英文:
Understanding the SSL Trust Strategy
问题
以下是翻译好的部分:
我正在尝试理解在方法loadTrustMaterial中应该采用什么样的TrustStrategy。
public SSLContextBuilder loadTrustMaterial(KeyStore truststore,
TrustStrategy trustStrategy)
throws NoSuchAlgorithmException,
KeyStoreException
我找到了四个不同的示例,我非常想知道这四个示例之间的区别,因为描述太少,很难理解它们之间的差异/用途/优缺点。
以下是这四个不同的代码示例:
TrustStrategy:这似乎是在此处重写了标准的JSSE证书验证过程,但它始终返回true,那么它是否也会信任无效的证书呢?
TrustStrategy trustStrategy = new TrustStrategy() {
@Override
public boolean isTrusted(X509Certificate[] x509Certificates, String authType) throws CertificateException {
return true;
}
};
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, trustStrategy);
NULL:我们没有提供任何策略,那么它会做什么?
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, null);
TrustAllStrategy:它会信任所有已签名的证书,那么这样安全吗?
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, new TrustAllStrategy());
TrustSelfSignedStrategy:这与TrustAllStrategy之间有什么区别?
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, new TrustSelfSignedStrategy());
请帮助我理解这四个示例版本之间的区别,谢谢!
英文:
I am trying to understand what TrustStrategy is to adopt for the method loadTrustMaterial.
public SSLContextBuilder loadTrustMaterial(KeyStore truststore,
TrustStrategy trustStrategy)
throws NoSuchAlgorithmException,
KeyStoreException
I found four different examples and I am very curious to know the difference between these four as the description is too little to understand the differences/usages/advantages/disadvantages.
Here are the four different code examples:
TrustStrategy: This seems like here we are overriding the standard JSSE certificate verification process but it always returning true so does it trust invalid certificates too?
TrustStrategy trustStrategy = new TrustStrategy() {
@Override
public boolean isTrusted(X509Certificate[] x509Certificates, String authType) throws CertificateException {
return true;
}
};
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, trustStrategy);
NULL: We are NOT giving any Strategy so what it will do?
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, null);
TrustAllStrategy: It will trust all singed certificate so is that secure though?
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, new TrustAllStrategy());
TrustSelfSignedStrategy: What is the difference between this and TrustAllStrategy?
SSLContextBuilder sslContextBuilder = SSLContexts.custom()
.loadTrustMaterial(trustStore, new TrustSelfSignedStrategy());
Help me to understand the difference between these four versions of the example, please? Thanks in Advance.
答案1
得分: 8
首先,强烈不建议信任所有证书。最好是将证书添加到信任存储中。
TrustStrategy
是一个接口,由一些类型实现。
这里的所有方法都来自于 Apache 的 httpclient
- 第一个方法(覆盖 isTrusted 方法)与 TrustAllStrategy
几乎相同,只是创建了一个自定义的 TrustStrategy
实例,您可以在其中定义自己的方法来确定是否信任证书。
在这里查看 TrustAllStrategy
的源代码:
public class TrustAllStrategy implements TrustStrategy {
public static final TrustAllStrategy INSTANCE = new TrustAllStrategy();
@Override
public boolean isTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
return true;
}
}
将 TrustStrategy
设置为 null 将导致没有任何 TrustManager
:
public SSLContextBuilder loadTrustMaterial(
final KeyStore truststore,
final TrustStrategy trustStrategy) throws NoSuchAlgorithmException, KeyStoreException {
final TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(
trustManagerFactoryAlgorithm == null ? TrustManagerFactory.getDefaultAlgorithm()
: trustManagerFactoryAlgorithm);
tmfactory.init(truststore);
final TrustManager[] tms = tmfactory.getTrustManagers();
if (tms != null) {
if (trustStrategy != null) {
for (int i = 0; i < tms.length; i++) {
final TrustManager tm = tms[i];
if (tm instanceof X509TrustManager) {
tms[i] = new TrustManagerDelegate(
(X509TrustManager) tm, trustStrategy);
}
}
}
for (final TrustManager tm : tms) {
this.trustManagers.add(tm);
}
}
return this;
}
TrustSelfSignedStrategy
的工作原理如下:
@Override
public boolean isTrusted(
final X509Certificate[] chain, final String authType) throws CertificateException {
return chain.length == 1;
}
自签名证书是由证书的目标颁发的。在许多应用程序中,默认生成此类证书,并且通常用于内部网络。
英文:
First of all, trusting all certificates is highly discouraged. Rather add the certificates to the truststore.
The TrustStategy
is an interface, implemented by some types.
All these methods here are from the apache httpclient
- the first one (overriding the isTrusted method) is more or less equal to the TrustAllStrategy
and just creating a custom instance of a TrustStrategy
where you could define your own way to determine whether a certificate is trusted or not.
See the sourcecode of the TrustAllStrategy
here:
public class TrustAllStrategy implements TrustStrategy {
public static final TrustAllStrategy INSTANCE = new TrustAllStrategy();
@Override
public boolean isTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
return true;
}
Setting the TrustStrategy
to null will result in not having any TrustManager
:
public SSLContextBuilder loadTrustMaterial(
final KeyStore truststore,
final TrustStrategy trustStrategy) throws NoSuchAlgorithmException, KeyStoreException {
final TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(
trustManagerFactoryAlgorithm == null ? TrustManagerFactory.getDefaultAlgorithm()
: trustManagerFactoryAlgorithm);
tmfactory.init(truststore);
final TrustManager[] tms = tmfactory.getTrustManagers();
if (tms != null) {
if (trustStrategy != null) {
for (int i = 0; i < tms.length; i++) {
final TrustManager tm = tms[i];
if (tm instanceof X509TrustManager) {
tms[i] = new TrustManagerDelegate(
(X509TrustManager) tm, trustStrategy);
}
}
}
for (final TrustManager tm : tms) {
this.trustManagers.add(tm);
}
}
return this;
}
The TrustSelfSignedStrategy
works as follows:
@Override
public boolean isTrusted(
final X509Certificate[] chain, final String authType) throws CertificateException {
return chain.length == 1;
}
A self singed certificate is issued by the target of the certificate. It's generated by default in many applications and often used for intranet purposes.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论