blocks|key|225725|text|据我所知，双向SSL与Java+EE代码没有任何联系:双向SSL是一种传输层安全性:当您的客户端应用程序尝试使用服务器创建安全的HTTP连接(HTTPS)时，服务器将要求提供证书，并将批准或不批准此证书。如果客户端证书被批准，则将在各方上建立安全连接，并允许它们通过此隧道交换一些消息。但这一过程是在传输层完成的。你的代码(在应用层)永远不会被告知这个过程。为了建立双向SSL，需要在应用服务器上设置SSL端口。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|225726|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

For what i know about two way SSL, you will have no link with Java EE code: two way SSL is a transport layer security: when your client application will try to create a secured HTTP connection (HTTPS) with the serve, the server will ask for a certificate and will approve or not this certificate. If the client certificate is approved, then a secured connection will be established on parties and they are allow to exchange some messages through this tunnel. But this process is done on the transport layer. Your code (on application layer) will never be informed of this process.
In order to established two way SSL, the setup is done on the application server setup for the SSL port.

blocks|key|225728|text|ListenerSoap+soap+=+new+Listener().getListenerSoap();|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|225729|希望它能有所改善|unstyled|225730|谢谢|225731|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|L|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|F|7|N|8|@]|9|@]|A|$]]]|J|$]]

<pre><code>ListenerSoap soap = new Listener().getListenerSoap();
</code></pre>

Hope it improves

Thanks

blocks|key|2878951|text|我知道你可能不想听到这个，但是使用SSL对于双向通信来说是昂贵和有问题的。根据您对服务器/客户端的控制程度，我更喜欢简单的双向管道，如web套接字和可以简单实现AES的数据包协议。这真的取决于你想要解决的问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2878952|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I know you might not want to hear this, but using SSL is expensive and problematic for two way communication. Depending on how much control you have over the server/client ends, I prefer a simple bi-directional pipe like web sockets and a data packet protocol that can simply implement AES. It really depends on the problem you are trying to solve.

blocks|key|222395|text|听起来似乎对简单连接(https://...)和所谓的“相互认证”或“公钥基础设施(PKI)”存在混淆。实际上，您可以同时使用这两种方法，也可以使用一种独立于另一种方法。对于后者(我认为原始问题指的是后者)，当您向服务器发出请求时，服务器将响应您的请求，要求您提供证书来验证自己。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|222396|要回答上面的具体问题(从二进制数据加载密钥库)，我不认为这真的是可能的，因为它是运行时获取您的密钥库。您唯一能做的就是从数据存储中加载位，并将其临时写入磁盘。当应用程序存在时，可以选择将其删除。这是我以前做过的，效果很好。如果这样做，我建议使用一个可能是可写的位置(例如JVM+)，然后在将文件写入磁盘之后，设置System.getProperty("java.io.tmpdir"));属性(例如System.getProperties().put(+"javax.net.ssl.keyStore","...");)。|BOLD|222397|entityMap^0|B|B|0|14|65|4C|12|5J|1O|0^^$0|@$1|2|3|4|5|6|7|K|8|@$9|L|A|M|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|N|8|@$9|O|A|P|B|H]|$9|Q|A|R|B|C]|$9|S|A|T|B|C]]|D|@]|E|$]]|$1|I|3|-4|5|6|7|U|8|@]|D|@]|E|$]]]|J|$]]

It sounds like there is confusion over simple connection over SSL (<code>https://...</code>) and what is known as "mutual authentication" or "public key infrastructure (PKI)". You can actually do both or one independent of another. With the latter (what I think the original question is referring to), when you make a request to the server, the server will respond to you asking for a certificate which you must present to authenticate yourself. 

To answer the specific question above (loading a keystore from binary data), I don't think that is really possible, since it's the Java runtime that picks up on your keystore. The only think you could do is load the bits from your datastore and temporarily write it to disk. Optionally delete it when the application exists. This I have done before and works fairly well. If you do this, I'd recommend using a location likely to be writable (such as <code>System.getProperty("java.io.tmpdir"));</code>), then after writing the file to disk, set the JVM properties (e.g. <code>System.getProperties().put( "javax.net.ssl.keyStore","...");</code>)

blocks|key|3093120|text|为此，您将需要App+Engine的Socket+API。此API处于可信测试器模式，因此不是每个人都可以使用它。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3093121|您可以要求访问gere：https://docs.google.com/spreadsheet/viewform?formkey=dF9QR3pnQ2pNa0dqalViSTZoenVkcHc6MQ#gid=0|offset|length|3093122|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.google.com/spreadsheet/viewform?formkey=dF9QR3pnQ2pNa0dqalViSTZoenVkcHc6MQ#gid=0^0|0|C|2L|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

You will need App Engine's Socket API for this. This API is in trusted tester mode, so it's not available for everyone.

You can ask for an access gere : <a href="https://docs.google.com/spreadsheet/viewform?formkey=dF9QR3pnQ2pNa0dqalViSTZoenVkcHc6MQ#gid=0" rel="nofollow">https://docs.google.com/spreadsheet/viewform?formkey=dF9QR3pnQ2pNa0dqalViSTZoenVkcHc6MQ#gid=0</a>

blocks|key|2879056|text|从我对SSL授权的有限了解来看，您可能在这里遗漏了一些至关重要的东西:证书。双向SSL要求客户端和服务器证书在您的密钥库中，可以是自签名证书(+pkcs12或pem文件，您可以通过shell使用几个命令轻松生成)，也可以是由Thawte或Verisign等授权公司颁发的专有证书。虽然我不确定这是否是你所面临的问题，但检查一下是很好的。(另外，我是一个新手，所以请不要贬低我的答案，只是试图提出可能的选择。)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2879057|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

From my restricted knowledge about SSL authorization, it seems you may be missing something of vital importance here; the certificates. Two-way SSL requires the client and server certificates to be in your keystore, which can be either a self-signed certificate( a pkcs12 or pem file, which you can easily generate with a few commands through shell) or a proprietary certificate issued by an authorized company like Thawte or Verisign.
Although I am not sure if that is the problem you are facing, but its good to check it out.
(Also, I am a newbie so please don't downvote my answer, just trying to suggest possible options.)

blocks|key|2879088|text|据我所知，不支持双向SSL+(从托管在GAE中的应用到外部世界)。几个月前，我尝试了一个示例应用程序，发现GAE甚至不支持这个基本功能，这让我很沮丧。文件也不是很清楚。当您联系web服务时，您将无法提供客户端证书。没有地方存储它，密钥库无法访问。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2879089|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

2-way SSL (from app hosted in GAE to outside world) is not supported as far as I know. I tried a sample app few months ago and was frustrated to find GAE does n't even support this basic feature.. and the documentations are n't clear either. You won't be able to present client cert when you contact a web-service.. there is no place to store it, the keystore cannot be accessed.

We need to implement two-way SSL on Google App Engine, where we send out web service requests using JAX-WS to a server requring 2-way SSL authentication.

How can we set up 2-way SSL for our outgoing web service requests?

We know that <code>javax.net.ssl*</code> is forbidden in the App Engine environment.

Here's an example of our code:

<pre><code>@WebService(name="ListenerSoap", targetNamespace = "http://example.com/Listener.Wsdl")
@SOAPBinding(parameterStyle = SOAPBinding.ParameterStyle.BARE)
public interface ListenerSoap {

 @WebMethod(operationName = "Ping", action="http://example.com/Listener.Wsdl#Ping")
 public void ping();
}

@WebServiceClient(name="Listener", targetNamespace="http://example.com/Listener.Wsdl", wsdlLocation = "https://example.com/Listener.asmx?WSDL")
public class Listener extends Service
{
 public ListenerSoap getListenerSoap() {
 return super.getPort(new QName("http://example.com/Listener.Wsdl", 
 "ListenerSoap"), ListenerSoap.class);
 }
}
</code></pre>

And an example of above code in use:

<pre><code>ListenerSoap soap = new Listener().getListenerSoap();
soap.ping();
</code></pre>

I figure we can store the keystores or any certs needed in the DataStore as binary objects (though how to upload them is still a lil' vague to me). 

How can we go about setting the necessary values needed for this web service to authenticate using 2-way SSL?

Thanks for any help

Update:

Through research I've seen this is how it can be done on a traditional server (one with filesystem access):

<pre><code>ListenerSoap soap = new Listener().getListenerSoap();
((BindingProvider) soap).getRequestContext().put("javax.net.ssl.keyStore", "client_cert.p12"
</code></pre>

However, in this approach, <code>client_cert.p12</code> is expected to be on the filesystem. 

Additionally, <code>SSLSocketFactory</code>, <code>SSLContext</code>, <code>KeyManager</code>, and <code>KeyManagerFactory</code> all aren't allowed on GAE. 

Update:

As of GAE SDK version 1.7.7. this should now be possible:

<pre><code>Similarly, Java developers can now use the javax.net.ssl package to make outbound SSL connections.
</code></pre>

<a href="http://googleappengine.blogspot.com/2013/04/app-engine-177-released.html" rel="nofollow">GAE 1.7.7 SDK Release Notes</a>

2-way SSL for web services on GAE (java)

身份验证

数据存储

文件系统

服务器

Java

我们需要在Google App Engine上实现双向SSL，在这里我们使用JAX-WS将web服务请求发送到需要双向SSL身份验证的服务器。我们如何为传出的web服务请求设置双向SSL？我们知道javax.net.ssl*在App Engine环境中是被禁止的。下面是我们的代码示例：@WebService(name=...

问GAE上web服务的双向SSL (java)
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问GAE上web服务的双向SSL (java)EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问GAE上web服务的双向SSL (java)
EN