blocks|key|1585561|text|首先:你需要这个库做什么？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1585562|1585563|如果你要使用简单的加密功能，那么使用与JDK一起部署的Java+SE+Security+components。|unordered-list-item|offset|length|1585564|如果你需要更高级的功能(比如一些数字签名格式等)，使用加密库(BouncyCastle是最流行的)|1585565|，但是，如果你需要的是从Java代码打开SSL连接，以及处理证书认证等，你将不需要这些：<代码>H19如果你正在使用Java+EE容器，您的容器可以验证传入的SSL请求:如果您需要连接到SSL端口，这只是configuration|1585566|Also，的问题，JDK提供了一些基本的类来实现这一点(请参阅this+example)。请注意，在这种情况下，您需要在java+command.|1585567|1585568|上设置一些系统属性|1585569|​|1585570|就像这些属性：|1585571|-Djavax.net.ssl.keyStore=keystore_path
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.ssl.trustStore=truststore_path
-Djavax.net.ssl.trustStorePassword=trustword|code-block|syntax|javascript|1585572|entityMap|0|LINK|mutability|MUTABLE|url|http://www.oracle.com/technetwork/java/javase/tech/index-jsp-136007.html|1|http://www.bouncycastle.org/|2|http://www.jguru.com/faq/view.jsp?EID=32388^0|0|0|R|R|0|0|V|C|1|0|1|V|C|2|1|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1B|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|1D|8|@]|9|@$F|1E|G|1F|1|1G]]|A|$]]|$1|H|3|I|5|E|7|1H|8|@]|9|@$F|1I|G|1J|1|1K]]|A|$]]|$1|J|3|K|5|E|7|1L|8|@]|9|@]|A|$]]|$1|L|3|M|5|E|7|1M|8|@]|9|@$F|1N|G|1O|1|1P]]|A|$]]|$1|N|3|-4|5|6|7|1Q|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1R|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1S|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|1T|8|@]|9|@]|A|$]]|$1|U|3|V|5|W|7|1U|8|@]|9|@]|A|$X|Y]]|$1|Z|3|-4|5|6|7|1V|8|@]|9|@]|A|$]]]|10|$11|$5|12|13|14|A|$15|16]]|17|$5|12|13|14|A|$15|18]]|19|$5|12|13|14|A|$15|1A]]]]

First of all: what do you need the library for? 

<ul>
<li>If you are going to use simple cryptographic functions, then use the <a href="http://www.oracle.com/technetwork/java/javase/tech/index-jsp-136007.html" rel="noreferrer">Java SE Security components</a> deployed with the JDK.</li>
<li>If you need more advanced functions (such as some digital signing formats, etc), use a cryptographic library (<a href="http://www.bouncycastle.org/" rel="noreferrer">BouncyCastle</a> is one of the the most popular)</li>
<li>But, if what you need is to open SSL connections from Java code, and handle certificates authentication, etc, you won't need any of these:

<ul>
<li>If you are working on a Java EE Container, your container can validate incoming SSL requests: it's just a matter of configuration</li>
<li>Also, if you need to connect to a SSL port, the JDK presents some basic classes for doing so (see <a href="http://www.jguru.com/faq/view.jsp?EID=32388" rel="noreferrer">this example</a>). Note that in this case, you'll need to set some system properties on your java command.</li>
</ul></li>
</ul>

Like these properties:

<pre><code>-Djavax.net.ssl.keyStore=keystore_path
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.ssl.trustStore=truststore_path
-Djavax.net.ssl.trustStorePassword=trustword
</code></pre>

blocks|key|5457451|text|每个人都在谈论BouncyCastle，但在我们的用例中，Gnu+Crypto库赢得了胜利。原生java。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5457452|对于一些客户来说，我们的数据库(+aerospike+)至少有10%25的时间是用java计算哈希的，原因很简单，就是这些实现速度很慢。我欢迎在每台Linux机器上都有可用的加密库的本机实现。我认为一些Java7+VM会包含更多的算法，但我还没有看到它们。|5457453|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Everyone talks about BouncyCastle, but in our use case Gnu Crypto library won the day. Native java.

Our database ( aerospike ) spends at least 10% of its time computing hashes in java, for some customers, simply because these implementations are slow. I welcome when there's a native implementation of the crypto libraries available on every Linux machine. I thought some of the Java7 VMs were going to include more algorithms, but I haven't seen them yet.

blocks|key|4039155|text|在提出任何建议之前，您需要回答几个重要的问题|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4039156|1)你真的想从JAVA调用C(原生)实现吗？|4039157|2)+OpenSSL中哪些特性是JCE和BouncyCastle无法解决的？|4039158|3)范围是否仅限于使用OpenSSL生成的证书，解密OpenSSL生成的文件？|4039159|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

You need to answer a few important questions before any suggestions

1) Do you really want to call C(native) implementation form JAVA?

2) What are the features in OpenSSL which cannot be solved by JCE and BouncyCastle

3) Is the scope just limited to using certificates generated by OpenSSL, decrypting files generated by OpenSSL?

blocks|key|5457409|text|最佳解决方案:对于简单的任务使用Java的内置安全性，对于更高级的任务则使用BouncyCastle。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5457410|如果你必须在Java中使用OpenSSL，你有两个选择：|5457411|5457412|将OpenSSL作为进程从Java调用，|ordered-list-item|5457413|向openssl创建了一个JNI层，但在我看来这完全是浪费时间。这些都不是真正好的方法。|5457414|5457415|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|O|8|@]|9|@]|A|$]]|$1|E|3|F|5|G|7|P|8|@]|9|@]|A|$]]|$1|H|3|I|5|G|7|Q|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|L|$]]

Best solution: Use Java's built-in security for simple tasks or use BouncyCastle for more advanced ones.

If you HAVE TO use OpenSSL from Java you have 2 choices: 

<ol>
<li>Call openssl as a process from Java.</li>
<li>Make a JNI layer to OpenSSL, but that seems like a complete waste of time to me.
None of those are really good ways of doing it.</li>
</ol>

blocks|key|4039341|text|Apache+Tomcat本地库就是解决方案。https://github.com/apache/tomcat-native|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|4039342|它使用OpenSSL实现TLS/SSL功能。您可以将其用作独立库(就像我一样)，也可以连接您的Tomcat。它是一个开放源码项目，包含文档齐全的Java代码。|4039343|为什么是tomcat原生的？|4039344|JSSE很慢，而且很难使用。在我的项目中，为了获得最佳性能，我们决定寻找/编写OpenSSL的JNI包装器，因为动态升级证书的可能性是一个问号，而密钥库太复杂了。|4039345|因为Bouncy+Castle+Crypto+API是用Java编写的，所以你不能期望最高的效率。|4039346|Tomcat+Native是一个包装器，因此您只能使用OpenSSL版本的功能。|4039347|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/apache/tomcat-native^0|0|G|N|13|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@$9|10|A|11|1|12]]|E|$]]|$1|F|3|G|5|6|7|13|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|14|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|15|8|@]|D|@]|E|$]]|$1|L|3|M|5|6|7|16|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|17|8|@]|D|@]|E|$]]|$1|P|3|-4|5|6|7|18|8|@]|D|@]|E|$]]]|Q|$R|$5|S|T|U|E|$V|W]]]]

Apache Tomcat Native Library is the solution.
<a href="https://github.com/apache/tomcat-native" rel="nofollow noreferrer">https://github.com/apache/tomcat-native</a>

It uses OpenSSL for TLS/SSL capabilities. You can use it as standalone library (as I did) or connect your Tomcat. It is open source project with well documented Java code. 

Why tomcat native?

JSSE is slow and hard to use.
In my project to get best performance we've decided to find/write JNI wrapper for OpenSSL as possibility for upgrading certificates on-the-fly is a question mark and Key Stores are too complex. 

As Bouncy Castle Crypto APIs is written in Java you cannot expect best efficiency.

Tomcat Native is a wrapper so you are limited only to capabilities of your OpenSSL version.

blocks|key|5457492|text|有很多用于加密的Java本地库。然而，它们通常不能与OpenSSL完全互操作，有时速度会慢得多(请参阅下面网站上的指标)，并且并不是所有平台都支持它们。OpenSSL在几乎所有的平台上都得到了肯定的支持，而且通常是高性能的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5457493|也就是说，使用基于VM的加密有一些安全优势。这也应该是一个考虑因素。|5457494|Apache小组已经为Java构建了一个库，该库使用JNI访问用于AES加密的openssl。我认为这是使用JNI访问openssl的最佳公开示例，您可以使用maven轻松地引用它。|5457495|https://github.com/apache/commons-crypto|offset|length|5457496|如果需要，可以提取库中的JNI绑定部分并实现所需的函数。|5457497|这个makefile展示了如何使用javah从.class获取构建.c代码所需的内容：|5457498|https://github.com/apache/commons-crypto/blob/master/Makefile|5457499|具体地说，Makefile中的这一行调用javah：$(JAVAH)+-force+-classpath+$(TARGET)/classes+-o+$@+org.apache.commons.crypto.cipher.OpenSslNative根据OpenSslNative.class生成正确的"OpenSslNative.h“文件。|style|CODE|5457500|https://github.com/apache/commons-crypto/blob/master/src/main/java/org/apache/commons/crypto/cipher/OpenSslNative.java|5457501|请注意import+java.nio.ByteBuffer;是如何用于支持C输出缓冲区的。|5457502|相关的.c程序如下：|5457503|https://github.com/apache/commons-crypto/blob/master/src/main/native/org/apache/commons/crypto/cipher/OpenSslNative.c|5457504|它在编写时考虑到了跨平台支持，这是一个很好的例子。每个导出的函数都必须以JNIEXPORT开头，您可以看到每个函数名中的完整类路径。|5457505|我见过很多糟糕的JNI绑定，传递字符串等等。从一个坚实的基础开始，对于在Java语言中构建良好的OpenSSL集成有很大的帮助。|5457506|entityMap|0|LINK|mutability|MUTABLE|url|1|2|3^0|0|0|0|0|14|0|0|0|0|0|1P|1|0|Q|2P|0|0|3A|2|0|3|R|0|0|0|39|3|0|10|9|0|0^^$0|@$1|2|3|4|5|6|7|1F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1G|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1H|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|1I|8|@]|9|@$H|1J|I|1K|1|1L]]|A|$]]|$1|J|3|K|5|6|7|1M|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1N|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|1O|8|@]|9|@$H|1P|I|1Q|1|1R]]|A|$]]|$1|P|3|Q|5|6|7|1S|8|@$H|1T|I|1U|R|S]]|9|@]|A|$]]|$1|T|3|U|5|6|7|1V|8|@]|9|@$H|1W|I|1X|1|1Y]]|A|$]]|$1|V|3|W|5|6|7|1Z|8|@$H|20|I|21|R|S]]|9|@]|A|$]]|$1|X|3|Y|5|6|7|22|8|@]|9|@]|A|$]]|$1|Z|3|10|5|6|7|23|8|@]|9|@$H|24|I|25|1|26]]|A|$]]|$1|11|3|12|5|6|7|27|8|@$H|28|I|29|R|S]]|9|@]|A|$]]|$1|13|3|14|5|6|7|2A|8|@]|9|@]|A|$]]|$1|15|3|-4|5|6|7|2B|8|@]|9|@]|A|$]]]|16|$17|$5|18|19|1A|A|$1B|G]]|1C|$5|18|19|1A|A|$1B|O]]|1D|$5|18|19|1A|A|$1B|U]]|1E|$5|18|19|1A|A|$1B|10]]]]

There are lots of Java native libraries for crypto. However they are generally not fully interoperable with OpenSSL, are sometimes significantly slower (see the metrics on the site below), and aren't supported on all platforms. OpenSSL is definitely supported on nearly every platform and is, generally, performant.

That being said, there are some security advantages to using VM-based crypto. This should also be a consideration.

The Apache group has built a library for Java that uses JNI to access openssl for AES encryption. I think it's the best public example of using JNI to access openssl, and you can reference it easily using maven.

<a href="https://github.com/apache/commons-crypto" rel="nofollow noreferrer">https://github.com/apache/commons-crypto</a>

If you want, you can pull out the JNI binding portion of the libary and implement the functions you need. 

This makefile shows how to use javah to get what you need from the .class to build the .c code:

<a href="https://github.com/apache/commons-crypto/blob/master/Makefile" rel="nofollow noreferrer">https://github.com/apache/commons-crypto/blob/master/Makefile</a>

Specifically, this line in the Makefile calls javah: <code>$(JAVAH) -force -classpath $(TARGET)/classes -o $@ org.apache.commons.crypto.cipher.OpenSslNative</code> to produce the correct "OpenSslNative.h" file based on the OpenSslNative.class.

<a href="https://github.com/apache/commons-crypto/blob/master/src/main/java/org/apache/commons/crypto/cipher/OpenSslNative.java" rel="nofollow noreferrer">https://github.com/apache/commons-crypto/blob/master/src/main/java/org/apache/commons/crypto/cipher/OpenSslNative.java</a>

Note how <code>import java.nio.ByteBuffer;</code> is used to allow for C output buffers.

The associated .c program is here:

<a href="https://github.com/apache/commons-crypto/blob/master/src/main/native/org/apache/commons/crypto/cipher/OpenSslNative.c" rel="nofollow noreferrer">https://github.com/apache/commons-crypto/blob/master/src/main/native/org/apache/commons/crypto/cipher/OpenSslNative.c</a>

It's written with cross-platform support in mind, and is a good example. Every exported function must begin with <code>JNIEXPORT</code>, and you can see how the full class path is in each function name.

I've seen a lot of bad JNI bindings, passing strings around, etc. Starting with a solid base goes a long way toward building good OpenSSL integration in Java.

blocks|key|5457563|text|您可以在java\jdk\jre\bin目录中使用keytool+java工具。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5457564|entityMap^0|4|G|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

You can use keytool java tool in your <code>java\jdk\jre\bin</code> directory.

I have to use OpenSSL in a Java web project and I don't know anything about 'OpenSSL'.

How can I integrate OpenSSL with my project? is there any good fundamental tutorials to learn this?

OpenSSL with Java

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我必须在Java web项目中使用OpenSSL，但我对“OpenSSL”一无所知。如何将OpenSSL集成到我的项目中？有没有什么好的基础教程来学习这一点？

问使用Java的OpenSSL
EN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Java的OpenSSLEN

回答 7

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Java的OpenSSL
EN