Java SSL问题：警报编号46（sslv3警报证书未知）_Java_Ssl_Openssl_Bouncycastle_Haproxy

Java SSL问题：警报编号46（sslv3警报证书未知）

java ssl openssl

Java SSL问题：警报编号46（sslv3警报证书未知）,java,ssl,openssl,bouncycastle,haproxy,Java,Ssl,Openssl,Bouncycastle,Haproxy,我遇到了一个问题（SSL警报编号46）当我在haproxy配置中提供crl文件时，出现了上述问题用例 public static X509Certificate generateClientCertificate(X509Certificate issuerCertificate, PrivateKey issuerPrivateKey, KeyPair keyPair, X500Name dnName, BigInteger serialNumber) throws IOException

我遇到了一个问题（SSL警报编号46）

当我在haproxy配置中提供crl文件时，出现了上述问题

用例

public static X509Certificate generateClientCertificate(X509Certificate issuerCertificate, PrivateKey issuerPrivateKey, KeyPair keyPair, X500Name dnName, BigInteger serialNumber) throws IOException, OperatorCreationException, CertificateException {

            JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(SHA_256_WITH_RSA).setProvider("BC");

            JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
                issuerCertificate, //here intermedCA is issuer authority
                serialNumber, new Date(),
                Date.from(Instant.now().plus(100, ChronoUnit.DAYS)),
                dnName, keyPair.getPublic());

            builder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature));
            builder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));

            X509Certificate x509Certificate = new JcaX509CertificateConverter()
                .getCertificate(builder
                    .build(signerBuilder.build(issuerPrivateKey)));// private key of signing authority , here it is signed by intermedCA

            return x509Certificate;
        }

private static X509CRL generateCrl(X509Certificate ca, PrivateKey caPrivateKey, PublicKey caPublicKey, 
                                   X509Certificate... revoked) throws Exception {
    X509v2CRLBuilder builder = new X509v2CRLBuilder(
        new X500Name(ca.getSubjectDN().getName()),
        new Date()
    );

    builder.setNextUpdate(Date.from(Instant.now().plus(100000l, ChronoUnit.HOURS)));

    for (X509Certificate certificate : revoked) {
        builder.addCRLEntry(certificate.getSerialNumber(), new Date(), CRLReason.PRIVILEGE_WITHDRAWN.ordinal());
    }

    builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(4)));
//        builder.addExtension(Extension.authorityKeyIdentifier, false, new AuthorityKeyIdentifier(ca.getEncoded()));

    builder.addExtension(Extension.authorityKeyIdentifier, false,
        new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(caPublicKey));

    JcaContentSignerBuilder contentSignerBuilder =
        new JcaContentSignerBuilder(SHA_256_WITH_RSA_ENCRYPTION);

    contentSignerBuilder.setProvider(BC_PROVIDER_NAME);

    X509CRLHolder crlHolder = builder.build(contentSignerBuilder.build(caPrivateKey));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();

    converter.setProvider(BC_PROVIDER_NAME);

    return converter.getCRL(crlHolder);
}

我正在使用HAPROXY进行ssl终止。我有自己签名的ca.crt、ca.pem、server.crt、server.pem和client.crt、client.key、crl.pem

工作场景

我已使用生成自签名证书

Ha代理配置

global
    log 127.0.0.1 local0 debug
    tune.ssl.default-dh-param 2048

defaults
    log global

listen mqtt
  bind *:2883
  bind *:8883 ssl crt /etc/ssl/certs/server.pem verify required ca-file /etc/ssl/certs/ca.pem crl-file /etc/ssl/certs/crl.pem

  mode tcp
  option tcplog

  option clitcpka # For TCP keep-alive
  tcp-request content capture dst len 15
  timeout client 3h #By default TCP keep-alive interval is 2hours in OS kernal, 'cat /proc/sys/net/ipv4/tcp_keepalive_time'
  timeout server 3h #By default TCP keep-alive interval is 2hours in OS kernal

  balance leastconn
  # MQTT broker 1
  server broker_1 ray-mqtt:1883 check send-proxy-v2-ssl-cn
  # MQTT broker 2
  #  server broker_2 10.255.4.102:1883 check

当我使用crl文件生成证书时，上述配置在有crl文件和无crl文件的情况下都能正常工作

非工作场景

我使用Java bouncy castle库生成所有证书

客户端证书生成

public static X509Certificate generateClientCertificate(X509Certificate issuerCertificate, PrivateKey issuerPrivateKey, KeyPair keyPair, X500Name dnName, BigInteger serialNumber) throws IOException, OperatorCreationException, CertificateException {

            JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(SHA_256_WITH_RSA).setProvider("BC");

            JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
                issuerCertificate, //here intermedCA is issuer authority
                serialNumber, new Date(),
                Date.from(Instant.now().plus(100, ChronoUnit.DAYS)),
                dnName, keyPair.getPublic());

            builder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature));
            builder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));

            X509Certificate x509Certificate = new JcaX509CertificateConverter()
                .getCertificate(builder
                    .build(signerBuilder.build(issuerPrivateKey)));// private key of signing authority , here it is signed by intermedCA

            return x509Certificate;
        }

private static X509CRL generateCrl(X509Certificate ca, PrivateKey caPrivateKey, PublicKey caPublicKey, 
                                   X509Certificate... revoked) throws Exception {
    X509v2CRLBuilder builder = new X509v2CRLBuilder(
        new X500Name(ca.getSubjectDN().getName()),
        new Date()
    );

    builder.setNextUpdate(Date.from(Instant.now().plus(100000l, ChronoUnit.HOURS)));

    for (X509Certificate certificate : revoked) {
        builder.addCRLEntry(certificate.getSerialNumber(), new Date(), CRLReason.PRIVILEGE_WITHDRAWN.ordinal());
    }

    builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(4)));
//        builder.addExtension(Extension.authorityKeyIdentifier, false, new AuthorityKeyIdentifier(ca.getEncoded()));

    builder.addExtension(Extension.authorityKeyIdentifier, false,
        new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(caPublicKey));

    JcaContentSignerBuilder contentSignerBuilder =
        new JcaContentSignerBuilder(SHA_256_WITH_RSA_ENCRYPTION);

    contentSignerBuilder.setProvider(BC_PROVIDER_NAME);

    X509CRLHolder crlHolder = builder.build(contentSignerBuilder.build(caPrivateKey));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();

    converter.setProvider(BC_PROVIDER_NAME);

    return converter.getCRL(crlHolder);
}

CRL生成

public static X509Certificate generateClientCertificate(X509Certificate issuerCertificate, PrivateKey issuerPrivateKey, KeyPair keyPair, X500Name dnName, BigInteger serialNumber) throws IOException, OperatorCreationException, CertificateException {

            JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(SHA_256_WITH_RSA).setProvider("BC");

            JcaX509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(
                issuerCertificate, //here intermedCA is issuer authority
                serialNumber, new Date(),
                Date.from(Instant.now().plus(100, ChronoUnit.DAYS)),
                dnName, keyPair.getPublic());

            builder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature));
            builder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));

            X509Certificate x509Certificate = new JcaX509CertificateConverter()
                .getCertificate(builder
                    .build(signerBuilder.build(issuerPrivateKey)));// private key of signing authority , here it is signed by intermedCA

            return x509Certificate;
        }

private static X509CRL generateCrl(X509Certificate ca, PrivateKey caPrivateKey, PublicKey caPublicKey, 
                                   X509Certificate... revoked) throws Exception {
    X509v2CRLBuilder builder = new X509v2CRLBuilder(
        new X500Name(ca.getSubjectDN().getName()),
        new Date()
    );

    builder.setNextUpdate(Date.from(Instant.now().plus(100000l, ChronoUnit.HOURS)));

    for (X509Certificate certificate : revoked) {
        builder.addCRLEntry(certificate.getSerialNumber(), new Date(), CRLReason.PRIVILEGE_WITHDRAWN.ordinal());
    }

    builder.addExtension(Extension.cRLNumber, false, new CRLNumber(BigInteger.valueOf(4)));
//        builder.addExtension(Extension.authorityKeyIdentifier, false, new AuthorityKeyIdentifier(ca.getEncoded()));

    builder.addExtension(Extension.authorityKeyIdentifier, false,
        new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(caPublicKey));

    JcaContentSignerBuilder contentSignerBuilder =
        new JcaContentSignerBuilder(SHA_256_WITH_RSA_ENCRYPTION);

    contentSignerBuilder.setProvider(BC_PROVIDER_NAME);

    X509CRLHolder crlHolder = builder.build(contentSignerBuilder.build(caPrivateKey));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();

    converter.setProvider(BC_PROVIDER_NAME);

    return converter.getCRL(crlHolder);
}

这里，在HAproxy配置中，当我将不包含crl文件时，它将与客户端证书一起工作。但当我将crl文件包含到haproxy配置中时，它将给出警报编号46（sslv3警报证书未知）错误
我已经使用openssl进行了验证

cat client3.pem | openssl verify -CAfile ca.crt
返回OK
openssl s_客户端的输出-连接haproxy:8883-cert client3.crt-key client3.key-CAfile ca.crt

CONNECTED(00000005) depth=1 CN = *.ray.life verify return:1 depth=0 CN = haproxy verify return:1 --- Certificate chain 0 s:CN = haproxy i:CN = *.ray.life 1 s:CN = *.ray.life i:CN = *.ray.life --- Server certificate -----BEGIN CERTIFICATE----- MIIBujCCASOgAwIBAgIBATANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDDAoqLnJh eS5saWZlMB4XDTIwMDEwNzExMzIyOFoXDTIwMDQxNjExMzIyOFowEjEQMA4GA1UE AwwHaGFwcm94eTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0CAq/xYcCXWl PJgs2+DeRRO5DRK813LIiRzdoMFeKrI9X5yXeNFzc6mSAS9EdFITM/HJYSvL/XhZ p+Hu3N2f9ZR/zD2hpTq2PP0lK3Ev6gryXpWXoJU2SbtOyLsjPmw1y/+xHUjVv5B6 V+m7b0I3RYN8blcJIkjl7Gz83GMlMucCAwEAAaMdMBswDgYDVR0PAQH/BAQDAgeA MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADgYEAnmIG9SXICU78Dz2eGbNN2znY OGCpt7TBDkuXthStAFAyzHxZFKqexkelnJNMg19CbWzxGrPk6lxJQ+ebCGEYZwiZ /WB9C1fQm+07/FEKVc1TCKv0odpTGRyXno4NePnFz6MCJGfVmec0huVPMD9fAbeJ DlcWed88CL1MdgmkKoQ= -----END CERTIFICATE----- subject=CN = haproxy issuer=CN = *.ray.life --- Acceptable client certificate CA names CN = *.ray.life Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:ECDSA+SHA1:RSA+SHA224:RSA+SHA1 Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512 Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 1440 bytes and written 1488 bytes Verification: OK --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 1024 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 0 (ok) --- 139659759231424:error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown:../ssl/record/rec_layer_s3.c:1528:SSL alert number 46

任何帮助对我都非常有用。
您需要在CA证书中添加AKI和SKI扩展，以通过HA代理验证CRL。
您的openssl版本是什么
$openssl版本
您使用的是哪个版本的
bouncycastle
？bouncycastle是最新的，我使用的是Ubuntu 18.04的默认opensslbcpkix-jdk15on:1.58OpenSSL 1.1.1 2018年9月11日这帮助我弄清楚了为什么我为一些旧证书颁发的CRL不起作用，谢谢！