Autenticación mutua con certificados x509 usando HttpClient 4.0.1

Question

¿Alguien tiene consejos amigables sobre cómo realizar la autenticación de cliente a través de un certificado x509 utilizando HTTPClient 4.0.1?

Gracias por su tiempo.

Answer 1

Aquí hay un código para comenzar. El KeyStore es el objeto que contiene el certificado del cliente. Si el servidor está utilizando un certificado autofirmado o un certificado que no está firmado por una CA como lo reconoce la JVM en el archivo de cacerts incluido, entonces deberá usar un TrustStore. De lo contrario utilizar el archivo por defecto cacerts, pase a nullSSLSockeFactory para el argumento almacén de confianza ..

import org.apache.http.conn.scheme.Scheme; 
import org.apache.http.conn.scheme.SchemeRegistry; 
import org.apache.http.conn.ssl.SSLSocketFactory; 
import org.apache.http.impl.client.DefaultHttpClient; 
import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager; 
import org.apache.http.params.BasicHttpParams; 
import org.apache.http.params.HttpParams; 

... 

final HttpParams httpParams = new BasicHttpParams(); 

// load the keystore containing the client certificate - keystore type is probably jks or pkcs12 
final KeyStore keystore = KeyStore.getInstance("pkcs12"); 
InputStream keystoreInput = null; 
// TODO get the keystore as an InputStream from somewhere 
keystore.load(keystoreInput, "keystorepassword".toCharArray()); 

// load the trustore, leave it null to rely on cacerts distributed with the JVM - truststore type is probably jks or pkcs12 
KeyStore truststore = KeyStore.getInstance("pkcs12"); 
InputStream truststoreInput = null; 
// TODO get the trustore as an InputStream from somewhere 
truststore.load(truststoreInput, "truststorepassword".toCharArray()); 

final SchemeRegistry schemeRegistry = new SchemeRegistry(); 
schemeRegistry.register(new Scheme("https", new SSLSocketFactory(keystore, keystorePassword, truststore), 443)); 

final DefaultHttpClient httpClient = new DefaultHttpClient(new ThreadSafeClientConnManager(httpParams, schemeRegistry), httpParams); 

Answer 2

Otra solución (copiado de otro ejemplo). He usado el mismo almacén de claves para "confiar" (trustStore) y para autenticarme (KeyStore).

KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); 
FileInputStream instream = new FileInputStream(new File("miller.keystore")); 
try { 
    trustStore.load(instream, "pw".toCharArray()); 
} finally { 
    instream.close(); 
} 

SSLContext sslcontext = SSLContexts.custom() 
     .loadTrustMaterial(trustStore) /* this key store must contain the certs needed & trusted to verify the servers cert */ 
     .loadKeyMaterial(trustStore, "pw".toCharArray()) /* this keystore must contain the key/cert of the client */ 
     .build(); 

SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext, 
     SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER); 
CloseableHttpClient httpclient = HttpClients.custom() 
     .setSSLSocketFactory(sslsf) 
     .build(); 
try { 

    HttpGet httpget = new HttpGet("https://localhost"); 

    System.out.println("executing request" + httpget.getRequestLine()); 

    CloseableHttpResponse response = httpclient.execute(httpget); 
    try { 
     HttpEntity entity = response.getEntity(); 

     System.out.println("----------------------------------------"); 
     System.out.println(response.getStatusLine()); 
     if (entity != null) { 
      System.out.println("Response content length: " + entity.getContentLength()); 
     } 
     EntityUtils.consume(entity); 
    } finally { 
     response.close(); 
    } 
} finally { 
    httpclient.close(); 
} 

Answer 3

He utilizado el siguiente de un código de ejemplo en la página web de HttpClient (contexto SSL personalizado si no recuerdo mal).

{ 
    KeyStore keyStore = KeyStore.getInstance("PKCS12"); //client certificate holder 
    FileInputStream instream = new FileInputStream(new File(
      "client-p12-keystore.p12")); 
    try { 
     trustStore.load(instream, "password".toCharArray()); 
    } finally { 
     instream.close(); 
    } 

    // Trust own CA and all self-signed certs 
    SSLContext sslcontext = SSLContexts.custom() 
      .loadKeyMaterial(keyStore, "password".toCharArray()) 
      // .loadTrustMaterial(trustStore, new TrustSelfSignedStrategy()) //if you have a trust store 
      .build(); 
    // Allow TLSv1 protocol only 
    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
      sslcontext, new String[] { "TLSv1" }, null, 
      SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
    CloseableHttpClient httpclient = HttpClients 
      .custom() 
      .setHostnameVerifier(
        SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER) //todo 
      .setSSLSocketFactory(sslsf).build(); 
    try { 

     HttpGet httpget = new HttpGet("https://localhost:8443/secure/index"); 

     System.out.println("executing request" + httpget.getRequestLine()); 

     CloseableHttpResponse response = httpclient.execute(httpget); 
     try { 
      HttpEntity entity = response.getEntity(); 

      System.out.println("----------------------------------------"); 
      System.out.println(response.getStatusLine()); 
      if (entity != null) { 
       System.out.println("Response content length: " 
         + entity.getContentLength()); 
      } 
      EntityUtils.consume(entity); 
     } finally { 
      response.close(); 
     } 
    } finally { 
     httpclient.close(); 
    } 
}