Android MQTT认证Mosquitto: javax.n

2020-12-31 本文已影响0人 maiduoduo

导读：在进行多证书验证的过程中，会出现握手失败的情况

2020-12-31 10:43:26.673 4415-4415/? W/System.err: Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:229)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:97)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:676)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:   ... 1 more
2020-12-31 10:43:26.673 4415-4415/? W/System.err: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:661)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:539)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:605)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:495)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:418)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:339)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:88)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:208)
2020-12-31 10:43:26.673 4415-4415/? W/System.err:     at com.android.org.conscrypt.ConscryptFileDescriptorSocket.verifyCertificateChain(ConscryptFileDescriptorSocket.java:404)
2020-12-31 10:43:26.674 4415-4415/? W/System.err:     at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
2020-12-31 10:43:26.674 4415-4415/? W/System.err:     at com.android.org.conscrypt.NativeSsl.doHandshake(NativeSsl.java:375)
2020-12-31 10:43:26.674 4415-4415/? W/System.err:     at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:224)

场景：MQTT Android 端与服务端Mosquitto作传输通讯过程，需要用到：

mMqttConnectOptions = new MqttConnectOptions();
 InputStream caCrtFileI = getResources().openRawResource(R.raw.ca_c88);
 InputStream crtFile = getResources().openRawResource(R.raw.crt_c88);
 InputStream keyFile = getResources().openRawResource(R.raw.key_c88);
 mMqttConnectOptions.setSocketFactory(getSocketFactory(caCrtFileI, crtFile, keyFile, ""));

 /**
     * 多证书认证
     * @param caCrtFile ca.crt
     * @param crtFile 92e89e010253a4ab2e430f6254850c88.crt
     * @param keyFile 92e89e010253a4ab2e430f6254850c88.key
     * @param password " "
     * @return
     * @throws Exception
     */
    public static SSLSocketFactory getSocketFactory(InputStream caCrtFile, InputStream crtFile, InputStream keyFile, String password) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        // load CA certificate
        X509Certificate caCert = null;

        BufferedInputStream bis = new BufferedInputStream(caCrtFile);
        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        while (bis.available() > 0) {
            caCert = (X509Certificate) cf.generateCertificate(bis);
        }

        // load client certificate
        BufferedInputStream bis1 = new BufferedInputStream(crtFile);
        X509Certificate cert = null;
        while (bis1.available() > 0) {
            cert = (X509Certificate) cf.generateCertificate(bis1);
        }

        // load client private cert
        PEMParser pemParser = new PEMParser(new InputStreamReader(keyFile));
        Object object = pemParser.readObject();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
        KeyPair key = converter.getKeyPair((PEMKeyPair) object);

        KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
        caKs.load(null, null);
        caKs.setCertificateEntry("cert-certificate", caCert);
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(caKs);

        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(null, null);
        ks.setCertificateEntry("certificate", cert);
        ks.setKeyEntry("private-cert", key.getPrivate(), password.toCharArray(),
                new java.security.cert.Certificate[]{cert});
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(ks, password.toCharArray());
        SSLContext context = SSLContext.getInstance("TLSv1.2");
//        SSLContext context = SSLContext.getInstance("TLS");
        context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        return context.getSocketFactory();
    }

解决方法：