Jersey + Weblogic - javax.net.ssl.SSLKeyException：致命警报：BAD_CERTIFICATE

Question

我整天坐在一个问题上并放弃。我编写了一个球衣客户端，它适用于 Jetty，而 不适用于 Weblogic。原因可能隐藏在证书中：CN = "*.somecompany.com"。 Weblogic 不喜欢 CN 中的通配符。有人对此有有效的解决方案吗？

我将这些添加到 Weblogic 启动参数，但 Weblogic 使用许多其他客户端，所以 我不想添加这些参数：ignoreHostnameVerification: -

-Dssl.debug=true -Dweblogic.security.SSL.ignoreHostnameVerification=true 
-Dweblogic.security.SSL.enforceConstraints=off 
-Dweblogic.nodemanager.sslHostNameVerificationEnabled=false
-Dweblogic.security.SSL.allowSmallRSAExponent=true
-Dweblogic.security.SSL.ignoreHostnameVerification=true

我还使用 webbrowser 访问了 REST 服务并将证书下载到磁盘，然后使用 keytool 将其添加到信任库。它仍然无法正常工作。

唯一也是最好的方法是编写一些自定义来验证主机名？也许这个通配符是个问题.. 但我是新手，不知道怎么写，一个工作示例将不胜感激，我自己无法做到：/

以下是我发现的异常（不确定哪些存在以及何时出现，但仍然无法正常工作）我试图通过以下方式修复它：

1) 将整个证书链导入信任库（Java 和 Weblogic 信任库）

2）给Weblogic添加启动参数，但不是很好的解决方案

com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLKeyException: FATAL 
Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
com.sun.jersey.api.client.ClientHandlerException: 
javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt 
or unuseable certificate was received.
         at 
    com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHa    ndler.java:131)
         at com.sun.jersey.api.client.Client.handle(Client.java:629)
     at 
com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)
     at 
com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
     at 
com.sun.jersey.api.client.WebResource$Builder.post(WebResource.java:507)
     at 

第二

with Severity: FATAL, Type: 42
java.lang.Exception: New alert stack
    at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
    at         com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
    at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
    at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
    at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
    at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
    at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown     Source)
    at com.certicom.tls.record.WriteHandler.write(Unknown Source)
    at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
    at java.io.FilterOutputStream.flush(FilterOutputStream.java:140)
    at weblogic.net.http.HttpURLConnection.writeRequests(HttpURLConnection.java:154)
    at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:358)
    at     weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
    at weblogic.net.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:702)
    at weblogic.net.http.HttpURLConnection.getResponseCode(HttpURLConnection.java:962)
    at      com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:217)
    at     com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:129)
    at com.sun.jersey.api.client.Client.handle(Client.java:629)
    at com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)
    at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
    at com.sun.jersey.api.client.WebResource$Builder.post(WebResource.java:507)
    at  

第三

 E7C0E2529308F> <> <1387573464164> <BEA-000000> <Failure loading trusted CA list
java.security.cert.CertificateParsingException: Could not set value for ASN.1     string     object.
    at com.certicom.security.cert.internal.x509.X509V3CertImpl.<init>(Unknown Source)
    at com.certicom.tls.interfaceimpl.CertificateSupport.addTrustedCertificate(Unknown      Source)
    at com.certicom.net.ssl.SSLContext.addTrustedCertificate(Unknown Source)
    at com.bea.sslplus.CerticomSSLContext.addTrustedCA(Unknown Source)
    at weblogic.security.utils.SSLContextWrapper.addTrustedCA(SSLContextWrapper.java:62)
    at weblogic.security.utils.SSLSetup.getSSLContext(SSLSetup.java:320)
    at weblogic.net.http.HttpsClient.openServer(HttpsClient.java:334)
    at weblogic.net.http.HttpsClient.New(HttpsClient.java:566)
    at weblogic.net.http.HttpsURLConnection.getHttpClient(HttpsURLConnection.java:339)
    at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:408)
    at weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
    at weblogic.net.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:702)
    at weblogic.net.http.HttpURLConnection.getResponseCode(HttpURLConnection.java:962)
    at com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:217)
    at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:129)
    at com.sun.jersey.api.client.Client.handle(Client.java:629)
    at com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)
    at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
    at com.sun.jersey.api.client.WebResource$Builder.post(WebResource.java:507)
    at 

Answer 1

尝试将站点证书添加到您的 weblogic 信任库，然后在您的 weblogic 启动中添加以下参数

-DUseSunHttpHandler=true
-Dssl.SocketFactory.provider=sun.security.ssl.SSLSocketFactoryImpl 
-Dssl.ServerSocketFactory.provider=sun.security.ssl.SSLSocketFactoryImpl

我遇到了像你这样的问题，通过这篇文章我解决了 Cannot access HTTPS from Weblogic

Answer 2

通过在 JVM 参数中添加这些条目来解决问题

"-Dweblogic.security.SSL.nojce=true"
"-Dweblogic.ssl.JSSEEnabled=true"
"-Dweblogic.security.SSL.enableJSSE=true"