无法通过X509TrustManager.getAcceptedIssuers限制受信任CA根证书

你遇到的核心问题是对getAcceptedIssuers()方法的作用理解有误：

这个方法根本不是用来验证服务器证书的——它的主要用途是在SSL握手的客户端证书请求阶段，告诉客户端“哪些CA签发的客户端证书是服务器接受的”。当服务器要求客户端提供证书时，客户端会根据这个列表来选择对应的客户端证书发送。

而你的代码里，checkServerTrusted()完全委托给了系统默认的X509TrustManager，这个默认管理器在验证服务器证书时，是用它初始化时加载的系统信任存储（比如系统内置的CA根证书）来做校验，完全不会读取你重写的getAcceptedIssuers()返回的内容。所以哪怕你返回空数组，默认验证逻辑还是会用系统信任的CA去匹配服务器证书的根CA，自然能通过验证。

要实现“仅允许指定CA根证书”的需求，不能只改getAcceptedIssuers()，必须接管checkServerTrusted()的验证逻辑，让它只信任你指定的CA。常见的实现方式有两种：

方式一：完全基于自定义CA集合构建TrustManager #

直接创建只包含你允许的CA的密钥库，用它初始化一个独立的X509TrustManager，所有验证都委托给这个管理器，彻底和系统默认信任存储隔离：

import java.security.KeyStore;
import java.security.cert.*;
import javax.net.ssl.*;
import java.io.InputStream;
import java.util.Arrays;
import java.util.HashSet;
import java.util.Set;

public class RestrictedTrustManager implements X509TrustManager {
    private final X509TrustManager restrictedTrustManager;
    private final Set<X509Certificate> acceptedIssuersSet;

    // 传入你允许的CA证书输入流（比如从文件读取的CA证书）
    public RestrictedTrustManager(InputStream... caCertInputs) throws Exception {
        // 初始化空密钥库
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null, null);

        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
        // 将指定CA证书导入密钥库
        for (InputStream is : caCertInputs) {
            X509Certificate caCert = (X509Certificate) certFactory.generateCertificate(is);
            keyStore.setCertificateEntry(caCert.getSubjectDN().getName(), caCert);
        }

        // 用自定义密钥库初始化TrustManagerFactory
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(keyStore);

        // 获取自定义的X509TrustManager
        X509TrustManager foundManager = null;
        for (TrustManager tm : tmf.getTrustManagers()) {
            if (tm instanceof X509TrustManager) {
                foundManager = (X509TrustManager) tm;
                break;
            }
        }
        if (foundManager == null) {
            throw new IllegalStateException("未找到X509TrustManager实例");
        }
        restrictedTrustManager = foundManager;
        acceptedIssuersSet = new HashSet<>(Arrays.asList(restrictedTrustManager.getAcceptedIssuers()));
    }

    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        restrictedTrustManager.checkClientTrusted(chain, authType);
    }

    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        // 使用自定义的受限TrustManager验证服务器证书
        restrictedTrustManager.checkServerTrusted(chain, authType);
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return acceptedIssuersSet.toArray(new X509Certificate[0]);
    }
}

方式二：在系统信任基础上额外限制CA #

如果想保留系统默认的信任逻辑，同时只允许指定CA，可以在checkServerTrusted()里先调用默认验证，再额外检查服务器证书的根CA是否在你的允许列表中：

import java.security.cert.X509Certificate;
import javax.net.ssl.X509TrustManager;
import java.util.HashSet;
import java.util.Set;
import java.util.Arrays;

public class FilteredDefaultTrustManager implements X509TrustManager {
    private final X509TrustManager defaultTrustManager;
    private final Set<String> allowedCaSubjectDns;

    // 传入允许的CA的主题DN（比如"CN=Example Root CA, O=Example Corp"）
    public FilteredDefaultTrustManager(X509TrustManager defaultTm, String... allowedCaDns) {
        this.defaultTrustManager = defaultTm;
        this.allowedCaSubjectDns = new HashSet<>(Arrays.asList(allowedCaDns));
    }

    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        defaultTrustManager.checkClientTrusted(chain, authType);
    }

    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        // 先通过系统默认验证
        defaultTrustManager.checkServerTrusted(chain, authType);

        // 获取证书链的根证书
        X509Certificate rootCert = chain[chain.length - 1];
        String rootSubjectDn = rootCert.getSubjectDN().getName();

        // 检查根CA是否在允许列表中
        if (!allowedCaSubjectDns.contains(rootSubjectDn)) {
            throw new CertificateException("服务器证书根CA不在允许列表中：" + rootSubjectDn);
        }
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        // 返回允许的CA列表（可选，仅影响客户端证书请求阶段）
        return defaultTrustManager.getAcceptedIssuers();
    }
}

内容的提问来源于stack exchange，提问作者Grodriguez