java - gui - Registrar múltiples almacenes de claves en JVM

jframe en java

Question

Tengo dos aplicaciones ejecutándose en la misma máquina virtual de Java, y ambas usan diferentes almacenes de claves y almacenes de confianza.

Una opción viable sería usar un solo almacén de claves e importar todos los demás en el almacén de claves compartido (por ejemplo, keytool -import), pero realmente ayudaría a mis requisitos si pudiera usar almacenes de claves separados para aplicaciones separadas que se ejecutan en el mismo jvm.

Podría establecer keystore y truststores para usarlos como parámetros jvm o propiedades del sistema de la siguiente manera:

java -Djavax.net.ssl.keyStore=serverKeys
-Djavax.net.ssl.keyStorePassword=password
-Djavax.net.ssl.trustStore=serverTrust
-Djavax.net.ssl.trustStorePassword=password SSLApplication

o

System.setProperty("javax.net.ssl.keyStore","serverKeys")

Pero el problema con este enfoque es que especifica el almacén de claves / almacén de confianza que se utilizará en un nivel de JVM, por lo tanto, todas las aplicaciones que se ejecutan en la misma JVM obtienen el mismo almacén de claves / almacén de confianza.

También intenté crear un SSLContext personalizado y configurarlo como valor predeterminado, pero también establece el contexto para todas las aplicaciones que se ejecutan en la misma JVM.

SSLContext context = SSLContext.getInstance("SSL");
context.init(kms, tms, null);
SSLContext.setDefault(context);

Quiero poder usar diferentes almacenes de claves / almacenes de confianza sin modificar los códigos de aplicaciones individuales.

Una solución que pueda registrar dinámicamente múltiples almacenes de claves además de los keystore / certs predeterminados en jre en jvm sería genial.

La solución funcionará de esta manera:

• Cuando se inicia JVM, carga todos los certs / keystores predeterminados de la carpeta jre / certs (comportamiento java predeterminado cuando no se especifican almacenes de claves).
• Cuando la aplicación 1 carga, registra sus almacenes de claves,
• luego, cuando la App 2 se carga, registra sus keystores ...

Por favor, hágame saber sus ideas o soluciones. ¡Gracias por adelantado!

Answer 1

Después de jugar con el código que recibí de ZZ Coder, sylvarking y Software Monkey, encontré una solución que funciona:

Primero, escribí un X509KeyManager que funciona combina un almacén de claves personalizado y un almacén de claves predeterminado.

class MultiKeyStoreManager implements X509KeyManager {
private static final Logger logger = Logger.getLogger(MultiKeyStoreManager.class);
private final X509KeyManager jvmKeyManager;
private final X509KeyManager customKeyManager;
public MultiKeyStoreManager(X509KeyManager jvmKeyManager, X509KeyManager customKeyManager ) {
this.jvmKeyManager = jvmKeyManager;
this.customKeyManager = customKeyManager;
}
@Override
public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
// try the first key manager
String alias = customKeyManager.chooseClientAlias(keyType, issuers, socket);
if( alias == null ) {
alias = jvmKeyManager.chooseClientAlias(keyType, issuers, socket);
logger.warn("Reverting to JVM CLIENT alias : " + alias);
}
return alias;
}
@Override
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
// try the first key manager
String alias = customKeyManager.chooseServerAlias(keyType, issuers, socket);
if( alias == null ) {
alias = jvmKeyManager.chooseServerAlias(keyType, issuers, socket);
logger.warn("Reverting to JVM Server alias : " + alias);
}
return alias;
}
@Override
public X509Certificate[] getCertificateChain(String alias) {
X509Certificate[] chain = customKeyManager.getCertificateChain(alias);
if( chain == null || chain.length == 0) {
logger.warn("Reverting to JVM Chain : " + alias);
return jvmKeyManager.getCertificateChain(alias);
} else {
return chain;
}
}
@Override
public String[] getClientAliases(String keyType, Principal[] issuers) {
String[] cAliases = customKeyManager.getClientAliases(keyType, issuers);
String[] jAliases = jvmKeyManager.getClientAliases(keyType, issuers);
logger.warn("Supported Client Aliases Custom: " + cAliases.length + " JVM : " + jAliases.length);
return ArrayUtils.join(cAliases,jAliases);
}
@Override
public PrivateKey getPrivateKey(String alias) {
PrivateKey key = customKeyManager.getPrivateKey(alias);
if( key == null ) {
logger.warn("Reverting to JVM Key : " + alias);
return jvmKeyManager.getPrivateKey(alias);
} else {
return key;
}
}
@Override
public String[] getServerAliases(String keyType, Principal[] issuers) {
String[] cAliases = customKeyManager.getServerAliases(keyType, issuers);
String[] jAliases = jvmKeyManager.getServerAliases(keyType, issuers);
logger.warn("Supported Server Aliases Custom: " + cAliases.length + " JVM : " + jAliases.length);
return ArrayUtils.join(cAliases,jAliases);
}
}

Luego, puede usar este administrador de almacén de claves al crear un Contexto SSL o SocketFactory. El código necesita algunas refactorizaciones y arreglos, pero funciona perfectamente.

 /**
* Returns an array of KeyManagers, set up to use the required keyStore.
* This method does the bulk of the work of setting up the custom trust managers.
*
* @param props
*
* @return an array of KeyManagers set up accordingly.
*/
private static KeyManager[] getKeyManagers(Properties props) throws IOException, GeneralSecurityException {
// First, get the default KeyManagerFactory.
String alg = KeyManagerFactory.getDefaultAlgorithm();
KeyManagerFactory kmFact = KeyManagerFactory.getInstance(alg);
// Next, set up the KeyStore to use. We need to load the file into
// a KeyStore instance.
FileInputStream fis = new FileInputStream(props.getProperty(SSL_KEYSTORE));
logger.info("Loaded keystore");
KeyStore ks = KeyStore.getInstance("jks");
String keyStorePassword = props.getProperty(SSL_KEYSTORE_PASSWORD);
ks.load(fis, keyStorePassword.toCharArray());
fis.close();
// Now we initialise the KeyManagerFactory with this KeyStore
kmFact.init(ks, keyStorePassword.toCharArray());
// default
KeyManagerFactory dkmFact = KeyManagerFactory.getInstance(alg);
dkmFact.init(null,null);
// Get the first X509KeyManager in the list
X509KeyManager customX509KeyManager = getX509KeyManager(alg, kmFact);
X509KeyManager jvmX509KeyManager = getX509KeyManager(alg, dkmFact);
KeyManager[] km = { new MultiKeyStoreManager(jvmX509KeyManager, customX509KeyManager) };
logger.debug("Number of key managers registered:" + km.length);
return km;
}
/**
* Find a X509 Key Manager compatible with a particular algorithm
* @param algorithm
* @param kmFact
* @return
* @throws NoSuchAlgorithmException
*/
private static X509KeyManager getX509KeyManager(String algorithm, KeyManagerFactory kmFact)
throws NoSuchAlgorithmException {
KeyManager[] keyManagers = kmFact.getKeyManagers();
if (keyManagers == null || keyManagers.length == 0) {
throw new NoSuchAlgorithmException("The default algorithm :" + algorithm + " produced no key managers");
}
X509KeyManager x509KeyManager = null;
for (int i = 0; i < keyManagers.length; i++) {
if (keyManagers[i] instanceof X509KeyManager) {
x509KeyManager = (X509KeyManager) keyManagers[i];
break;
}
}
if (x509KeyManager == null) {
throw new NoSuchAlgorithmException("The default algorithm :"+ algorithm + " did not produce a X509 Key manager");
}
return x509KeyManager;
}
private static void initialiseManager(Properties props) throws IOException, GeneralSecurityException {
// Next construct and initialise a SSLContext with the KeyStore and
// the TrustStore. We use the default SecureRandom.
SSLContext context = SSLContext.getInstance("SSL");
context.init(getKeyManagers(props), getTrustManagers(props), null);
SSLContext.setDefault(context);
}

Avíseme si alguien tiene alguna pregunta o necesita algún código de demostración.

Answer 2

La respuesta de Raz fue un gran comienzo, pero no fue lo suficientemente flexible como para satisfacer mis necesidades. MultiStoreKeyManager verifica explícitamente el KeyManager personalizado y luego recurre al jvm KeyManager si falla una operación. De hecho, quiero verificar primero los certs de jvm; la mejor solución debería ser capaz de manejar cualquier caso. Además, la respuesta no proporciona un TrustManager en funcionamiento.

He escrito un par de clases más flexibles, CompositeX509KeyManager y CompositeX509TrustManager, que añaden soporte para cualquier cantidad de almacenes de claves en un orden arbitrario.

CompositeX509KeyManager

package com.mycompany.ssl;
import java.net.Socket;
import java.security.Principal;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.List;
import javax.annotation.Nullable;
import javax.net.ssl.X509KeyManager;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Iterables;
/**
* Represents an ordered list of {@link X509KeyManager}s with most-preferred managers first.
*
* This is necessary because of the fine-print on {@link SSLContext#init}:
* Only the first instance of a particular key and/or trust manager implementation type in the
* array is used. (For example, only the first javax.net.ssl.X509KeyManager in the array will be used.)
*
* @author codyaray
* @since 4/22/2013
* @see http://.com/questions/1793979/registering-multiple-keystores-in-jvm
*/
public class CompositeX509KeyManager implements X509KeyManager {
private final List keyManagers;
/**
* Creates a new {@link CompositeX509KeyManager}.
*
* @param keyManagers the X509 key managers, ordered with the most-preferred managers first.
*/
public CompositeX509KeyManager(List keyManagers) {
this.keyManagers = ImmutableList.copyOf(keyManagers);
}
/**
* Chooses the first non-null client alias returned from the delegate
* {@link X509TrustManagers}, or {@code null} if there are no matches.
*/
@Override
public @Nullable String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) {
for (X509KeyManager keyManager : keyManagers) {
String alias = keyManager.chooseClientAlias(keyType, issuers, socket);
if (alias != null) {
return alias;
}
}
return null;
}
/**
* Chooses the first non-null server alias returned from the delegate
* {@link X509TrustManagers}, or {@code null} if there are no matches.
*/
@Override
public @Nullable String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
for (X509KeyManager keyManager : keyManagers) {
String alias = keyManager.chooseServerAlias(keyType, issuers, socket);
if (alias != null) {
return alias;
}
}
return null;
}
/**
* Returns the first non-null private key associated with the
* given alias, or {@code null} if the alias can''t be found.
*/
@Override
public @Nullable PrivateKey getPrivateKey(String alias) {
for (X509KeyManager keyManager : keyManagers) {
PrivateKey privateKey = keyManager.getPrivateKey(alias);
if (privateKey != null) {
return privateKey;
}
}
return null;
}
/**
* Returns the first non-null certificate chain associated with the
* given alias, or {@code null} if the alias can''t be found.
*/
@Override
public @Nullable X509Certificate[] getCertificateChain(String alias) {
for (X509KeyManager keyManager : keyManagers) {
X509Certificate[] chain = keyManager.getCertificateChain(alias);
if (chain != null && chain.length > 0) {
return chain;
}
}
return null;
}
/**
* Get all matching aliases for authenticating the client side of a
* secure socket, or {@code null} if there are no matches.
*/
@Override
public @Nullable String[] getClientAliases(String keyType, Principal[] issuers) {
ImmutableList.Builder aliases = ImmutableList.builder();
for (X509KeyManager keyManager : keyManagers) {
aliases.add(keyManager.getClientAliases(keyType, issuers));
}
return emptyToNull(Iterables.toArray(aliases.build(), String.class));
}
/**
* Get all matching aliases for authenticating the server side of a
* secure socket, or {@code null} if there are no matches.
*/
@Override
public @Nullable String[] getServerAliases(String keyType, Principal[] issuers) {
ImmutableList.Builder aliases = ImmutableList.builder();
for (X509KeyManager keyManager : keyManagers) {
aliases.add(keyManager.getServerAliases(keyType, issuers));
}
return emptyToNull(Iterables.toArray(aliases.build(), String.class));
}
@Nullable
private static <T> T[] emptyToNull(T[] arr) {
return (arr.length == 0) ? null : arr;
}
}

CompositeX509TrustManager

package com.mycompany.ssl;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.List;
import javax.net.ssl.X509TrustManager;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.Iterables;
/**
* Represents an ordered list of {@link X509TrustManager}s with additive trust. If any one of the
* composed managers trusts a certificate chain, then it is trusted by the composite manager.
*
* This is necessary because of the fine-print on {@link SSLContext#init}:
* Only the first instance of a particular key and/or trust manager implementation type in the
* array is used. (For example, only the first javax.net.ssl.X509KeyManager in the array will be used.)
*
* @author codyaray
* @since 4/22/2013
* @see http://.com/questions/1793979/registering-multiple-keystores-in-jvm
*/
public class CompositeX509TrustManager implements X509TrustManager {
private final List trustManagers;
public CompositeX509TrustManager(List trustManagers) {
this.trustManagers = ImmutableList.copyOf(trustManagers);
}
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
for (X509TrustManager trustManager : trustManagers) {
try {
trustManager.checkClientTrusted(chain, authType);
return; // someone trusts them. success!
} catch (CertificateException e) {
// maybe someone else will trust them
}
}
throw new CertificateException("None of the TrustManagers trust this certificate chain");
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
for (X509TrustManager trustManager : trustManagers) {
try {
trustManager.checkServerTrusted(chain, authType);
return; // someone trusts them. success!
} catch (CertificateException e) {
// maybe someone else will trust them
}
}
throw new CertificateException("None of the TrustManagers trust this certificate chain");
}
@Override
public X509Certificate[] getAcceptedIssuers() {
ImmutableList.Builder certificates = ImmutableList.builder();
for (X509TrustManager trustManager : trustManagers) {
certificates.add(trustManager.getAcceptedIssuers());
}
return Iterables.toArray(certificates.build(), X509Certificate.class);
}
}

Uso

Para el caso estándar de un keystore + jvm keystore, puede cablearlo así. Estoy usando guayaba de nuevo, pero en una envoltura Guicey esta vez:

@Provides @Singleton
SSLContext provideSSLContext(KeyStore keystore, char[] password) {
String defaultAlgorithm = KeyManagerFactory.getDefaultAlgorithm();
X509KeyManager customKeyManager = getKeyManager("SunX509", keystore, password);
X509KeyManager jvmKeyManager = getKeyManager(defaultAlgorithm, null, null);
X509TrustManager customTrustManager = getTrustManager("SunX509", keystore);
X509TrustManager jvmTrustManager = getTrustManager(defaultAlgorithm, null);
KeyManager[] keyManagers = { new CompositeX509KeyManager(ImmutableList.of(jvmKeyManager, customKeyManager)) };
TrustManager[] trustManagers = { new CompositeX509TrustManager(ImmutableList.of(jvmTrustManager, customTrustManager)) };
SSLContext context = SSLContext.getInstance("SSL");
context.init(keyManagers, trustManagers, null);
return context;
}
private X509KeyManager getKeyManager(String algorithm, KeyStore keystore, char[] password) {
KeyManagerFactory factory = KeyManagerFactory.getInstance(algorithm);
factory.init(keystore, password);
return Iterables.getFirst(Iterables.filter(
Arrays.asList(factory.getKeyManagers()), X509KeyManager.class), null);
}
private X509TrustManager getTrustManager(String algorithm, KeyStore keystore) {
TrustManagerFactory factory = TrustManagerFactory.getInstance(algorithm);
factory.init(keystore);
return Iterables.getFirst(Iterables.filter(
Arrays.asList(factory.getTrustManagers()), X509TrustManager.class), null);
}

Extraje esto de mi blog sobre este problema que tiene un poco más de detalle, motivación, etc. Todo el código está ahí, así que es independiente. :)

Answer 3

Mira mi respuesta a esta pregunta,

¿Cómo puedo tener múltiples certificados SSL para un servidor Java?

Si usa MyKeyManager, puede tener varios almacenes de claves o puede usar un único almacén de claves para múltiples contextos.