Scala中无需外部库与密钥工具，如何为PUT请求附加证书和密钥？

实现步骤 #

不用依赖Keytool生成密钥库，直接通过Java/Scala原生API加载证书和私钥，构建自定义SSL上下文，再基于Apache HttpClient实现PUT请求：

1. 核心工具方法（加载证书和私钥） #

手动解析PEM格式的证书和私钥，无需外部库：

import java.io.FileInputStream
import java.security._
import java.security.cert.X509Certificate
import java.security.spec.PKCS8EncodedKeySpec
import javax.net.ssl._

// 加载X.509格式证书（支持PEM文件）
def loadCertificate(certPath: String): X509Certificate = {
  val certFactory = CertificateFactory.getInstance("X.509")
  val certStream = new FileInputStream(certPath)
  val cert = certFactory.generateCertificate(certStream).asInstanceOf[X509Certificate]
  certStream.close()
  cert
}

// 加载PKCS#8格式的PEM私钥（需去除头尾标识）
def loadPrivateKey(keyPath: String): PrivateKey = {
  val keyLines = scala.io.Source.fromFile(keyPath).getLines()
    .filterNot(line => line.startsWith("-----BEGIN PRIVATE KEY-----") || line.startsWith("-----END PRIVATE KEY-----"))
    .mkString
  val decodedKey = java.util.Base64.getDecoder.decode(keyLines)
  val keySpec = new PKCS8EncodedKeySpec(decodedKey)
  // 密钥算法根据实际情况调整，比如ECDSA用"EC"，RSA用"RSA"
  val keyFactory = KeyFactory.getInstance("RSA")
  keyFactory.generatePrivate(keySpec)
}

2. 构建支持证书认证的HttpClient #

创建内存中的临时密钥库，生成SSL上下文并初始化HttpClient：

import org.apache.http.impl.client.HttpClients
import org.apache.http.client.methods.HttpPut
import org.apache.http.util.EntityUtils
import org.apache.http.HttpHeaders
import org.apache.http.message.BasicHeader
import org.apache.http.entity.StringEntity
import org.apache.http.entity.ContentType

// 替换为你的证书和私钥路径
val clientCertPath = "/path/to/your/client.crt"
val clientKeyPath = "/path/to/your/client.pem"

// 加载证书和私钥
val clientCert = loadCertificate(clientCertPath)
val clientPrivateKey = loadPrivateKey(clientKeyPath)

// 创建内存密钥库（无需磁盘文件）
val keyStore = KeyStore.getInstance(KeyStore.getDefaultType)
keyStore.load(null, null)
keyStore.setCertificateEntry("client-cert", clientCert)
// 第三个参数为空密码数组，因为我们不需要密钥库密码保护
keyStore.setKeyEntry("client-key", clientPrivateKey, Array.emptyCharArray, Array(clientCert))

// 初始化密钥管理器和信任管理器
val keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
keyManagerFactory.init(keyStore, Array.emptyCharArray)

val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm)
// 如果需要信任自签名的服务器证书，可将服务器CA证书加入keyStore后再初始化
trustManagerFactory.init(keyStore)

// 构建SSL上下文
val sslContext = SSLContext.getInstance("TLS")
sslContext.init(keyManagerFactory.getKeyManagers, trustManagerFactory.getTrustManagers, new SecureRandom())

// 创建带SSL支持的HttpClient
val httpClient = HttpClients.custom()
  .setSSLContext(sslContext)
  .build()

3. 发送HTTPS PUT请求 #

替换原GET请求为PUT，添加请求体并处理响应：

try {
  // 替换为目标HTTPS地址
  val request = new HttpPut("https://localhost:30000/temp/")
  
  // 设置PUT请求体（示例为JSON格式）
  val requestBody = """{"data": "test-content"}"""
  request.setEntity(new StringEntity(requestBody, ContentType.APPLICATION_JSON))
  
  // 设置请求头
  request.addHeader(new BasicHeader(HttpHeaders.CONTENT_TYPE, "application/json"))
  
  // 执行请求并处理响应
  val response = httpClient.execute(request)
  val statusCode = response.getStatusLine.getStatusCode
  val responseData = EntityUtils.toString(response.getEntity)
  
  println(s"响应状态码: $statusCode")
  println(s"响应内容: $responseData")
  
  response.close()
} finally {
  httpClient.close()
}

注意事项 #

• 密钥算法需与实际私钥匹配：如果是ECDSA密钥，将KeyFactory.getInstance("RSA")改为KeyFactory.getInstance("EC")
• 若服务器使用自签名证书，需将服务器的CA证书加载到密钥库的信任条目里，否则会出现SSL握手失败
• 确保证书与私钥是配对的，否则会触发认证失败
• 建议使用try-finally或Scala的Using工具类管理资源，避免连接泄漏

内容的提问来源于stack exchange，提问作者Shailendra Kirtikar