服务器的瞬时 Diffie-Hellman 公共密钥过弱

<dependency>

	<groupId>org.bouncycastle</groupId>

	<artifactId>bcpkix-jdk15on</artifactId>

	<version>1.54</version>

</dependency>

import java.io.BufferedReader;

import java.io.BufferedWriter;

import java.io.Closeable;

import java.io.IOException;

import java.io.InputStreamReader;

import java.io.OutputStreamWriter;

import java.net.Socket;

import java.security.KeyStore;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.List;

import java.util.concurrent.ExecutorService;

import java.util.concurrent.Executors;



import javax.net.ssl.KeyManagerFactory;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLParameters;

import javax.net.ssl.SSLServerSocket;

import javax.net.ssl.SSLServerSocketFactory;

import javax.net.ssl.TrustManagerFactory;



public class SSLServerDemo implements Runnable {



	private Socket socket;



	private SSLServerDemo(Socket socket) {

		this.socket = socket;

	}



	public static void main(String[] args) throws Exception {

		KeyManagerFactory kmf = KeyManagerFactory.getInstance("SUNX509"/*NEWSUNX509*/);

		KeyStore serverStore = CertMakeDemo.createKeyStore("DemoServer", "123456");

		kmf.init(serverStore, "123456".toCharArray());



		TrustManagerFactory tmf = TrustManagerFactory.getInstance("SUNX509"/*PKIX*/);

		KeyStore clientStore = KeyStore.getInstance("PKCS12"/*JKS, WINDOWS-ROOT, JCEKS等*/);

		clientStore.load(null, null);

		tmf.init(clientStore);



		SSLContext context = SSLContext.getInstance("SSL"/*TLS, SSLV3, DEFAULT, "TLSV1"*/);

		context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

		SSLParameters parameters = context.getDefaultSSLParameters();

		List<String> cipherSuites = new ArrayList<String>(Arrays.asList(parameters.getCipherSuites()));

		cipherSuites.remove("TLS_DHE_RSA_WITH_AES_128_CBC_SHA");

		parameters.setCipherSuites(cipherSuites.toArray(new String[0]));

		System.out.println(Arrays.asList(parameters.getCipherSuites()));



		SSLServerSocketFactory factory = context.getServerSocketFactory();

		SSLServerSocket serverSocket = (SSLServerSocket) factory.createServerSocket(443);

		//serverSocket.setNeedClientAuth(true);浏览器会提示选择个人私钥证书，tmf需要能够认证客户端证书

		System.out.println("server started. try https://localhost");



		ExecutorService executor = Executors.newCachedThreadPool();

		for (Socket socket; (socket = serverSocket.accept()) != null;) {

			executor.submit(new SSLServerDemo(socket));

		}

	}



	public void run() {

		BufferedReader in = null;

		BufferedWriter out = null;

		try {

			in = new BufferedReader(new InputStreamReader(socket.getInputStream(), "UTF-8"));

			out = new BufferedWriter(new OutputStreamWriter(socket.getOutputStream(), "UTF-8"));



			out.write("HTTP/1.1 200 OK\r\n");

			out.write("Content-Type: text/html;charset=UTF-8\r\n");

			out.write("\r\n");

			for (String line; (line = in.readLine()) != null;) {

				out.write(line + "<br>\r\n");

				out.flush();

				System.out.println(line);

			}

		}

		catch (Exception e) {

			e.printStackTrace();

		}

		finally {

			if (!socket.isClosed() && socket.isConnected()) {

				closeQuietly(in);

				closeQuietly(out);

			}

		}

	}



	private void closeQuietly(Closeable closeable) {

		if (closeable != null) {

			try {

				closeable.close();

			}

			catch (IOException e) {

				e.printStackTrace();

			}

		}

	}

}

import java.io.ByteArrayInputStream;

import java.io.FileOutputStream;

import java.io.OutputStream;

import java.math.BigInteger;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import java.security.KeyStore;

import java.security.PrivateKey;

import java.security.PublicKey;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.cert.X509Certificate;

import java.text.SimpleDateFormat;

import java.util.Date;

import java.util.Enumeration;



import org.bouncycastle.asn1.ASN1Encodable;

import org.bouncycastle.asn1.DEROctetString;

import org.bouncycastle.asn1.DERSequence;

import org.bouncycastle.asn1.DERTaggedObject;

import org.bouncycastle.asn1.x500.X500Name;

import org.bouncycastle.asn1.x509.Extension;

import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;

import org.bouncycastle.cert.X509v3CertificateBuilder;

import org.bouncycastle.operator.ContentSigner;

import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;



public class CertMakeDemo {



	public static void main(String[] args) throws Exception {

		X500Name subject = new X500Name("CN=root, O=root, OU=root");

		KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");

		gen.initialize(1024);

		KeyPair pair = gen.generateKeyPair();

		X509Certificate certificate = signerSelf(subject, pair);

		System.out.println("证书：" + certificate);



		KeyStore pkcs12 = KeyStore.getInstance("PKCS12");

		pkcs12.load(null, null);

		pkcs12.setKeyEntry("root", pair.getPrivate(), "123456".toCharArray(), new Certificate[] { certificate });

		for (Enumeration<String> e = pkcs12.aliases(); e.hasMoreElements();) {

			String alias = e.nextElement();

			System.out.println(pkcs12.getCertificateChain(alias));

			System.out.println(pkcs12.getKey(alias, "123456".toCharArray()));

		}

		OutputStream out = new FileOutputStream("f:/temp/root.pfx");

		pkcs12.store(out, "123456".toCharArray());

		out.close();



		//root为张三签发证书

		X500Name zsSubject = new X500Name("CN=张三, O=张三, OU=张三");

		gen = KeyPairGenerator.getInstance("RSA");

		gen.initialize(1024);

		KeyPair zsKeypair = gen.generateKeyPair();

		X509Certificate zsCertificate = signer(zsSubject, zsKeypair.getPublic(), certificate, pair.getPrivate());

		System.out.println("张三证书：" + zsCertificate);

		out = new FileOutputStream("f:/temp/zhangsan.cer");

		out.write(zsCertificate.getEncoded());

		out.close();

	}



	public static KeyStore createKeyStore(String subjectName, String pwd) throws Exception {

		X500Name subject = new X500Name("CN=" + subjectName);

		KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA");

		gen.initialize(1024);

		KeyPair pair = gen.generateKeyPair();

		X509Certificate certificate = signerSelf(subject, pair);



		KeyStore store = KeyStore.getInstance("PKCS12");

		store.load(null, null);

		store.setKeyEntry("root", pair.getPrivate(), pwd.toCharArray(), new Certificate[] { certificate });

		return store;

	}



	public static X509Certificate signer(X500Name subject, PublicKey subjectPublicKey,// 

		X509Certificate issuerCert, PrivateKey issuerPrivateKey) throws Exception {



		X500Name issuer = X500Name.getInstance(issuerCert.getSubjectX500Principal().getEncoded());

		String signatureAlgorithm = issuerCert.getSigAlgName();

		return signer(subject, subjectPublicKey, issuer, issuerPrivateKey, signatureAlgorithm);

	}



	public static X509Certificate signerSelf(X500Name subject, KeyPair pair) throws Exception {

		String signatureAlgorithm = "SHA1With" + pair.getPrivate().getAlgorithm();

		return signer(subject, pair.getPublic(), subject, pair.getPrivate(), signatureAlgorithm);

	}



	public static X509Certificate signer(X500Name subject, PublicKey subjectPublicKey,//

		X500Name issuer, PrivateKey issuerPrivateKey, String signatureAlgorithm) throws Exception {



		BigInteger sn = new BigInteger(new SimpleDateFormat("yyyyMMdd").format(new Date()));

		Date notBefore = new Date();

		Date notAfter = new Date(notBefore.getTime() + 365L * 24 * 60 * 60 * 1000);

		SubjectPublicKeyInfo publicKeyInfo = SubjectPublicKeyInfo.getInstance(subjectPublicKey.getEncoded());

		ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(issuerPrivateKey);



		X509v3CertificateBuilder builder = new X509v3CertificateBuilder(//

			issuer, sn, notBefore, notAfter, subject, publicKeyInfo);

		builder.addExtension(createSubjectAlternativeName());

		byte[] certBytes = builder.build(signer).getEncoded();



		X509Certificate certificate = (X509Certificate) CertificateFactory.getInstance("X509")//

			.generateCertificate(new ByteArrayInputStream(certBytes));



		return certificate;

	}



	/** 使用者备用名称：绑定证书和域名，解决此证书与网站不符的问题 */

	private static Extension createSubjectAlternativeName() throws Exception {

		DERTaggedObject tag1 = new DERTaggedObject(false, 2, new DEROctetString("localhost".getBytes()));

		DERTaggedObject tag2 = new DERTaggedObject(false, 2, new DEROctetString("127.0.0.1".getBytes()));

		DERSequence seq = new DERSequence(new ASN1Encodable[] { tag1, tag2 });

		Extension extension = new Extension(Extension.subjectAlternativeName, false, new DEROctetString(seq));

		return extension;

	}

}