如何从SSLContext中获取KeyManager详情及其所属的credentialMap？

Hey there! Let's break down how to get the KeyManager from an SSLContext and access its credentialMap—since Java's public API doesn't expose this directly, we'll need to use reflection to dig into the internal implementation details.

为什么不能直接获取？ #

Java's SSLContext is a facade class, and the actual implementation (like sun.security.ssl.SSLContextImpl in Oracle/OpenJDK) keeps KeyManager instances as internal state. The public API intentionally hides these details to maintain encapsulation and allow different JSSE implementations to vary.

解决方案：使用反射获取 #

Here's how you can retrieve the KeyManager and its credentialMap with reflection. Note that this depends on the specific JDK implementation (tested on Oracle/OpenJDK 8-17; may not work on other JDKs like IBM's):

public static void main(String[] args) throws Exception {
    SSLContext sslContext = newServerContext(createKeyManagers());
    
    // Step 1: 获取SSLContext内部的SSLContextSpi实现对象
    Field contextSpiField = SSLContext.class.getDeclaredField("contextSpi");
    contextSpiField.setAccessible(true);
    Object sslContextSpi = contextSpiField.get(sslContext);
    
    // Step 2: 从SSLContextImpl中获取KeyManager实例
    Field keyManagerField = sslContextSpi.getClass().getDeclaredField("keyManager");
    keyManagerField.setAccessible(true);
    Object keyManager = keyManagerField.get(sslContextSpi);
    
    // 部分版本中KeyManager可能以数组形式存储，取第一个元素即可
    if (keyManager instanceof KeyManager[]) {
        keyManager = ((KeyManager[]) keyManager)[0];
    }
    
    // Step 3: 从X509KeyManagerImpl中获取credentialMap
    Field credentialMapField = keyManager.getClass().getDeclaredField("credentialMap");
    credentialMapField.setAccessible(true);
    Map<?, ?> credentialMap = (Map<?, ?>) credentialMapField.get(keyManager);
    
    // 打印credentialMap内容
    System.out.println("CredentialMap content:");
    credentialMap.forEach((k, v) -> System.out.println(k + " -> " + v));
}

// 你已实现的newServerContext和createKeyManagers方法保持不变...

重要注意事项 #

• 依赖具体实现: 这种方式依赖contextSpi、keyManager、credentialMap这些非公开的内部字段，字段名或结构可能在未来JDK版本或不同JSSE实现中发生变化。
• 安全限制: 如果运行环境存在安全管理器（现在已很少见），反射访问JDK内部类可能会被阻止。
• 更优替代方案: 如果可以的话，在初始化SSLContext时就保存好KeyManager[]的引用（比如在createKeyManagers()方法调用后直接存储），避免后续依赖内部实现去获取，这才是更稳妥的做法。

内容的提问来源于stack exchange，提问作者Swadeep Mohanty