Статус: Участник
Группы: Участники
Зарегистрирован: 09.01.2018(UTC) Сообщений: 10  Откуда: Москва
|
Идем глубже в кроличью нору. Мы продвинулись, но увы, недалеко. Следуя документу "ЖТЯИ.00091-01 33 03. Руководство программиста (JTLS)" получилось установить handshake с удаленным сервером. Код: Код:
private final static String url = "https://protected.remote.url";
public void testRestTemplate () throws Exception {
logger.trace("Executing ClientServiceImpl.testRestTemplate");
System.getProperties().setProperty("com.sun.security.enableCRLDP", "true");
HttpHeaders headers = new HttpHeaders();
headers.setAccept(Arrays.asList(MediaType.APPLICATION_OCTET_STREAM)); // We are downloading a file
HttpEntity<?> httpEntity = new HttpEntity<>(null, headers);
SSLContext sslContext = sslContext ();
HttpClient client = HttpClients.custom().setSSLContext(sslContext).build();
RestTemplate restTemplate = new RestTemplateBuilder()
.requestFactory(new HttpComponentsClientHttpRequestFactory(client))
.build();
ResponseEntity<byte[]> response = restTemplate.exchange(
new URI(url), HttpMethod.GET,
httpEntity, byte[].class);
logger.warn("Completed without error");
}
/**
* Generate SSLContext with root and user certificates
*
* @return Ready SSL context
* @throws NoSuchAlgorithmException
* @throws KeyStoreException
* @throws NoSuchProviderException
* @throws CertificateException
* @throws IOException
* @throws UnrecoverableKeyException
* @throws KeyManagementException
*/
private SSLContext sslContext () throws NoSuchAlgorithmException, KeyStoreException, NoSuchProviderException, CertificateException, IOException, UnrecoverableKeyException, KeyManagementException {
KeyStore keyStore = KeyStore.getInstance("OCFStore", "JCP");
keyStore.load(null, null);
KeyManagerFactory kmf = KeyManagerFactory.getInstance("GostX509");
kmf.init(keyStore, "1".toCharArray()); // Пароль к контейнеру сервера или клиента
FileInputStream is = new FileInputStream("c:\\tmp\\ssl.jks");
KeyStore trustStore = KeyStore.getInstance("JKS");
trustStore.load(is, "1".toCharArray());
TrustManagerFactory tmf = TrustManagerFactory.getInstance("GostX509");
tmf.init(trustStore);
SSLContext sslCtx = SSLContext.getInstance("GostTLS"); // Защищенный контекст
sslCtx.init(kmf != null ? kmf.getKeyManagers() : null, tmf.getTrustManagers(), null);
return sslCtx;
}
Доступ к eToken идет средствами Аладдина, и в дебагере видно, что с его кейстором вроде все в порядке. Проблема возникает при выполнении. У нас есть три корневых сертификата в p7b, каждый содержит несколько сертификатов, два - цепочки сертификатов. Документация сайта, к которому мы осуществляем доступ, утверждает, что нужно загружать все p7b. Сначала мы попробовали сгенерить хранилище при помощи JCP control panel. Код:
FileInputStream is = new FileInputStream("c:\\tmp\\TEMP\\root-atsenergo");
KeyStore trustStore = KeyStore.getInstance("HDImageStore");
trustStore.load(is, "1234567890".toCharArray());
Но вылетает исключение. Потом мы использовали "KeyStore Explorer", создали JKS keystore и испортировали в него все сертификаты по очереди. И снова та же ошибка Код:
15:28:33.704 [http-nio-8080-exec-5] WARN ru.CryptoPro.ssl.SSLLogger - http-nio-8080-exec-5, handling exception: javax.net.ssl.SSLHandshakeException: ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target
15:28:33.740 [http-nio-8080-exec-5] ERROR r.m.i.t.controller.ClientController - Request: http://localhost:8080/srv-tas-client/test-client raised org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://protected.remote.url": ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target
org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://protected.remote.url": ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:674)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:636)
at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:557)
at our.organization.service.impl.ClientServiceImpl.testRestTemplate(ClientServiceImpl.java:64)
at our.organization.controller.ClientController.testClient(ClientController.java:35)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:635)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.boot.web.filter.ApplicationContextHeaderFilter.doFilterInternal(ApplicationContextHeaderFilter.java:55)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at ru.mdi.irmdev.core.filter.CoreCorsFilter.doFilterInternal(CoreCorsFilter.java:34)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:110)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:106)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115)
at org.springframework.boot.web.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59)
at org.springframework.boot.web.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:650)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1468)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target
at ru.CryptoPro.ssl.cl_2.a(Unknown Source)
at ru.CryptoPro.ssl.cl_97.a(Unknown Source)
at ru.CryptoPro.ssl.cl_58.a(Unknown Source)
at ru.CryptoPro.ssl.cl_58.a(Unknown Source)
at ru.CryptoPro.ssl.cl_15.a(Unknown Source)
at ru.CryptoPro.ssl.cl_15.a(Unknown Source)
at ru.CryptoPro.ssl.cl_58.u(Unknown Source)
at ru.CryptoPro.ssl.cl_58.a(Unknown Source)
at ru.CryptoPro.ssl.cl_97.a(Unknown Source)
at ru.CryptoPro.ssl.cl_97.n(Unknown Source)
at ru.CryptoPro.ssl.cl_97.b(Unknown Source)
at ru.CryptoPro.ssl.cl_97.startHandshake(Unknown Source)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:396)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373)
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
at org.springframework.http.client.HttpComponentsClientHttpRequest.executeInternal(HttpComponentsClientHttpRequest.java:89)
at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48)
at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:53)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:660)
... 82 common frames omitted
Caused by: ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target
at ru.CryptoPro.ssl.pc_4.cl_2.a(Unknown Source)
at ru.CryptoPro.ssl.pc_4.cl_2.a(Unknown Source)
at ru.CryptoPro.ssl.pc_4.cl_4.b(Unknown Source)
at ru.CryptoPro.ssl.cl_125.a(Unknown Source)
at ru.CryptoPro.ssl.cl_125.a(Unknown Source)
at ru.CryptoPro.ssl.cl_125.checkServerTrusted(Unknown Source)
... 106 common frames omitted
Caused by: java.security.cert.CertPathValidatorException: Could not determine revocation status: unable to find valid certification path to requested target
at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(Unknown Source)
at sun.security.provider.certpath.PKIXCertPathValidator.validate(Unknown Source)
at sun.security.provider.certpath.PKIXCertPathValidator.validate(Unknown Source)
at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(Unknown Source)
at java.security.cert.CertPathValidator.validate(Unknown Source)
at ru.CryptoPro.reprov.CPCertPathValidator.engineValidate(Unknown Source)
at java.security.cert.CertPathValidator.validate(Unknown Source)
... 112 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
at ru.CryptoPro.reprov.certpath.CrlRevocationChecker.a(Unknown Source)
at ru.CryptoPro.reprov.certpath.CrlRevocationChecker.a(Unknown Source)
at ru.CryptoPro.reprov.certpath.CrlRevocationChecker.a(Unknown Source)
at ru.CryptoPro.reprov.certpath.CrlRevocationChecker.a(Unknown Source)
at ru.CryptoPro.reprov.certpath.CrlRevocationChecker.check(Unknown Source)
... 119 common frames omitted
Вопросы: Мы проверяли, что эти сертификаты вместе с IE11 + activeX plugin + eToken работают. Мы видим, что в сгенеренном keystore не видна иерархия сертификатов (как она видна в p7b), импортировали сертификаты мы по одному. 1. Есть ли разница - импортировать сертификаты цепочкой или по одному? Каков рекомендованный способ импортировать p7b? 2. Все ли в порядке с кодом? Может как-то по-другому надо? Еще - не хотелось бы трогать JDK cacerts. Однако мы попробовали и так, и exception тот же самый "unable to find valid certification path to requested target".
|
