如何用Java代码自动下载.cer证书（拒绝忽略证书/手动操作）

核心实现思路 #

直接在代码中读取本地或远程的.cer证书文件，将其导入临时内存密钥库，无需手动导入到系统或本地密钥库，再基于该密钥库构建SSL上下文，让WebService客户端使用此上下文完成证书认证，同时集成用户名密码认证逻辑。

代码实现 #

1. 证书加载与SSL上下文构建工具类

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public class SSLContextUtil {
    // 加载.cer证书并构建SSL上下文
    public static SSLContext buildSSLContext(String cerFilePath) throws Exception {
        // 读取.cer证书文件
        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
        X509Certificate cert = (X509Certificate) certFactory.generateCertificate(new FileInputStream(cerFilePath));

        // 创建临时内存密钥库
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(null); // 初始化空密钥库
        trustStore.setCertificateEntry("client-cert", cert); // 将证书存入密钥库

        // 构建TrustManagerFactory
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);

        // 构建SSL上下文
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);

        return sslContext;
    }
}

2. 集成WebService客户端（以JAX-WS为例）

假设你通过wsimport生成了WebService客户端代码，以下是集成认证的示例：

import com.example.webservice.MyWebService;
import com.example.webservice.MyWebServicePortType;
import javax.xml.ws.BindingProvider;
import java.util.Map;

public class WebServiceClient {
    public static void main(String[] args) throws Exception {
        // 构建SSL上下文
        SSLContext sslContext = SSLContextUtil.buildSSLContext("/path/to/your/client.cer");

        // 创建WebService客户端
        MyWebService service = new MyWebService();
        MyWebServicePortType port = service.getMyWebServicePort();

        // 配置SSL上下文到客户端
        BindingProvider bindingProvider = (BindingProvider) port;
        Map<String, Object> requestContext = bindingProvider.getRequestContext();
        requestContext.put("com.sun.xml.ws.transport.https.client.SSLSocketFactory", sslContext.getSocketFactory());

        // 配置用户名密码认证
        requestContext.put(BindingProvider.USERNAME_PROPERTY, "your-username");
        requestContext.put(BindingProvider.PASSWORD_PROPERTY, "your-password");

        // 调用WebService接口
        String result = port.yourWebServiceMethod("param");
        System.out.println("调用结果：" + result);
    }
}

补充：远程下载.cer证书代码 #

如果证书需要从远程地址获取，可先下载到本地临时文件再加载：

import java.io.FileOutputStream;
import java.net.URL;
import java.nio.channels.Channels;
import java.nio.channels.ReadableByteChannel;

public class CertDownloader {
    public static void downloadCert(String certUrl, String savePath) throws Exception {
        URL website = new URL(certUrl);
        ReadableByteChannel rbc = Channels.newChannel(website.openStream());
        FileOutputStream fos = new FileOutputStream(savePath);
        fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
        fos.close();
        rbc.close();
    }
}

注意事项 #

• 若服务端要求双向认证（验证客户端证书），还需将客户端私钥（通常为.p12或.jks格式）加载到密钥库，调整SSLContext.init()方法传入KeyManager数组即可。

内容的提问来源于stack exchange，提问作者Shaheaz