Java 即使客户端未发送证书，SSL套接字连接仍能正常工作？

我对使用Java进行加密非常陌生。我必须建立一个程序，在任何数据通信发生之前交换证书。我使用sslSockets来构建基本的客户机-服务器程序，而不是使用HTTP/S，这只是为了获得额外的安全性。（想知道Socket和SSLSocket之间的区别……这是否意味着所有内容都自动加密？）

以下是我更新的服务器代码：

public class SSLServerExample {
    final static String pathToStores = "C:/Users/XXX/Desktop/sslserverclientprogram";
    final static String keyStoreFile = "keystore.jks";
    final static String passwd = "changeit";

    final static int theServerPort = 8443;

    static boolean debug = false;



  public static void main(String args[]) throws Exception {

      String trustFilename = pathToStores + "/" + keyStoreFile;
//    System.out.println("Verifying KeyStore File of Client..");

    System.setProperty("javax.net.ssl.keyStore", trustFilename);
    System.setProperty("javax.net.ssl.keyStorePassword", passwd);
    if (debug)
        System.setProperty("javax.net.debug", "all");
        System.out.println("Setting up SSL parameters");

     // Initialize socket connection
       SSLServerSocketFactory sslssf = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
    SSLServerSocket sslServerSocket = (SSLServerSocket)sslssf.createServerSocket(theServerPort);
    System.out.println("Server Started..Waiting for clients");
    sslServerSocket.setNeedClientAuth(true);
    SSLSocket sslSocket = (SSLSocket)sslServerSocket.accept();
    //sslSocket.startHandshake();
    System.out.println("Client Connected!");

    InputStream sslIS = sslSocket.getInputStream();

        OutputStream sslOS = sslSocket.getOutputStream();
        sslServerSocket.setNeedClientAuth(true);

    final int RSAKeySize = 1024;
    final String newline = "\n";

    Key pubKey = null;
    Key privKey = null; 
    boolean flag = sslSocket.getNeedClientAuth();
    System.out.println("Flag value: "+ flag);

该标志将导致False，即使我将其设置为true，并且客户端发送数据，这些数据由服务器解密，而无需相互验证

我错过什么了吗

请帮忙

我的客户代码：

public class SSLClientExample {
    final static String pathToStores = "C:/Users/XXX/Desktop/sslserverclientprogram";
    final static String trustStoreFile = "cacerts.jks";
    final static String passwd = "changeit";
    final static String INPUT_FILE = "E:/workspace/input.txt";
    final static String theServerName = "localhost";
    final static int theServerPort = 8443;

    static boolean debug = false;

  public static void main(String args[]) throws Exception {

      String trustFilename = pathToStores + "/" + trustStoreFile;
      System.out.println("Validating KeyStore file of Server..");

    System.setProperty("javax.net.ssl.trustStore", trustFilename);
    System.setProperty("javax.net.ssl.trustStorePassword", passwd);
    if (debug)
        System.setProperty("javax.net.debug", "all");


    SSLSocketFactory sslssf = (SSLSocketFactory) SSLSocketFactory.getDefault();
    SSLSocket sslSocket = (SSLSocket)sslssf.createSocket(theServerName, 8443);
    System.out.println("Connected to Server!");

---

您必须调用

sslServerSocket.setNeedClientAuth（true）在接受传入的客户端连接之前。连接建立后，您正在修改服务器套接字的配置。
我这样做了，现在我的程序抛出错误！！如何交换证书？哪个命令能帮我做那件事。。抱歉问了这么多愚蠢的问题（…请参阅更新问题中的修改程序！@Papps现在您需要向客户端提供密钥库，就像您在服务器中一样，包含其自己的私钥和证书。