exception {
        //新建RestTemplate對象
        RestTemplate restTemplate = new RestTemplate();
        //判斷證書文件地址是否存在
        if (StringUtils.isNotEmpty(sslProperties.getKeyfile())) {
            //在握手期間，如果URL的主機名和服務器的標識主機名不匹配，則驗證機制可以回調此接口的實現程序來確定是否應該允許此連接
            HostnameVerifier hv = new HostnameVerifier() {
                @Override
                public boolean verify(String urlHostName, SSLSession session) {
                    return true;
                }
            };
            HttpsURLConnection.setDefaultHostnameVerifier(hv);
            //構建SSL-Socket鏈接工廠
            SSLConnectionSocketFactory ssLSocketFactory = buildSSLSocketFactory("PKCS12",
                    sslProperties.getKeyfile(), sslProperties.getPassword(),
                    Lists.newArrayList("TLSv1"), true);
            //Spring提供HttpComponentsClientHttpRequestFactory指定使用HttpClient作為底層實現創建 HTTP請求
            HttpComponentsClientHttpRequestFactory httpRequestFactory = new HttpComponentsClientHttpRequestFactory(
                    HttpClients.custom().setSSLSocketFactory(ssLSocketFactory).build()
            );
            //設置傳遞數據超時時長
            httpRequestFactory.setReadTimeout(sslProperties.getTimeout());
            //設置建立連接超時時長
            httpRequestFactory.setConnectTimeout(sslProperties.getTimeout());
            //設置獲取連接超時時長
            httpRequestFactory.setConnectionRequestTimeout(sslProperties.getTimeout());

            restTemplate.setRequestFactory(httpRequestFactory);

            // 返回消息頭也是text_html,消息格式是XML,添加新的message converter
            Jaxb2RootElementHttpMessageConverter messageConverter = new Jaxb2RootElementHttpMessageConverter();
            //設置message Converter支持的媒體類型
            List<MediaType> finalMediaTypes = new ArrayList<>();
            finalMediaTypes.addAll(messageConverter.getSupportedMediaTypes());
            finalMediaTypes.add(MediaType.TEXT_HTML);
            messageConverter.setSupportedMediaTypes(finalMediaTypes);
            restTemplate.setMessageConverters(Lists.newArrayList(messageConverter));

        }
        return restTemplate;
    }

    /**
     * 構建SSLSocketFactory
     *
     * @param keyStoreType
     * @param keyFilePath
     * @param keyPassword
     * @param sslProtocols
     * @param auth         是否需要client默認相信不安全證書
     * @return
     * @throws Exception
     */
    private SSLConnectionSocketFactory buildSSLSocketFactory(String keyStoreType, String keyFilePath,
                                                             String keyPassword, List<String> sslProtocols, boolean auth) throws Exception {
        //證書管理器，指定證書及證書類型
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        //KeyStore用于存放證書，創建對象時 指定交換數字證書的加密標準
        KeyStore keyStore = KeyStore.getInstance(keyStoreType);
        InputStream inputStream = resourcePatternResolver.getResource(keyFilePath).getInputStream();
        try {
            //添加證書
            keyStore.load(inputStream, keyPassword.toCharArray());
        } finally {
            inputStream.close();
        }
        keyManagerFactory.init(keyStore, keyPassword.toCharArray());

        SSLContext sslContext = SSLContext.getInstance("SSL");
        if (auth) {
            // 設置信任證書（繞過TrustStore驗證）
            TrustManager[] trustAllCerts = new TrustManager[1];
            TrustManager trustManager = new AuthX509TrustManager();
            trustAllCerts[0] = trustManager;
            sslContext.init(keyManagerFactory.getKeyManagers(), trustAllCerts, null);
            HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
        } else {
            //加載證書材料，構建sslContext
            sslContext = SSLContexts.custom().loadKeyMaterial(keyStore, keyPassword.toCharArray()).build();
        }

        SSLConnectionSocketFactory sslConnectionSocketFactory =
                new SSLConnectionSocketFactory(sslContext, sslProtocols.toArray(new String[sslProtocols.size()]),
                        null,
                        new HostnameVerifier() {
                            // 這里不校驗hostname
                            @Override
                            public boolean verify(String urlHostName, SSLSession session) {
                                return true;
                            }
                        });

        return sslConnectionSocketFactory;
    }

    public class AuthX509TrustManager implements javax.net.ssl.TrustManager, javax.net.ssl.X509TrustManager {
        @Override
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return null;
        }

        @Override
        public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType)
                throws java.security.cert.CertificateException {
            return;
        }

        @Override
        public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType)
                throws java.security.cert.CertificateException {
            return;
        }
    }
}

配置類 SSLProperties

import lombok.Data;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;


@Component
@Data
public class SSLProperties {
    @Value("${open.api.ssl.client.keyfile}")
    private String keyfile;

    @Value("${open.api.ssl.client.password}")
    private String password;

    @Value("${open.api.ssl.client.timeout}")
    private int timeout;
}

配置文件

#客戶端client配置
open.api.ssl.client.keyfile=classpath:client/keycert.p12
open.api.ssl.client.password=123456
open.api.ssl.client.timeout=10000

測試類

    @Resource(name = "sslRestTemplate")
    RestTemplate restTemplate;

    @Test
    public void testSslClient() {
        try {
            RestTemplate restTemplate = new RestTemplate();
            ResponseEntity<String> response = restTemplate.getForEntity("https://www.open-api.io:8443/****", String.class);
            System.out.println(response.getBody());
        } catch (RestClientException e) {
            e.printStackTrace();
        }
    }

參看資料
Go代碼打通HTTPs
SpringBoot配置http和https