使用证书在 netflix-zuul 和微服务之间进行身份验证答案

【问题标题】：Authentication between netflix-zuul and microservice with certificates使用证书在 netflix-zuul 和微服务之间进行身份验证
【发布时间】：2019-11-25 14:22:25
【问题描述】：

我在我的应用程序 netflix-zuul 中配置了调用其他服务，需要在应用程序中包含证书。

我正在尝试做与this question 相同的操作（使用带有证书的 netflix-zuul），但我遇到了问题..

例如，在this link 中，它表示使用了 .keystore，但我拥有的文件是 .cer 和 .key，我看不到如何使用我拥有的文件应用证书。

您能帮我将我拥有的证书与我的应用程序的 netflix-zuul 代理连接起来吗？

非常感谢大家！

EDIT ->我试过this link的解决方案，我的代码：

@Bean
    public CloseableHttpClient httpClient() throws Throwable {

    InputStream is = new FileInputStream(KEYSTOREPATH);
    //KEYSTOREPATH =    String KEYSTOREPATH = "E:/ARC/myapp/src/main/java/com/myapp/services/myapp/myapp.cer";

    // You could get a resource as a stream instead.

    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    X509Certificate caCert = (X509Certificate)cf.generateCertificate(is);

    TrustManagerFactory tmf = TrustManagerFactory
        .getInstance(TrustManagerFactory.getDefaultAlgorithm());
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
    ks.load(null); // You don't need the KeyStore instance to come from a file.
    ks.setCertificateEntry("caCert", caCert);

    tmf.init(ks);

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, tmf.getTrustManagers(), null);

  return HttpClients.custom().setSSLContext(sslContext).build();

}

在执行 netflix-zuul 中配置的路径时，我收到此错误：

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1460)
    ... 105 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
    ... 111 common frames omitted

【问题讨论】：

标签： java spring-boot ssl ssl-certificate netflix-zuul

【解决方案1】：

您可以尝试构建 SSLContext 并信任来自 .cer 文件的证书，如此处提到/描述的： Using SSLContext with just a CA certificate and no keystore

【讨论】：

非常感谢 Mohit 的回答，我已经尝试了他们在您告诉我的链接中放入的内容，当您启动应用程序并调用 netflix-zuul 服务时，我收到一个您无法使用的错误查找证书：原因：sun.security.provider.certpath.SunCertPathBuilderException：无法找到请求目标的有效证书路径

【解决方案2】：

Javier，我能够如下构建 SSLContext。你还有这个问题吗。

 @Test
public void sslContext() {
    Class demoClass = Demo.class;
    InputStream is  = demoClass.getResourceAsStream("/test.cert");
    try {
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509Certificate caCert = (X509Certificate) cf.generateCertificate(is);
        TrustManagerFactory tmf = TrustManagerFactory
                .getInstance(TrustManagerFactory.getDefaultAlgorithm());
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(null); // You don't need the KeyStore instance to come from a file.
        ks.setCertificateEntry("caCert", caCert);
        tmf.init(ks);
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);
    } catch (CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException | KeyManagementException e) {
        e.printStackTrace();
    }
}

【讨论】：