Java 禁用JDBC连接上的密钥库
我有一个应用程序,它使用ConnectorJ连接到MySQL数据库,没有问题。但是,我现在需要扩展该应用程序,以便对其他端点执行相互验证的HTTP请求 我的问题是,为HTTP请求定义客户机密钥库似乎会导致在JDBC连接中也使用密钥库。MySQL数据库不希望出现证书,握手失败,如下所示 资料来源(简化) 例子 健全性测试运行(成功输出): 生成任意密钥: keytool-genkey-keyalg RSA-keystore myKeystore.jks-storepass密码 使用指定的密钥重新运行(失败!!): java-cp.:mysql-connector-java-5.1.24-bin.jar-Djavax.net.ssl.keyStore=myKeystore.jks-Djavax.net.ssl.keystrepassword=password DbTester 版本 java版本“1.7.0_21” Java(TM)SE运行时环境(build 1.7.0_21-b11) Java HotSpot(TM)64位服务器虚拟机(构建23.21-b01,混合模式) mysql服务器:5.1.66-log源代码分发 connectorj:mysql-connector-java-5.1.24-bin.jar 编辑/解决Java 禁用JDBC连接上的密钥库,java,jdbc,keystore,connector-j,Java,Jdbc,Keystore,Connector J,我有一个应用程序,它使用ConnectorJ连接到MySQL数据库,没有问题。但是,我现在需要扩展该应用程序,以便对其他端点执行相互验证的HTTP请求 我的问题是,为HTTP请求定义客户机密钥库似乎会导致在JDBC连接中也使用密钥库。MySQL数据库不希望出现证书,握手失败,如下所示 资料来源(简化) 例子 健全性测试运行(成功输出): 生成任意密钥: keytool-genkey-keyalg RSA-keystore myKeystore.jks-storepass密码 使用指定的密钥重新运
我通过显式加载HTTP连接的证书(并删除JVM级别的环境参数)实现了这一点: MySQL数据库不希望提供证书
但它要求一个!如果服务器没有发送
CertificateRequest
消息,客户端就不会提供证书。MySQL不接受您的客户端,这可以通过MySQL端的配置进行修复,或者MySQL不应该要求客户端证书,这也可以在MySQL端进行修复。我通过为HTTP连接显式加载证书(并删除JVM级环境参数)实现了这一点:
谢谢-我会将此信息传递给DB维护人员。
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
public class DbTester {
private static final String JDBC_DRIVER = "com.mysql.jdbc.Driver";
private static final String JDBC_URL = "jdbc:mysql://XXX.XXX.XXX.XXX/mysql?useSSL=true";
private static final String JDBC_USERNAME = "xxxxxxxxxx";
private static final String JDBC_PASSWORD = "xxxxxxxxxx";
public static void main(final String[] args) throws Exception {
Class.forName(JDBC_DRIVER);
Connection connection = DriverManager.getConnection(JDBC_URL, JDBC_USERNAME, JDBC_PASSWORD);
try (PreparedStatement statement = connection.prepareStatement("select 1 from user")){
try (ResultSet results = statement.executeQuery()) {
if (results.next()) {
System.out.println("Query Result: " + results.getString(1));
}
}
}
}
}
> java -cp .:mysql-connector-java-5.1.24-bin.jar DbTester
Query Result: 1
Exception in thread "main" com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure
The last packet successfully received from the server was 911 milliseconds ago. The last packet sent successfully to the server was 907 milliseconds ago.
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:525)
...
Caused by: javax.net.ssl.SSLException: Unsupported record version Unknown-0.0
at sun.security.ssl.InputRecord.readV3Record(InputRecord.java:524)
at sun.security.ssl.InputRecord.read(InputRecord.java:509)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:927)
at sun.security.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1707)
at sun.security.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:122)
at sun.security.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:972)
at sun.security.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:1087)
at sun.security.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:1006)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:285)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
at com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:90)
... 17 more
String certPath = System.getProperty("my.cert.path");
String certPassword = System.getProperty("my.cert.password");
in = new FileInputStream(new File(certPath));
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(in, certPassword.toCharArray());
in.close();
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(ks, certPassword.toCharArray());
KeyManager[] keymanagers = kmf.getKeyManagers();
SSLContext context = SSLContext.getInstance("TLS");
context.init(keymanagers, null, null);
SSLSocketFactory sslSocketFactory = context.getSocketFactory();
HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
connection.setSSLSocketFactory(sslSocketFactory);
// do HTTP connection OPS :)
String certPath = System.getProperty("my.cert.path");
String certPassword = System.getProperty("my.cert.password");
in = new FileInputStream(new File(certPath));
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(in, certPassword.toCharArray());
in.close();
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(ks, certPassword.toCharArray());
KeyManager[] keymanagers = kmf.getKeyManagers();
SSLContext context = SSLContext.getInstance("TLS");
context.init(keymanagers, null, null);
SSLSocketFactory sslSocketFactory = context.getSocketFactory();
HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
// do HTTP connection OPS :)