如何在 Spring Boot 应用程序中启用吊销检查？答案

【问题标题】：How to enable revocation checking in springboot application?如何在 Spring Boot 应用程序中启用吊销检查？
【发布时间】：2021-03-25 20:45:54
【问题描述】：

我正在使用 AdoptOpenJDK 11 开发 springboot 应用程序。我想了解如何启用吊销检查。默认情况下，使用 PKIXCertPathValidator 并禁用撤销检查。我已经将-Dcom.sun.security.enableCRLDP=true -Dcom.sun.net.ssl.checkRevocation=true 设置为VM 参数和Security.setProperty("ocsp.enable", "true")，但它们似乎对仍处于禁用状态的撤销检查没有任何影响。

感谢您的快速帮助。

【问题讨论】：

您是否可能通过调用PKIXParameters.setRevocationEnabled(false) 禁用了撤销检查？
我假设 SSLHostConfig 有一个标志 revocationCheckEnabled 并且它的值为 false？我相信这是问题所在，但我不知道如何使用 spring 配置和在 server.port spring prop 上运行的连接器来设置它的值。连接器连接器 = new Connector("org.apache.coyote.http11.Http11NioProtocol"); Http11NioProtocol http11NioProtocol = (Http11NioProtocol) connector.getProtocolHandler(); SSLHostConfig sslHostConfig = new SSLHostConfig(); sslHostConfig.setRevocationEnabled(true); http11NioProtocol.addSslHostConfig(sslHostConfig);

标签： java spring-boot java-security

【解决方案1】：

我有两种方法-

一种方式-

@Configuration public class ContainerCustomizer {

//Spring properties
@Value("${isRevocationCheckEnabled}")
private String isRevocationCheckEnabled;

//Other Spring properties here

@Bean
@Autowired
public TomcatServletWebServerFactory containerFactory() {
    TomcatServletWebServerFactory  tomcat = new TomcatServletWebServerFactory ();
    tomcat.addAdditionalTomcatConnectors(createSSLConnector(keyStore, keyStorePassword, keyAlias, keyStoreType, clientAuth,
            protocol, enabledProtocol, trustStoreType, trustStore, trustStorePassword, ciphers, port, Boolean.parseBoolean(isRevocationCheckEnabled)));
    return tomcat;
}

private Connector createSSLConnector(String keyStore, String keyStorePassword, String keyAlias, String keyStoreType, 
        String clientAuth, String protocol, String enabledProtocol, String trustStoreType, String trustStore, 
        String trustStorePassword, String ciphers, int port, boolean isRevocationCheckEnabled) {
    Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
    Http11NioProtocol http11NioProtocol = (Http11NioProtocol) connector.getProtocolHandler();
    SSLHostConfig sslHostConfig = new SSLHostConfig();
    sslHostConfig.setRevocationEnabled(isRevocationCheckEnabled);
    http11NioProtocol.addSslHostConfig(sslHostConfig);
    File keystore = new File(keyStore);
    File truststore = new File(trustStore);
    connector.setScheme("https");
    connector.setSecure(true);
    connector.setPort(port);

    http11NioProtocol.setKeystoreType(keyStoreType);
    http11NioProtocol.setKeystoreFile(keystore.getAbsolutePath());
    http11NioProtocol.setKeystorePass(keyStorePassword);
    http11NioProtocol.setKeyAlias(keyAlias);
    http11NioProtocol.setSSLEnabled(true);

    http11NioProtocol.setTruststoreFile(truststore.getAbsolutePath());
    http11NioProtocol.setTruststorePass(trustStorePassword);
    http11NioProtocol.setClientAuth(Boolean.TRUE.toString());
    
    http11NioProtocol.setCiphers(ciphers);
    http11NioProtocol.setSslEnabledProtocols(enabledProtocol);
    return connector;
}}

第二种方式-

@Controller public class ContainerCustomizer implements TomcatConnectorCustomizer {
 //spring properties
 @Value{"isRevocationCheckEnabled"}
 private String isRevocationCheckBoolean;

 @Override
 public void customize(Connector connector){
    Http11NioProtocol protocol = (Http11NioProtocol) connector.getProtocolHandler();
    SSLHostConfig[] sslConfigs = protocol.findSslHostConfigs();
    for (SSLHostConfig sslHostConfig : sslConfigs) {
       
   sslHostConfig.setRevocationEnabled(Boolean.parseBoolean(isRevocationCheckEnabled));
    }
 }}

【讨论】：