Java KeyManager類代碼示例

import javax.net.ssl.KeyManager; //導入依賴的package包/類
@PostConstruct
public void afterPropertiesSet() throws Exception {
	RegistryBuilder<ConnectionSocketFactory> schemeRegistry = RegistryBuilder.create();

	schemeRegistry.register("http", PlainConnectionSocketFactory.getSocketFactory());

	SSLContext sslcontext = SSLContext.getInstance("TLS");
	sslcontext.init(new KeyManager[0], new TrustManager[]{new SimpleTrustManager()}, null);
	SSLConnectionSocketFactory sf = new SSLConnectionSocketFactory(sslcontext);
	schemeRegistry.register("https", sf);

	pool = new PoolingHttpClientConnectionManager(schemeRegistry.build());
	pool.setMaxTotal(maxConnection);
	pool.setDefaultMaxPerRoute(maxConnection);
	pool.setDefaultSocketConfig(SocketConfig.custom().setSoTimeout(sotimeout).build());
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
private SSLServerSocketFactory getSSLServerSF() throws Exception {

        char [] password =
            System.getProperty("javax.net.ssl.keyStorePassword").toCharArray();
        String keyFilename = System.getProperty("javax.net.ssl.keyStore");

        KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(new FileInputStream(keyFilename), password);

        KeyManagerFactory kmf = KeyManagerFactory.getInstance("NewSunX509");
        kmf.init(ks, password);

        KeyManager[] kms = kmf.getKeyManagers();
        TrustManager[] tms = new MyX509TM[] {new MyX509TM()};

        SSLContext ctx = SSLContext.getInstance("TLS");
        ctx.init(kms, tms, null);

        return ctx.getServerSocketFactory();
    }
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
public KeyManager[] wrap(KeyManager[] managers) {
	if (managers == null)
		return null;
	KeyManager[] result = new KeyManager[managers.length];
	for (int i = 0; i < result.length; i++) {
		if (managers[i] instanceof X509KeyManager && getKeyAlias() != null) {
			String keyAlias = getKeyAlias();
			// JKS keystores always convert the alias name to lower case
			if ("jks".equalsIgnoreCase(getKeystoreType())) {
				keyAlias = keyAlias.toLowerCase(Locale.ENGLISH);
			}
			result[i] = new NioX509KeyManager((X509KeyManager) managers[i], keyAlias);
		} else {
			result[i] = managers[i];
		}
	}
	return result;
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
public static KeyManager[] createKeyManagers(final KeyStore keystore,
    char[] keyvalue) {
  try {
    KeyManagerFactory kmfactory =
        KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmfactory.init(keystore, keyvalue);
    return kmfactory.getKeyManagers();
  } catch (Exception e) {
    throw new IllegalArgumentException("Bad key store."
        + e.getMessage());
  }
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
private void addToStore(String alias, KeyPair kp, Certificate cert) throws KeyStoreException,
        NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException {
    Certificate[] chain = {
        cert,
    };
    keyStore.setKeyEntry(alias, kp.getPrivate(),
            "".toCharArray(), chain);

    keyStore.store(new FileOutputStream(keyStoreFile), "".toCharArray());

    /*
     * After adding an entry to the keystore we need to create a fresh
     * KeyManager by reinitializing the KeyManagerFactory with the new key
     * store content and then rewrapping the default KeyManager with our own
     */
    KeyManagerFactory keyManagerFactory = KeyManagerFactory
            .getInstance(KeyManagerFactory.getDefaultAlgorithm());

    keyManagerFactory.init(keyStore, "".toCharArray());
    KeyManager defaultKeyManager = keyManagerFactory.getKeyManagers()[0];
    KeyManager wrappedKeyManager = new KerplappKeyManager((X509KeyManager) defaultKeyManager);
    keyManagers = new KeyManager[] {
        wrappedKeyManager,
    };
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
private static SSLContext createSslContext(ApacheThriftClientConfig config)
{
    try {
        KeyStore trustStore = loadTrustStore(config.getTrustCertificate());
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);

        KeyManager[] keyManagers = null;
        if (config.getKey() != null) {
            Optional<String> keyPassword = Optional.ofNullable(config.getKeyPassword());
            KeyStore keyStore = loadKeyStore(config.getTrustCertificate(), config.getKey(), keyPassword);
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(keyStore, new char[0]);
            keyManagers = keyManagerFactory.getKeyManagers();
        }

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagers, trustManagerFactory.getTrustManagers(), null);
        return sslContext;
    }
    catch (IOException | GeneralSecurityException e) {
        throw new IllegalArgumentException("Unable to load SSL keys", e);
    }
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
/**
 * 雙向證書的驗證,極少數的應用需要雙向證書驗證，比如銀行、金融類
 *
 * @param certificates
 * @param bksFile
 * @param password
 */
public CustomHttpsTrust(InputStream[] certificates, InputStream bksFile, String password) {

    try {
        TrustManager[] trustManagers = prepareTrustManager(certificates);
        KeyManager[] keyManagers = prepareKeyManager(bksFile, password);
        if (trustManagers == null) {
            x509TrustManager = new UnSafeTrustManager();
        } else {
            for (TrustManager trustManager :
                    trustManagers) {
                if (trustManager instanceof X509TrustManager) {
                    x509TrustManager = (X509TrustManager) trustManager;
                    break;
                }
            }
        }
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagers, new TrustManager[]{x509TrustManager}, null);
        sSLSocketFactory = sslContext.getSocketFactory();
    } catch (Exception e) {
        e.printStackTrace();
    }
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
private static KeyManager[] prepareKeyManager(InputStream bksFile, String password) {

        if (bksFile == null || password == null) {
            return null;
        }

        KeyStore clientKeyStore;
        try {
            clientKeyStore = KeyStore.getInstance("BKS");
            clientKeyStore.load(bksFile, password.toCharArray());
            KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(clientKeyStore, password.toCharArray());
            return keyManagerFactory.getKeyManagers();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
public static SSLParams getSslSocketFactory(InputStream[] certificates, InputStream bksFile, String password) {
    SSLParams sslParams = new SSLParams();
    try {
        TrustManager[] trustManagers = prepareTrustManager(certificates);
        KeyManager[] keyManagers = prepareKeyManager(bksFile, password);
        SSLContext sslContext = SSLContext.getInstance("TLS");
        X509TrustManager trustManager = null;
        if (trustManagers != null) {
            trustManager = new MyTrustManager(chooseTrustManager(trustManagers));
        } else {
            trustManager = new UnSafeTrustManager();
        }
        sslContext.init(keyManagers, new TrustManager[]{trustManager}, null);
        sslParams.sSLSocketFactory = sslContext.getSocketFactory();
        sslParams.trustManager = trustManager;
        return sslParams;
    } catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
        throw new AssertionError(e);
    }
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
public static SSLServerSocketFactory makeSSLSocketFactory(KeyStore loadedKeyStore, KeyManager[] keyManagers)
{
    SSLServerSocketFactory res = null;
    try {
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(loadedKeyStore);
        SSLContext ctx = SSLContext.getInstance("TLS");
        ctx.init(keyManagers, trustManagerFactory.getTrustManagers(), null);
        res = ctx.getServerSocketFactory();
    } 
    catch (Exception e) 
    {
    	System.out.println(e.toString());
        //throw new IOException(e.getMessage());
    }
    return res;
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
private SSLContext createSSLContext()
{
    KeyManager[] keymanagers = keyStore.createKeyManagers();;
    TrustManager[] trustmanagers = trustStore.createTrustManagers();

    try
    {
        SSLContext sslcontext = SSLContext.getInstance("TLS");
        sslcontext.init(keymanagers, trustmanagers, null);
        return sslcontext;
    }
    catch(Throwable e)
    {
        throw new AlfrescoRuntimeException("Unable to create SSL context", e);
    }
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
private static SSLContext createSSLContext(final KeyStore keyStore, final KeyStore trustStore, String password) throws Exception {
    KeyManager[] keyManagers;
    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    keyManagerFactory.init(keyStore, password.toCharArray());
    keyManagers = keyManagerFactory.getKeyManagers();

    TrustManager[] trustManagers;
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    trustManagerFactory.init(trustStore);
    trustManagers = trustManagerFactory.getTrustManagers();

    SSLContext sslContext;
    sslContext = SSLContext.getInstance("TLS");
    sslContext.init(keyManagers, trustManagers, null);

    return sslContext;
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
public static SSLSocketFactory createSocketFactory(
	final String caCertificateFileName, 
	final String clientCertificateFileName, 
	final String clientKeyFileName) throws Exception
{
	// Creates a TLS socket factory with the given 
	// CA certificate file, client certificate, client key
	// In this case, we are working without a client key password
	final String clientKeyPassword = "";
	try
	{
		Security.addProvider(new BouncyCastleProvider());
		final KeyManager[] keyManagers = createKeyManagerFactory(clientCertificateFileName, clientKeyFileName, clientKeyPassword).getKeyManagers();
		final TrustManager[] trustManagers = createTrustManagerFactory(caCertificateFileName).getTrustManagers();
		
		// Create the TLS socket factory for the desired TLS version
		final SSLContext context = SSLContext.getInstance(TLS_VERSION);
		
		context.init(keyManagers, trustManagers, new SecureRandom());
		//context.init(keyManagers, trustManagers, null);

		return context.getSocketFactory();			
	}
	catch (Exception e)
	{
		throw new Exception("I cannot create the TLS socket factory.", e);
	}		
}
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
@Test
    public void createKeyManagers() throws Exception {
/*
        StringBuffer sb = new StringBuffer();
        Provider[] p = Security.getProviders();
        for (int i = 0; i < p.length; i++) {
            sb.append("\nProvider : " + p[i].toString() + "\n");
            Set s = p[i].keySet();
            Object[] o = s.toArray();
            Arrays.sort(o);
            for (int j = 1; j < o.length; j++) {
                sb.append(o[j].toString() + ", ");
            }
        }
        System.out.println(sb.toString());
*/
        final KeyManager[] keyManagers = ActiveMQUtil.createKeyManagers(TEST_CERT);
        assertThat(keyManagers).isNotNull().isNotEmpty();
    }
 

import javax.net.ssl.KeyManager; //導入依賴的package包/類
/**
 * Gets the ssl context for use making the connections
 *
 * @return the ssl context
 */
public SSLContext getSslContext() {
    KeyManager[] keyManagers = getKeyManagers();
    TrustManager[] trustManagers = getTrustManagers();
    if (keyManagers != null || trustManagers != null) {
        try {
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(getKeyManagers(), trustManagers, null);
            sslContext.getDefaultSSLParameters().setNeedClientAuth(true);
            return sslContext;
        } catch (Exception e) {
            throw new IllegalStateException("Created keystore and truststore but failed to initialize SSLContext", e);
        }
    } else {
        return null;
    }
}