英文:
Java client not picking root/intermediate certificates from Windows Trust Store
问题
我有一个正在运行的Jetty服务器，使用SSL证书，该证书具有根->中间->主机证书链。
我有一个在Windows上运行的Java客户端，连接到此服务器。我正在使用以下系统属性来设置信任存储，但除非我将“主机”证书导入Windows的“受信任的根证书颁发机构”存储中，否则它不起作用。我在Windows的“中间证书颁发机构”存储中有中介和根证书，但Java不会选择它们并抛出SSL错误。然而，Chrome可以完美运行，而不会发出任何警告。
System.setProperty("javax.net.ssl.trustStore", "NUL");
System.setProperty("javax.net.ssl.trustStoreType", "Windows-ROOT");
根据我的理解，即使客户端机器上有根证书或中间证书，Java也应该能够选择它。是否需要将中间证书和根证书放在“受信任的根证书颁发机构”存储中？将其放在“中间证书颁发机构”中是否不起作用？Java从哪个存储类别选择证书？
请帮助。
英文:
I have a Jetty server running with SSL certificate which has root->intermediate->host certificate chain.
I have a Java client on Windows which connects to this server. I am using below system properties to set trust store but it does not work unless I import "host" certificate in Windows "Trusted Root Certificate Authorities" store. I have intermediary and root certificates in "Intermediate Certificate Authorities" store of Windows, but Java does not pick them and throws SSL error. However, Chrome works perfectly without issueing any warning.
System.setProperty("javax.net.ssl.trustStore", "NUL");
System.setProperty("javax.net.ssl.trustStoreType", "Windows-ROOT");
As per my understanding, even if root or intermediary certificate is there on client machine, Java should be able to pick it.
Is it required to put intermediates and root under "Trusted Root authorities" store? Would putting under "Intermediate Certificate Authorities" not work? From which store category, Java picks the certificates?
Please help.
答案1
得分: 1
这是在服务器仅返回叶子证书而不返回中间证书时发生的情况。https://stackoverflow.com/questions/54612772/does-a-tls-client-needs-to-have-intermediate-ca-in-the-trust-store 解释说这实际上是一个服务器问题，而不是客户端问题。根据那个建议，问题得以解决。
英文:
This happens when the server only returns the leaf certificate and not the intermediate certificates. https://stackoverflow.com/questions/54612772/does-a-tls-client-needs-to-have-intermediate-ca-in-the-trust-store explains it is actually a server issue and not a client issue. Following that advice it solved my issue.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论