we use lots of ssh to access the web service or https. Sometime to create the cerfication file named:
jssecacerts
Then we can just copy this file to $java_home/lib/security
/** * http://blogs.sun.com/andreas/resource/InstallCert.java * Use: * java InstallCert hostname * Example: *% java InstallCert ecc.fedora.redhat.com */ import javax.net.ssl.*; import java.io.*; import java.security.KeyStore; import java.security.MessageDigest; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; /** * Class used to add the server's certificate to the KeyStore * with your trusted certificates. */ public class InstallCert { public static void main(String[] args) throws Exception { String host; int port; char[] passphrase; if ((args.length == 1) || (args.length == 2)) { String[] c = args[0].split(":"); host = c[0]; port = (c.length == 1) ? 443 : Integer.parseInt(c[1]); String p = (args.length == 1) ? "changeit" : args[1]; passphrase = p.toCharArray(); } else { System.out.println("Usage: java InstallCert <host>[:port] [passphrase]"); return; } File file = new File("jssecacerts"); if (file.isFile() == false) { char SEP = File.separatorChar; File dir = new File(System.getProperty("java.home") + SEP + "lib" + SEP + "security"); file = new File(dir, "jssecacerts"); if (file.isFile() == false) { file = new File(dir, "cacerts"); } } System.out.println("Loading KeyStore " + file + "..."); InputStream in = new FileInputStream(file); KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType()); ks.load(in, passphrase); in.close(); SSLContext context = SSLContext.getInstance("TLS"); TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); tmf.init(ks); X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0]; SavingTrustManager tm = new SavingTrustManager(defaultTrustManager); context.init(null, new TrustManager[]{tm}, null); SSLSocketFactory factory = context.getSocketFactory(); System.out.println("Opening connection to " + host + ":" + port + "..."); SSLSocket socket = (SSLSocket) factory.createSocket(host, port); socket.setSoTimeout(10000); try { System.out.println("Starting SSL handshake..."); socket.startHandshake(); socket.close(); System.out.println(); System.out.println("No errors, certificate is already trusted"); } catch (SSLException e) { System.out.println(); e.printStackTrace(System.out); } X509Certificate[] chain = tm.chain; if (chain == null) { System.out.println("Could not obtain server certificate chain"); return; } BufferedReader reader = new BufferedReader(new InputStreamReader(System.in)); System.out.println(); System.out.println("Server sent " + chain.length + " certificate(s):"); System.out.println(); MessageDigest sha1 = MessageDigest.getInstance("SHA1"); MessageDigest md5 = MessageDigest.getInstance("MD5"); for (int i = 0; i < chain.length; i++) { X509Certificate cert = chain[i]; System.out.println (" " + (i + 1) + " Subject " + cert.getSubjectDN()); System.out.println(" Issuer " + cert.getIssuerDN()); sha1.update(cert.getEncoded()); System.out.println(" sha1 " + toHexString(sha1.digest())); md5.update(cert.getEncoded()); System.out.println(" md5 " + toHexString(md5.digest())); System.out.println(); } System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]"); String line = reader.readLine().trim(); int k; try { k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1; } catch (NumberFormatException e) { System.out.println("KeyStore not changed"); return; } X509Certificate cert = chain[k]; String alias = host + "-" + (k + 1); ks.setCertificateEntry(alias, cert); OutputStream out = new FileOutputStream("jssecacerts"); ks.store(out, passphrase); out.close(); System.out.println(); System.out.println(cert); System.out.println(); System.out.println ("Added certificate to keystore 'jssecacerts' using alias '" + alias + "'"); } private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray(); private static String toHexString(byte[] bytes) { StringBuilder sb = new StringBuilder(bytes.length * 3); for (int b : bytes) { b &= 0xff; sb.append(HEXDIGITS[b >> 4]); sb.append(HEXDIGITS[b & 15]); sb.append(' '); } return sb.toString(); } private static class SavingTrustManager implements X509TrustManager { private final X509TrustManager tm; private X509Certificate[] chain; SavingTrustManager(X509TrustManager tm) { this.tm = tm; } public X509Certificate[] getAcceptedIssuers() { throw new UnsupportedOperationException(); } public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { throw new UnsupportedOperationException(); } public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { this.chain = chain; tm.checkServerTrusted(chain, authType); } } }
相关推荐
SLL rtificate problem: unable to get local issuer certificate
composer ssl cacert.pem证书
ssl-cert-check是一个Bourne shell脚本,可用于报告SSL证书过期。 该脚本旨在从cron运行,并且可以通过nagios发送电子邮件警告或记录警报。 用法: $ ./ssl-cert-check Usage: ./ssl-cert-check [ -e email ...
Product Description Universal Data Access Components (UniDAC) is a library of components that provides direct access to most popular database servers from Delphi, Delphi for .NET and, C++Builder....
e.g.: -P http://someurl.com-S or --ssl Enable https.-C or --cert Path to ssl cert file (default: cert.pem).-K or --key Path to ssl key file (default: key.pem).-r or --robots Provide a...
check_ssl_cert 用于检查X.509证书的Shell脚本(可用作Nagios插件): 检查服务器是否正在运行并提供有效的证书 检查CA是否匹配给定的模式 检查有效性 用法 Usage: check_ssl_cert -H host [OPTIONS] Arguments: ...
CREATE certificate for ssl comunicate
curl ssl ca根证书文件
https-ssl-cert-check-zabbix:用于在站点上检查TLSSSL证书的有效性和有效期的脚本。 可与Zabbix或独立使用
域和SSL证书监视程序 观看您的域的SSL证书和注册日期到期。 输入项 url 要检查的站点域(使用协议)。 产出 ssl-expire-date ...- run : echo 'SSL cert has ${{ steps.check-domain.outputs.ssl-exp
zabbix监控ssl证书过期的模板
# Install agent in /var/cronus with default ssl cert and no password wget -qO- ' http://cronuspaas.github.io/downloads/install_agent ' | sudo dev=true bash # custom ssl cert and user:password for ...
SSL certificate problem: unable to get local issuer certificate
本地SSL证书生成器安装$ git clone https://github.com/zablik/ssl_cert_generator.git生成认证我们将创建本地证书颁发机构(CA)。 然后,我们为任何本地域创建SSL证书,并使用我们的CA证书对其进行签名。 我们在...
在wamp环境里,当你配置好了“extension=php_curl.dll”事项,还遇到“cURL error 60: SSL certificate: unable to get local ...并在php.ini里配置:curl.cainfo = "E:/wamp/bin/php/php5.5.12/extras/ssl/cacert.pem"
您可以自己提供这些证书,也可以使用的可用证书( dev-ssl.cert和dev-ssl.key )。 将网状权限公共密钥作为perms.pub.pem添加到certs文件夹中,或者通过AUTH_KEY设置外壳中文件的路径。 如果使用hubs-ops的公共...
帮助一个同学的WordPress博客从虚拟主机搬迁到VPS主机环境中,他的VPS环境是采用的免费版AMH4.2环境搭建的,告知在升级最新WordPress4.3版本以及安装插件的时候无法下载,有提示Problem with the SSL CA cert (path?...
显示“SSL证书问题:无法获取本地颁发者证书”。这个文件适用于适用于发送CURL请求的系统(并且没有接收请求的服务器)
尤伯曼 更好的休息方式 by 使用更少的样板代码快速开发和部署 REST API。 介绍 Uberman 是一个用于构建实用的面向 RESTful 资源的超... certPath : // PATH TO SSL CERT keyPath : // PATH TO SSL KEY } ) ; blogAP